Overview

overview

10

Static

static

1

713b699c04...58c771

ubuntu-18.04-amd64

10

Analysis

  • max time kernel
    139s
  • platform
    linux_amd64
  • resource
    ubuntu1804-amd64-en-20211208
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    10-06-2023 01:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    713b699c04f21000fca981e698e1046d4595f423bd5741d712fd7e0bc358c771

  • Size

    2.3MB

  • MD5

    171d2a50c6d7e69281d1c3ef98d510f2

  • SHA1

    322db4ca435004a127acd4171cc52be9edaf5338

  • SHA256

    713b699c04f21000fca981e698e1046d4595f423bd5741d712fd7e0bc358c771

  • SHA512

    2226d1a5e9c8a2920fa8d327b53e10f135e9b30c8c3d1e7fbb3a59a51df782f106f41f60ad8140a1de4a81ef6b230418126ffb24bd75eab3c3a298ada2f58913

  • SSDEEP

    49152:bC9tUNrb/T7vO90dL3BmAFd4A64nsfJcm9M3YJIpgfDVw0ksgg778GzvyKYUcTD1:bzcM4IyEWyKP

Score
10/10
hiveransomware

Malware Config

Extracted

Path

/MEag_HOW_TO_DECRYPT.txt

Family

hive

Ransom Note
Your network has been breached and all data were encrypted. Personal data, financial reports and important documents are ready to disclose. To decrypt all the data and to prevent exfiltrated files to be disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/ you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: 5mX2Ja7tXTQd Password: 36VFJGoJ6t4qhgbHLXyJ To get an access to .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) Follow the guidelines below to avoid losing your data: - Do not modify, rename or delete *.key.ndjmu files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to the Police, FBI, etc. They don't care about your business. They simply won't allow you to pay. As a result you will lose everything. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. - Do not reject to purchase. Exfiltrated files will be publicly disclosed.
URLs

http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

Signatures

  • Hive

    A ransomware written in Golang first seen in June 2021.

    ransomwarehive
  • Deletes itself 1 IoCs
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads CPU attributes 1 TTPs 22 IoCs
  • Reads hardware information 1 TTPs 1 IoCs

    Accesses system info like serial numbers, manufacturer names etc.

  • Reads network interface configuration 2 TTPs 12 IoCs

    Fetches information about one or more active network interfaces.

  • Enumerates kernel/hardware configuration 1 TTPs 64 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/713b699c04f21000fca981e698e1046d4595f423bd5741d712fd7e0bc358c771
    /tmp/713b699c04f21000fca981e698e1046d4595f423bd5741d712fd7e0bc358c771
    1⤵
    • Deletes itself
    • Enumerates kernel/hardware configuration
    PID:596

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • /MEag_HOW_TO_DECRYPT.txt
    Filesize

    1KB

    MD5

    24a4eff548b411e7716858ce77d60240

    SHA1

    757acc90bccf8dc11a1440015b4d02dcb7962d35

    SHA256

    9f3cb32b4ea42ee56ba952a09af75c5a180488d33945bb06f97df944183a46a0

    SHA512

    61abe02146c8a2d29c76f0625170cbcb903e8fc8bbf7f4fd4afcdcff70972f3042dc19a741fa5a3756ca0eb2f0e3dbf4fbb6a192e8897d952607f211177844be

    Download Submit

  • /Y84UNN1Y_iEJ0c6cEN5YqNInGP_1_Jz06Gis3-9LoMj_.key.ndjmu
    Filesize

    1.2MB

    MD5

    03e179a1cf7bc8f04767aff64bb1d60a

    SHA1

    5b0a8379f8f72aedd5d55191f2b65425ffe5d72e

    SHA256

    192d37aa2d69492ad896de28f0b8d812f026f3835de52b05a3711bd62c7d6f1f

    SHA512

    ba6c61758f2a5c2a3ad83e72ff22fbac3f577321cd31b014dc2e8ba9f8509aa4d691c8b8865ccb119b7002fcb493583ee4cb2656c7cd3d7980f77fc991b36757

    Download Submit