Analysis
-
max time kernel
134s -
max time network
133s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20230621-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20230621-enkernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
25-07-2023 23:42
Static task
static1
Behavioral task
behavioral1
Sample
713b699c04f21000fca981e698e1046d4595f423bd5741d712fd7e0bc358c771.elf
Resource
ubuntu1804-amd64-20230621-en
General
-
Target
713b699c04f21000fca981e698e1046d4595f423bd5741d712fd7e0bc358c771.elf
-
Size
2.3MB
-
MD5
171d2a50c6d7e69281d1c3ef98d510f2
-
SHA1
322db4ca435004a127acd4171cc52be9edaf5338
-
SHA256
713b699c04f21000fca981e698e1046d4595f423bd5741d712fd7e0bc358c771
-
SHA512
2226d1a5e9c8a2920fa8d327b53e10f135e9b30c8c3d1e7fbb3a59a51df782f106f41f60ad8140a1de4a81ef6b230418126ffb24bd75eab3c3a298ada2f58913
-
SSDEEP
49152:bC9tUNrb/T7vO90dL3BmAFd4A64nsfJcm9M3YJIpgfDVw0ksgg778GzvyKYUcTD1:bzcM4IyEWyKP
Malware Config
Extracted
/MEag_HOW_TO_DECRYPT.txt
hive
http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/
http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/
Signatures
-
Hive
A ransomware written in Golang first seen in June 2021.
-
Deletes itself 1 IoCs
pid Process 613 713b699c04f21000fca981e698e1046d4595f423bd5741d712fd7e0bc358c771.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads CPU attributes 1 TTPs 22 IoCs
description ioc File opened for reading /sys/devices/system/cpu/cpu0 File opened for reading /sys/devices/system/cpu/cpu0/hotplug File opened for reading /sys/devices/system/cpu/cpu0/power File opened for reading /sys/devices/system/cpu/hotplug File opened for reading /sys/devices/system/cpu/power File opened for reading /sys/devices/system/cpu/cpu0/cache/index0 File opened for reading /sys/devices/system/cpu/cpu0/cache/power File opened for reading /sys/devices/system/cpu/cpu0/cache/index1/power File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/power File opened for reading /sys/devices/system/cpu/cpu0/cache/index3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/power File opened for reading /sys/devices/system/cpu/cpufreq File opened for reading /sys/devices/system/cpu/cpuidle File opened for reading /sys/devices/system/cpu/cpu0/cache File opened for reading /sys/devices/system/cpu/cpu0/cache/index1 File opened for reading /sys/devices/system/cpu/smt File opened for reading /sys/devices/system/cpu/vulnerabilities File opened for reading /sys/devices/system/cpu/cpu0/microcode File opened for reading /sys/devices/system/cpu/cpu0/topology File opened for reading /sys/devices/system/cpu/microcode File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/power File opened for reading /sys/devices/system/cpu/cpu0/cache/index2 -
Reads hardware information 1 TTPs 1 IoCs
Accesses system info like serial numbers, manufacturer names etc.
description ioc File opened for reading /sys/devices/virtual/dmi/id/power -
Reads network interface configuration 2 TTPs 12 IoCs
Fetches information about one or more active network interfaces.
