hive

General

Target

kill.zip
Size

934KB
Sample

230514-he7eksdc5w
MD5

2ae89e979cad2dba8f6915ef98e46f6d
SHA1

eafeebf5568f30ca106ac6b062b03e32c11dce46
SHA256

2c2778d631771268a20f943643256bd054d6dd964c85bb30ab862f36de12b5b9
SHA512

b7ea6097bb1874c94c6f42ef414d54149213be005d2bb9feb86da2b621bf6d90b24f622ca9f4767f303c514010fdb5ddab536433210cbf97bba106da382636da
SSDEEP

24576:qtRK3z9v29SdyeB/KEKqdWGsMav/R3Xl9bTh5:eK3zg9Ss/7Guv/RnDl5

Score

10^/10

Malware Config

Extracted

Path

/4oEi_HOW_TO_DECRYPT.txt

Family

hive

Ransom Note

Your network has been breached and all data were encrypted. Personal data, financial reports and important documents are ready to disclose. To decrypt all the data and to prevent exfiltrated files to be disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/ you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: xUvZHAXDfpoW Password: xvsX47VFucuDKUw4i77C To get an access to .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) Follow the guidelines below to avoid losing your data: - Do not modify, rename or delete *.key.21k5p files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to the Police, FBI, etc. They don't care about your business. They simply won't allow you to pay. As a result you will lose everything. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. - Do not reject to purchase. Exfiltrated files will be publicly disclosed.

URLs

http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

Targets

- Target
  
  6a0449a0b92dc1b17da219492487de824e86a25284f21e6e3af056fe3f4c4ec0.elf
- Size
  
  2.2MB
- MD5
  
  c41d9625ccd175647ffa10484ab2556d
- SHA1
  
  77d7614156607b68265b122fb35a1d408625cb96
- SHA256
  
  6a0449a0b92dc1b17da219492487de824e86a25284f21e6e3af056fe3f4c4ec0
- SHA512
  
  7036bbdd7079b560abcfe3aac1b5951571c318708d48fea340e82185e351c3853091900b31ef0d790ca3309943318620e00f9567440693e89a259b56fc09c9b2
- SSDEEP
  
  49152:kOAAzrb/TYvO90dL3BmAFd4A64nsfJiTZxwuXf9nTCqw0Xfgg778laMex5D1:k1Dw+b3+
Score

10^/10

hive ransomware
- Hive
  A ransomware written in Golang first seen in June 2021.
  ransomware hive
- Deletes itself
- Reads CPU attributes
- Enumerates kernel/hardware configuration
  Reads contents of /sys virtual filesystem to enumerate system information.
- Reads runtime system information
  Reads data from /proc virtual filesystem.
behavioral1