Overview

overview

10

Static

static

1

6a0449a0b9...c0.elf

ubuntu-18.04-amd64

10

Analysis

  • max time kernel
    15s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20221125-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20221125-enkernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    14/05/2023, 06:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6a0449a0b92dc1b17da219492487de824e86a25284f21e6e3af056fe3f4c4ec0.elf

  • Size

    2.2MB

  • MD5

    c41d9625ccd175647ffa10484ab2556d

  • SHA1

    77d7614156607b68265b122fb35a1d408625cb96

  • SHA256

    6a0449a0b92dc1b17da219492487de824e86a25284f21e6e3af056fe3f4c4ec0

  • SHA512

    7036bbdd7079b560abcfe3aac1b5951571c318708d48fea340e82185e351c3853091900b31ef0d790ca3309943318620e00f9567440693e89a259b56fc09c9b2

  • SSDEEP

    49152:kOAAzrb/TYvO90dL3BmAFd4A64nsfJiTZxwuXf9nTCqw0Xfgg778laMex5D1:k1Dw+b3+

Score
10/10
hiveransomware

Malware Config

Extracted

Path

/4oEi_HOW_TO_DECRYPT.txt

Family

hive

Ransom Note
Your network has been breached and all data were encrypted. Personal data, financial reports and important documents are ready to disclose. To decrypt all the data and to prevent exfiltrated files to be disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/ you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: xUvZHAXDfpoW Password: xvsX47VFucuDKUw4i77C To get an access to .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) Follow the guidelines below to avoid losing your data: - Do not modify, rename or delete *.key.21k5p files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to the Police, FBI, etc. They don't care about your business. They simply won't allow you to pay. As a result you will lose everything. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. - Do not reject to purchase. Exfiltrated files will be publicly disclosed.
URLs

http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

Signatures

  • Hive

    A ransomware written in Golang first seen in June 2021.

    ransomwarehive
  • Deletes itself 1 IoCs
  • Reads CPU attributes 1 TTPs 22 IoCs
  • Enumerates kernel/hardware configuration 1 TTPs 64 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/6a0449a0b92dc1b17da219492487de824e86a25284f21e6e3af056fe3f4c4ec0.elf
    /tmp/6a0449a0b92dc1b17da219492487de824e86a25284f21e6e3af056fe3f4c4ec0.elf
    1⤵
      PID:609

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • /4oEi_HOW_TO_DECRYPT.txt
      Filesize

      1KB

      MD5

      9932bbfea02ad4bb0c43b36fddd98a7a

      SHA1

      1faee3c9dbb5f005769c8123387b45cf545cac89

      SHA256

      13f91b1c2c02259660f4d83dd7383b5bbc4f04be98331fbbcf92f1e56f8557a4

      SHA512

      cad236319f2bc80d4223aca681e1adc446ae72dd46530e00aa9887c331b94ac95c9b23c55c3d98c4615cb05da689d68006d75c3f0d213c6f9303ee04f2d4f7ab

      Download Submit

    • /A2tUDjSnJrQ1iNch7wk8rdXDlas6tUVqoVHEbdfYNjX_.key.21k5p
      Filesize

      1.1MB

      MD5

      2f6631527fff8d110f498cf07f82416d

      SHA1

      22b46be6e1d7d94464c441ae3e3a01abdae919ba

      SHA256

      ece024f255faae7606de6854c8dd97a86db2609886c488c2f73285f3e7388efd

      SHA512

      b536a89a770ed72bb74ed820757cbf40da3b9ca6da70f539cfe9759b262df047d16032c8454cc9675f371f2f078bb1a950134d73c2f4b99cfa225705f76c22bf

      Download Submit