hive

General

Target

6a0449a0b92dc1b17da219492487de824e86a25284f21e6e3af056fe3f4c4ec0.zip
Size

934KB
Sample

230514-2g8vzagb3y
MD5

9fdf8ec39be304cba57413bc530563fb
SHA1

37353c6d6026b0bc3e7e0db898cca6618a282c46
SHA256

40551d7a3ef688acb99144b131f0b8326d1171b8725ec40c770cc7f3dddb961a
SHA512

f54a82ab8be8cf485179b215740db517facfd782a3af4cd63d9bd4498d1353d3101845dae9b14796aa3b1a7e301f46698d06ca91dc8ec4be3bb712b1c74d77fe
SSDEEP

24576:gC7kSi1Pe3NWFkusJ0eFjgehWeCC4nLlQTDTEVo1uWRqf/2hp:gC7kScPuWFk/hjh2C4n3V6hkfehp

Score

10^/10

Malware Config

Extracted

Path

/4oEi_HOW_TO_DECRYPT.txt

Family

hive

Ransom Note

Your network has been breached and all data were encrypted. Personal data, financial reports and important documents are ready to disclose. To decrypt all the data and to prevent exfiltrated files to be disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/ you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: xUvZHAXDfpoW Password: xvsX47VFucuDKUw4i77C To get an access to .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) Follow the guidelines below to avoid losing your data: - Do not modify, rename or delete *.key.21k5p files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to the Police, FBI, etc. They don't care about your business. They simply won't allow you to pay. As a result you will lose everything. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. - Do not reject to purchase. Exfiltrated files will be publicly disclosed.

URLs

http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

Targets

- Target
  
  6a0449a0b92dc1b17da219492487de824e86a25284f21e6e3af056fe3f4c4ec0.elf
- Size
  
  2.2MB
- MD5
  
  c41d9625ccd175647ffa10484ab2556d
- SHA1
  
  77d7614156607b68265b122fb35a1d408625cb96
- SHA256
  
  6a0449a0b92dc1b17da219492487de824e86a25284f21e6e3af056fe3f4c4ec0
- SHA512
  
  7036bbdd7079b560abcfe3aac1b5951571c318708d48fea340e82185e351c3853091900b31ef0d790ca3309943318620e00f9567440693e89a259b56fc09c9b2
- SSDEEP
  
  49152:kOAAzrb/TYvO90dL3BmAFd4A64nsfJiTZxwuXf9nTCqw0Xfgg778laMex5D1:k1Dw+b3+
Score

10^/10

hive ransomware
- Hive
  A ransomware written in Golang first seen in June 2021.
  ransomware hive
- Deletes itself
- Reads CPU attributes
- Enumerates kernel/hardware configuration
  Reads contents of /sys virtual filesystem to enumerate system information.
- Reads runtime system information
  Reads data from /proc virtual filesystem.
behavioral1