Overview

overview

10

Static

static

7

211xahcou.exe

windows7-x64

10

211xahcou.exe

windows10-1703-x64

10

Hive.elf

windows7-x64

3

Hive.elf

windows10-1703-x64

3

hive.exe

windows7-x64

10

hive.exe

windows10-1703-x64

10

hive_linux_elf

windows7-x64

1

hive_linux_elf

windows10-1703-x64

1

linux_hive.elf

windows7-x64

3

linux_hive.elf

windows10-1703-x64

3

sjl8j6ap3.exe

windows7-x64

1

sjl8j6ap3.exe

windows10-1703-x64

1

windows_25...c5.exe

windows7-x64

10

windows_25...c5.exe

windows10-1703-x64

10

zi1ysv64h.exe

windows7-x64

10

zi1ysv64h.exe

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Ransomware.Hive.zip

  • Size

    6.6MB

  • Sample

    240212-js4raaab24

  • MD5

    33dc6cf9108fa7a395d632c29021791c

  • SHA1

    61ccffbfb8f2458be139aa1d3c9dd715f25cd06d

  • SHA256

    af9e8f301a3677b457345921d7ee765a842eceb7df107714eaffc6193bfc6bbe

  • SHA512

    5b7206cd076e313f15a13c4f6278ea80c109577530bc43614efc631aeb8b53f8b0abba1135298ba6b6b7fa2f19321ab673b257d3b4c0cbc95bd4c50c8040466d

  • SSDEEP

    196608:xUPLIETGA/+0vcL5o/Vu0vlQ77Z0SOJM7j:xmJ6ANa6/Vu0q3+SOw

Score
10/10
hiveevasionpersistenceransomwarespywarestealertrojanupx

Malware Config

Extracted

Path

C:\Program Files\n8pw_HOW_TO_DECRYPT.txt

Family

hive

Ransom Note
Your network has been breached and all data were encrypted. Personal data, financial reports and important documents are ready to disclose. To decrypt all the data and to prevent exfiltrated files to be disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/ you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: fTP4dtHQ51ZX Password: 7zC1gVatfxGNUwxnLe4e To get an access to .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) Follow the guidelines below to avoid losing your data: - Do not modify, rename or delete *.key.cv2gj files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to the Police, FBI, etc. They don't care about your business. They simply won't allow you to pay. As a result you will lose everything. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. - Do not reject to purchase. Exfiltrated files will be publicly disclosed.
URLs

http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

Extracted

Path

C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\EGdu_HOW_TO_DECRYPT.txt

Family

hive

Ransom Note
Your network has been breached and all data were encrypted. Personal data, financial reports and important documents are ready to disclose. To decrypt all the data or to prevent exfiltrated files to be disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/ you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: jxkdVr8zZs5J Password: GHTM6Qgqyhqs4nMH53ZD To get access to .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) Follow the guidelines below to avoid losing your data: - Do not shutdown or reboot your computers, unmount external storages. - Do not try to decrypt data using third party software. It may cause irreversible damage. - Do not fool yourself. Encryption has perfect secrecy and it's impossible to decrypt without knowing the key. - Do not modify, rename or delete *.key.uj1ps files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to authorities. The negotiation process will be terminated immediately and the key will be erased. - Do not reject to purchase. Your sensitive data will be publicly disclosed.
URLs

http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

Extracted

Path

C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\K8zJ_HOW_TO_DECRYPT.txt

Family

hive

Ransom Note
Your network has been breached and all data were encrypted. Personal data, financial reports and important documents are ready to disclose. To decrypt all the data and to prevent exfiltrated files to be disclosed at you will need to purchase our decryption software. Please contact our sales department at: Login: Password: To get an access to .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) Follow the guidelines below to avoid losing your data: - Do not modify, rename or delete *.key.2o4xo files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to the Police, FBI, etc. They don't care about your business. They simply won't allow you to pay. As a result you will lose everything. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. - Do not reject to purchase. Exfiltrated files will be publicly disclosed.