description ioc File opened for reading /sys/devices/pci0000:00/0000:00:03.0/net/ens3/queues/tx-0 File opened for reading /sys/devices/pci0000:00/0000:00:03.0/net/ens3/queues/tx-0/byte_queue_limits File opened for reading /sys/devices/virtual/net/lo/queues File opened for reading /sys/devices/virtual/net/lo/queues/tx-0 File opened for reading /sys/devices/virtual/net/lo/statistics File opened for reading /sys/devices/pci0000:00/0000:00:03.0/net/ens3/power File opened for reading /sys/devices/pci0000:00/0000:00:03.0/net/ens3/queues File opened for reading /sys/devices/virtual/net/lo/power File opened for reading /sys/devices/virtual/net/lo/queues/rx-0 File opened for reading /sys/devices/virtual/net/lo/queues/tx-0/byte_queue_limits File opened for reading /sys/devices/pci0000:00/0000:00:03.0/net/ens3/queues/rx-0 File opened for reading /sys/devices/pci0000:00/0000:00:03.0/net/ens3/statistics -
Enumerates kernel/hardware configuration 1 TTPs 64 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc File opened for reading /sys/devices/virtual/tty/tty57 File opened for reading /sys/kernel/debug/tracing/events/ftrace/mmiotrace_rw File opened for reading /sys/kernel/debug/tracing/events/syscalls/sys_enter_swapon File opened for reading /sys/devices/pci0000:00/0000:00:05.0/usb1/1-0:1.0/usb1-port4 File opened for reading /sys/devices/platform/serial8250/tty/ttyS17/power File opened for reading /sys/kernel/slab/:0000032 File opened for reading /sys/devices/virtual/block/loop0/mq/0/cpu0 File opened for reading /sys/kernel/slab/:A-0000128/cgroup File opened for reading /sys/module/virtio_gpu/sections File opened for reading /sys/devices/pci0000:00/0000:00:02.0/virtio0/drm/card0 File opened for reading /sys/devices/pci0000:00/0000:00:04.0/ata4/host3/target3:0:0/3:0:0:0/block/sr0/queue/iosched File opened for reading /sys/kernel/slab/dax_cache File opened for reading /sys/module/rcupdate/parameters File opened for reading /sys/devices/pci0000:00/0000:00:04.0/ata5/ata_port File opened for reading /sys/fs/cgroup/hugetlb File opened for reading /sys/kernel/debug/block/loop5/hctx0/cpu0 File opened for reading /sys/kernel/debug/tracing/events/syscalls/sys_exit_acct File opened for reading /sys/module/hid_generic/holders File opened for reading /sys/devices/platform/i8042/serio1/id File opened for reading /sys/kernel/debug/tracing/events/fib/fib_validate_source File opened for reading /sys/kernel/debug/tracing/events/syscalls/sys_exit_connect File opened for reading /sys/kernel/debug/tracing/events/syscalls/sys_exit_fcntl File opened for reading /sys/kernel/debug/tracing/events/xhci-hcd/xhci_ring_free File opened for reading /sys/bus/mdio_bus/drivers File opened for reading /sys/fs/cgroup/cpu,cpuacct/user.slice File opened for reading /sys/kernel/debug/tracing/events/syscalls/sys_enter_renameat File opened for reading /sys/kernel/debug/tracing/events/syscalls/sys_exit_mlock2 File opened for reading /sys/module/mac_hid/notes File opened for reading /sys/kernel/slab/:0008192/cgroup File opened for reading /sys/devices/pci0000:00/0000:00:04.0/ata3/ata_port/ata3 File opened for reading /sys/devices/software File opened for reading /sys/kernel/debug/tracing/events/syscalls/sys_exit_getpid File opened for reading /sys/kernel/slab/:0000192/cgroup File opened for reading /sys/devices/virtual/misc/rfkill/power File opened for reading /sys/kernel/debug/tracing/events/x86_fpu/x86_fpu_regs_deactivated File opened for reading /sys/kernel/debug/tracing/events/syscalls/sys_enter_getresgid File opened for reading /sys/kernel/debug/tracing/events/syscalls/sys_exit_setitimer File opened for reading /sys/module/libahci File opened for reading /sys/bus/pci/drivers/serial File opened for reading /sys/devices/pci0000:00/0000:00:02.0/virtio0/drm/renderD128/power File opened for reading /sys/devices/virtual/tty/tty8 File opened for reading /sys/kernel/debug/block/loop5 File opened for reading /sys/kernel/debug/block/loop6/hctx0 File opened for reading /sys/devices/power/events File opened for reading /sys/kernel/debug/tracing/events/ext4/ext4_direct_IO_enter File opened for reading /sys/kernel/debug/tracing/events/ext4/ext4_trim_all_free File opened for reading /sys/kernel/debug/tracing/events/dma_fence/dma_fence_wait_end File opened for reading /sys/kernel/debug/tracing/events/oom/mark_victim File opened for reading /sys/bus/rapidio/drivers File opened for reading /sys/kernel/debug/tracing/events/mdio/mdio_access File opened for reading /sys/module/sg/parameters File opened for