hive

General

Target

quickbuck.exe
Size

3.0MB
Sample

220609-er1wsagdc2
MD5

5764e41fede27bf9c984242c2b7bfd33
SHA1

e5b4178bdebf7a59e97c56235cff472b18440359
SHA256

1283836cc0ed21b535ca654611d87e766538b81b02e61289ecc94188602aaf2a
SHA512

a3610ca12b1ebfd0a618fae7c0e8f655d879156a0b850c4dd8e0e8827d6719f67ad5facad7496aac3adcafbf79f0195adb5ab62d900202f07ed4ec380e516379

Score

10^/10

hive ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\ransomware-simulator-note.txt

Family

hive

Ransom Note

Your network has been breached and all data were encrypted. Personal data, financial reports and important documents are ready to disclose.To decrypt all the data or to prevent exfiltrated files to be disclosed at http://thisisafakeonionaddress.onion/ you will need to purchase our decryption software.Please contact our sales department at: REDACTED Login: REDACTED Password: REDACTED To get access to .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) Follow the guidelines below to avoid losing your data: – Do not shutdown or reboot your computers, unmount external storages. – Do not try to decrypt data using third party software. It may cause irreversible damage. – Do not fool yourself. Encryption has perfect secrecy and it’s impossible to decrypt without knowing the key. – Do not modify, rename or delete *.key.k6thw files. Your data will be undecryptable. – Do not modify or rename encrypted files. You will lose them. – Do not report to authorities. The negotiation process will be terminated immediately and the key will be erased. – Do not reject to purchase. Your sensitive data will be publicly disclosed.

URLs

http://thisisafakeonionaddress.onion/

Targets

- Target
  
  quickbuck.exe
- Size
  
  3.0MB
- MD5
  
  5764e41fede27bf9c984242c2b7bfd33
- SHA1
  
  e5b4178bdebf7a59e97c56235cff472b18440359
- SHA256
  
  1283836cc0ed21b535ca654611d87e766538b81b02e61289ecc94188602aaf2a
- SHA512
  
  a3610ca12b1ebfd0a618fae7c0e8f655d879156a0b850c4dd8e0e8827d6719f67ad5facad7496aac3adcafbf79f0195adb5ab62d900202f07ed4ec380e516379
Score

10^/10

hive ransomware
- Hive
  A ransomware written in Golang first seen in June 2021.
  ransomware hive
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Executes dropped EXE
behavioral1