Extracted

Path

C:\MSOCache\HOW_TO_DECRYPT.txt

Family

hive

Ransom Note
Your network has been breached and all data is encrypted. To decrypt all the data you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: EQA9oydTxwXS Password: vNtgAgb3kMFmCooANNQr Follow the guidelines below to avoid losing your data: - Do not shutdown or reboot your computers, unmount external storages. - Do not try to decrypt data using third party software. It may cause irreversible damage. - Do not fool yourself. Encryption has perfect secrecy and it's impossible to decrypt without knowing the key. - Do not modify, rename or delete *.key.hive files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to authorities. The negotiation process will be terminated immediately and the key will be erased. - Do not reject to purchase. Your sensitive data will be publicly disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/
URLs

http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

Targets

    • Target

      211xahcou.dll

    • Size

      3.9MB

    • MD5

      0e4d44dde522c07d09d9e3086cfae803

    • SHA1

      d8dc26e2094869a0da78ecb47494c931419302dc

    • SHA256

      33aceb3dc0681a56226d4cfce32eee7a431e66f5c746a4d6dc7506a72b317277

    • SHA512

      ac1f269b028217210a72fc5c2e0cb07461e2ff896f8b5ba65771787f99ec34b0f9951cf73d9d387086f79c348c343d147aebc2fd5b7e18da009bc2041e2eee06

    • SSDEEP

      49152:e2NiZPNNirb/T2vO90dL3BmAFd4A64nsfJk0NuXCdmTQb0/6VCrrPrsbg11VgWA2:e2ANB04yIa0hsirubO

    Score
    10/10
    hiveevasionransomwaretrojan

    • Deletes Windows Defender Definitions

      Uses mpcmdrun utility to delete all AV definitions.

      evasion

    • Hive

      A ransomware written in Golang first seen in June 2021.

      ransomwarehive

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Modifies security service

      evasion

    • Clears Windows event logs

      evasionransomware

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Renames multiple (73) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware
    behavioral1behavioral2

    • Target

      Hive.elf

    • Size

      246KB

    • MD5

      22ae3e19ec54a9d314719158c00986e3

    • SHA1

      84353fe08dd87eb2f1086dfd08c014311e7e4889

    • SHA256

      822d89e7917d41a90f5f65bee75cad31fe13995e43f47ea9ea536862884efc25

    • SHA512

      a72a3e8fb908c2ed946b9266cc742b1584709205f1911e381823ef7caac10d55ccec2f35c3e7ca4a3eda7e04e1b57ec2039054c087fdc39241554cd82b62570e

    • SSDEEP

      3072:3Zp7gZzdfvjRCMj1Yk36ioyJ1zgjIlOhXYopNL+V7o0xvvkB/37Nt7xhew8A2Mzc:P7gDj8S1Hlx14+opNClvk977ew8A2M

    Score
    3/10
    behavioral3behavioral4

    • Target

      hive.bin_exe

    • Size

      764KB

    • MD5

      2f9fc82898d718f2abe99c4a6fa79e69

    • SHA1

      9d336b8911c8ffd7cc809e31d5b53796bb0cc7bb

    • SHA256

      88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1

    • SHA512

      19f0879b1c54d305ab7a97a0d46ab79c103d4687fe37d5f9ef1934904eea48a1c66b1ac2de3dace6dc0d91623309287044c198cb0b3fc9f8453fbc9d1c0cae8b

    • SSDEEP

      12288:CinNFNkY/yU97ppM4NSBG81Np2C9H4S3iDjlLtc4wCIITIQaOI6NrwacVYV+4MsT:CinN3n/y67jM4v4kCSPDjlLtbwt8IQLH

    Score
    10/10
    hivepersistenceransomwarespywarestealerupx

    • Detects Go variant of Hive Ransomware

    • Hive

      A ransomware written in Golang first seen in June 2021.

      ransomwarehive

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Drops file in Drivers directory

    • Modifies Installed Components in the registry

      persistence

    • Deletes itself

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops desktop.ini file(s)

    • Drops file in System32 directory

    behavioral5behavioral6

    • Target

      hive_linux_elf

    • Size

      2.4MB

    • MD5

      d3b0102e6632be81ce158c909f583412

    • SHA1

      10bd0f1d3122d6575e882ba8f025eb11b0a95b61

    • SHA256

      bdf3d5f4f1b7c90dfc526340e917da9e188f04238e772049b2a97b4f88f711e3

    • SHA512

      cd7c7d5cd4531fbd11d2c0e4fccfaad485fb804621b6a692dd4f640ac048bb6f596314b655df94f96788cbbcd64bf54e2285697db93b1ce4123852c9c9e00d39

