Overview

overview

10

Static

static

1

6a0449a0b9...c0.elf

debian-9-armhf

6a0449a0b9...c0.elf

debian-9-mips

6a0449a0b9...c0.elf

debian-9-mipsel

6a0449a0b9...c0.elf

ubuntu-18.04-amd64

10

Resubmissions

14-05-2023 22:34

230514-2g8vzagb3y 10

14-05-2023 10:00

230514-l13kasbe76 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6a0449a0b92dc1b17da219492487de824e86a25284f21e6e3af056fe3f4c4ec0.zip

  • Size

    934KB

  • Sample

    230514-l13kasbe76

  • MD5

    9fdf8ec39be304cba57413bc530563fb

  • SHA1

    37353c6d6026b0bc3e7e0db898cca6618a282c46

  • SHA256

    40551d7a3ef688acb99144b131f0b8326d1171b8725ec40c770cc7f3dddb961a

  • SHA512

    f54a82ab8be8cf485179b215740db517facfd782a3af4cd63d9bd4498d1353d3101845dae9b14796aa3b1a7e301f46698d06ca91dc8ec4be3bb712b1c74d77fe

  • SSDEEP

    24576:gC7kSi1Pe3NWFkusJ0eFjgehWeCC4nLlQTDTEVo1uWRqf/2hp:gC7kScPuWFk/hjh2C4n3V6hkfehp

Score
10/10
hivelinuxransomware

Malware Config

Extracted

Path

/4oEi_HOW_TO_DECRYPT.txt

Family

hive

Ransom Note
Your network has been breached and all data were encrypted. Personal data, financial reports and important documents are ready to disclose. To decrypt all the data and to prevent exfiltrated files to be disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/ you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: xUvZHAXDfpoW Password: xvsX47VFucuDKUw4i77C To get an access to .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) Follow the guidelines below to avoid losing your data: - Do not modify, rename or delete *.key.21k5p files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to the Police, FBI, etc. They don't care about your business. They simply won't allow you to pay. As a result you will lose everything. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. - Do not reject to purchase. Exfiltrated files will be publicly disclosed.
URLs

http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

Targets

    • Target

      6a0449a0b92dc1b17da219492487de824e86a25284f21e6e3af056fe3f4c4ec0.elf

    • Size

      2.2MB

    • MD5

      c41d9625ccd175647ffa10484ab2556d

    • SHA1

      77d7614156607b68265b122fb35a1d408625cb96

    • SHA256

      6a0449a0b92dc1b17da219492487de824e86a25284f21e6e3af056fe3f4c4ec0

    • SHA512

      7036bbdd7079b560abcfe3aac1b5951571c318708d48fea340e82185e351c3853091900b31ef0d790ca3309943318620e00f9567440693e89a259b56fc09c9b2

    • SSDEEP

      49152:kOAAzrb/TYvO90dL3BmAFd4A64nsfJiTZxwuXf9nTCqw0Xfgg778laMex5D1:k1Dw+b3+

    Score
    10/10
    hiveransomware

    • Hive

      A ransomware written in Golang first seen in June 2021.

      ransomwarehive

    • Deletes itself

    • Reads CPU attributes

    • Enumerates kernel/hardware configuration

      Reads contents of /sys virtual filesystem to enumerate system information.

    • Reads runtime system information

      Reads data from /proc virtual filesystem.

    behavioral1behavioral2behavioral3behavioral4

MITRE ATT&CK Enterprise v6

Tasks