reading /sys/devices/system/memory/memory10 File opened for reading /sys/devices/virtual/tty/tty47 File opened for reading /sys/kernel/debug/tracing/events/syscalls/sys_exit_fanotify_mark File opened for reading /sys/devices/pci0000:00/0000:00:04.0/ata7/link7/dev7.0/power File opened for reading /sys/kernel/debug/tracing/events/huge_memory/mm_collapse_huge_page_isolate File opened for reading /sys/kernel/debug/tracing/events/xdp/xdp_redirect_map_err File opened for reading /sys/kernel/debug/tracing/events/xhci-hcd/xhci_dbg_context_change File opened for reading /sys/module/virtio_pci/parameters File opened for reading /sys/module/zswap File opened for reading /sys/devices/pci0000:00/0000:00:05.0/usb1/1-1/power File opened for reading /sys/fs/cgroup/systemd/user.slice/user-0.slice/[email protected]/init.scope File opened for reading /sys/module/hid/parameters File opened for reading /sys/module/virtio_gpu/holders -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc File opened for reading /proc/169/task/169/net/dev_snmp6 File opened for reading /proc/18/task/18/net/stat File opened for reading /proc/20/task/20/net/dev_snmp6 File opened for reading /proc/448/task File opened for reading /proc/194/task/194/net/netfilter File opened for reading /proc/31/fd File opened for reading /proc/irq/6/floppy File opened for reading /proc/169/fdinfo File opened for reading /proc/171/attr/apparmor File opened for reading /proc/34/fd File opened for reading /proc/355/map_files File opened for reading /proc/390/net/stat File opened for reading /proc/626/ns File opened for reading /proc/81/ns File opened for reading /proc/156/ns File opened for reading /proc/170/fdinfo File opened for reading /proc/27/map_files File opened for reading /proc/27/net/stat File opened for reading /proc/613/task/616/net/dev_snmp6 File opened for reading /proc/634/task/634/fd File opened for reading /proc/sys/net/ipv6/route File opened for reading /proc/28/task/28/attr/apparmor File opened for reading /proc/34/task File opened for reading /proc/428/task/428/net/stat File opened for reading /proc/626/task/640/attr/selinux File opened for reading /proc/84/task/84/attr File opened for reading /proc/irq/25 File opened for reading /proc/sys/dev/raid File opened for reading /proc/11/net File opened for reading /proc/169/net File opened for reading /proc/5/net/netfilter File opened for reading /proc/79 File opened for reading /proc/82/net/dev_snmp6 File opened for reading /proc/155/task/155/net/dev_snmp6 File opened for reading /proc/170/task/170 File opened for reading /proc/34/attr/apparmor File opened for reading /proc/6/task/6/attr/smack File opened for reading /proc/613/task/616/net File opened for reading /proc/9/task/9 File opened for reading /proc/26/net/dev_snmp6 File opened for reading /proc/355/fd File opened for reading /proc/634/task/641/attr/apparmor File opened for reading /proc/82/task/82/fd File opened for reading /proc/irq/29 File opened for reading /proc/82/task/82/fdinfo File opened for reading /proc/15/task/15/attr/selinux File opened for reading /proc/165/task/165/net File opened for reading /proc/171/task/171/net/dev_snmp6 File opened for reading /proc/355/task/355/fdinfo File opened for reading /proc/448/net File opened for reading /proc/634/net File opened for reading /proc/79/task/79/attr/apparmor File opened for reading /proc/irq/25/virtio1-req.0 File opened for reading /proc/611/attr/selinux File opened for reading /proc/98/map_files File opened for reading /proc/168/attr/smack File opened for reading /proc/18/task/18/attr File opened for reading /proc/18/task/18/fdinfo File opened for reading /proc/453/attr/apparmor File opened for reading /proc/626/attr/apparmor File opened for reading /proc/133/task/133/fdinfo File opened for reading /proc/155/task/155/net File opened for reading /proc/98/net/stat File opened for reading /proc/115
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD534c4726e2ada91ab19052331c17b6e73
SHA1e570fb680b1739c3cebaa264f6c7be50d6485c33
SHA25643c92f80332f081010bbb974bb04d81c9db43028338b70f038f19dc1cd2ac659
SHA512918182cc54721c4cb2d25ae28496b3a841a7c5c89650db820f4db8a8c0bec9c299c53fcc878d9f872eee0f7ddd541e3143c05781e5c34f613f00aa62caad7f5f
-
Filesize
1KB
MD524a4eff548b411e7716858ce77d60240
SHA1757acc90bccf8dc11a1440015b4d02dcb7962d35
SHA2569f3cb32b4ea42ee56ba952a09af75c5a180488d33945bb06f97df944183a46a0
SHA51261abe02146c8a2d29c76f0625170cbcb903e8fc8bbf7f4fd4afcdcff70972f3042dc19a741fa5a3756ca0eb2f0e3dbf4fbb6a192e8897d952607f211177844be