Overview

overview

10

Static

static

1

Filecoder....ux.bin

ubuntu-18.04-amd64

10

Resubmissions

03-03-2024 13:05

240303-qbxpzabd88 10

24-05-2023 16:08

230524-tk9bxadc98 3

23-05-2023 16:48

230523-vbmbfsha9z 10

29-10-2021 20:23

211029-y55axaagcj 1

Analysis

  • max time kernel
    12s
  • platform
    linux_amd64
  • resource
    ubuntu1804-amd64-en-20211208
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    23-05-2023 16:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Filecoder.Hive_linux.bin

  • Size

    2.2MB

  • MD5

    c41d9625ccd175647ffa10484ab2556d

  • SHA1

    77d7614156607b68265b122fb35a1d408625cb96

  • SHA256

    6a0449a0b92dc1b17da219492487de824e86a25284f21e6e3af056fe3f4c4ec0

  • SHA512

    7036bbdd7079b560abcfe3aac1b5951571c318708d48fea340e82185e351c3853091900b31ef0d790ca3309943318620e00f9567440693e89a259b56fc09c9b2

  • SSDEEP

    49152:kOAAzrb/TYvO90dL3BmAFd4A64nsfJiTZxwuXf9nTCqw0Xfgg778laMex5D1:k1Dw+b3+

Score
10/10
hiveransomware

Malware Config

Extracted

Path

/4oEi_HOW_TO_DECRYPT.txt

Family

hive

Ransom Note
Your network has been breached and all data were encrypted. Personal data, financial reports and important documents are ready to disclose. To decrypt all the data and to prevent exfiltrated files to be disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/ you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: xUvZHAXDfpoW Password: xvsX47VFucuDKUw4i77C To get an access to .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) Follow the guidelines below to avoid losing your data: - Do not modify, rename or delete *.key.21k5p files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to the Police, FBI, etc. They don't care about your business. They simply won't allow you to pay. As a result you will lose everything. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. - Do not reject to purchase. Exfiltrated files will be publicly disclosed.
URLs

http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

Signatures

  • Hive

    A ransomware written in Golang first seen in June 2021.

    ransomwarehive
  • Deletes itself 1 IoCs
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads CPU attributes 1 TTPs 22 IoCs
  • Reads hardware information 1 TTPs 1 IoCs

    Accesses system info like serial numbers, manufacturer names etc.

  • Reads network interface configuration 2 TTPs 12 IoCs

    Fetches information about one or more active network interfaces.

  • Enumerates kernel/hardware configuration 1 TTPs 64 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/Filecoder.Hive_linux.bin
    /tmp/Filecoder.Hive_linux.bin
    1⤵
    • Deletes itself
    • Reads runtime system information
    PID:598

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • /4oEi_HOW_TO_DECRYPT.txt
    Filesize

    1KB

    MD5

    9932bbfea02ad4bb0c43b36fddd98a7a

    SHA1

    1faee3c9dbb5f005769c8123387b45cf545cac89

    SHA256

    13f91b1c2c02259660f4d83dd7383b5bbc4f04be98331fbbcf92f1e56f8557a4

    SHA512

    cad236319f2bc80d4223aca681e1adc446ae72dd46530e00aa9887c331b94ac95c9b23c55c3d98c4615cb05da689d68006d75c3f0d213c6f9303ee04f2d4f7ab

    Download Submit

  • /CfsNtyhA0ovoGEwfknQp4YDD5Z9x8fDtjrbgkdPuFlj_.key.21k5p
    Filesize

    1.1MB

    MD5

    a0294aa50b6d7d2fcfe9c71aa2a9b129

    SHA1

    968e4c146ebf5f4fab168389d16b174547a2bdec

    SHA256

    d6f1f9ec67edafb91e71b1bc674c2a4a341ebf729a5eb1239308a22904b6ab1e

    SHA512

    e88bc0f1e74b2be78f45c0dc4d842ef7d728a848a3a277245687483c3daae25df67879f4454d97a1bb299f767dccb2fcdee7dd441d82112dbee1bfea79a12cac

    Download Submit