    • SSDEEP

      49152:oBWlwme8nhvmR52bzPOA1nsRTuIQflLQn+MJ3m+02D1:YmeQhvmS/R1nsF

    Score
    1/10
    behavioral7behavioral8

    • Target

      linux_hive.elf

    • Size

      2.3MB

    • MD5

      56075e7c63b3f9f612cde6187d4a7877

    • SHA1

      1bcfa979b7b9044ba5ce5c006bd26b0bdbeb8464

    • SHA256

      12389b8af28307fd09fe080fd89802b4e616ed4c961f464f95fdb4b3f0aaf185

    • SHA512

      7df68e37b3c2e7ce197f0d8736d06adf808343fe2d638bcd3e0f285968e1365c06b33157c6e5816b9fa9362e6adc262d3d2da45d3d1a38efb7e2ce980fce8b80

    • SSDEEP

      49152:TzVcrxrb/TGvO90dL3BmAFd4A64nsfJbJ5PhTZDknzImQXNqw0Xfgg778lwQJKTS:TcbP/kB30JKT

    Score
    3/10
    behavioral10behavioral9

    • Target

      sjl8j6ap3.dll

    • Size

      661KB

    • MD5

      7692a5dca7c3c48095aa6db0db640d4a

    • SHA1

      268faa86ae921da264264f392b541a9facc3bdf5

    • SHA256

      b6b1ea26464c92c3d25956815c301caf6fa0da9723a2ef847e2bb9cd11563d8b

    • SHA512

      2e8c4c0ed23dffc2494e39654f0cec03e4ad6bd4c04a80342afa7ad412d1a3dbcbf4a4cab7841354ca6bc2932252eaacfaf7f0abe3f9380e30eed14a610cc882

    • SSDEEP

      12288:BLF6OtM1z8JLbA689tSfvTvFSYIzp4yzhrWbttQfaa4Gxjzgdlo/AhwN/eh9z/ET:BLF6gb0xqx9z/EO3BxhR

    Score
    1/10
    behavioral11behavioral12

    • Target

      windows_25bfec0c3c81ab55cf85a57367c14cc6803a03e2e9b4afd72e7bbca9420fe7c5

    • Size

      884KB

    • MD5

      da13022097518d123a91a3958be326da

    • SHA1

      24a71ab462594d5a159bbf176588af951aba1381

    • SHA256

      25bfec0c3c81ab55cf85a57367c14cc6803a03e2e9b4afd72e7bbca9420fe7c5

    • SHA512

      a82aa97a92cd21ee2d4b556448fd3293396eb7c01d3626ebdb6c3816277783578686830c430014b6b2fc3280bc1301df27da079937f88834c2d35641eb5fc26f

    • SSDEEP

      12288:Sw41dVZvThPCsM18GLHe7wlDdkPAQEtxr0fflvRmhEBWtdUJiAUtP/T/kAfMvgVt:dod1HDmlDdkZ4YXPpaTTXMw

    Score
    10/10
    hiveevasionransomwarespywarestealertrojanupx

    • Deletes Windows Defender Definitions

      Uses mpcmdrun utility to delete all AV definitions.

      evasion

    • Hive

      A ransomware written in Golang first seen in June 2021.

      ransomwarehive

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Modifies security service

      evasion

    • Clears Windows event logs

      evasionransomware

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral13behavioral14

    • Target

      zi1ysv64h.dll

    • Size

      3.3MB

    • MD5

      5384c6825a5707241c11d78529dbbfee

    • SHA1

      85f5587e8ad534c2e5de0e72450b61ebda93e4fd

    • SHA256

      3858e95bcf18c692f8321e3f8380c39684edb90bb622f37911144950602cea21

    • SHA512

      856861295efb9c1b0000b369297cf6905a277c2d7dd0bc238f3884cd22598055450bf0459d68441f135bb77150685a86707ea9320a37e10548b40185f09b961f

    • SSDEEP

      49152:HJ9mQ5uetkErb/TKvO90dL3BmAFd4A64nsfJ+9NRUMZXuPH9fc0KHPKG/g+eNgiz:HJ9jkl9NbBo9fc0KHYno

    Score
    10/10
    hiveevasionransomwaretrojan

    • Deletes Windows Defender Definitions

      Uses mpcmdrun utility to delete all AV definitions.

      evasion

    • Hive

      A ransomware written in Golang first seen in June 2021.

      ransomwarehive

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Modifies security service

      evasion

    • Clears Windows event logs

      evasionransomware

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Modifies boot configuration data using bcdedit

      ransomwareevasion
    behavioral15behavioral16

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Defense Evasion

Impair Defenses

2
T1562

Disable or Modify Tools

1
T1562.001

Indicator Removal

3
T1070

File Deletion

2
T1070.004

Modify Registry

4
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

3
T1012

Remote System Discovery

1
T1018

System Information Discovery

3
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

3
T1490

Tasks