Overview

overview

10

Static

static

1

2024-02-23...9_hive

ubuntu-18.04-amd64

10

Analysis

  • max time kernel
    11s
  • max time network
    66s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20240221-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20240221-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    23-02-2024 01:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-02-23_d99cbe3d21530f3416cd19cf6043a109_hive

  • Size

    2.6MB

  • MD5

    d99cbe3d21530f3416cd19cf6043a109

  • SHA1

    819faf374d944f0983ceac9bb41e3f4c6c8633d5

  • SHA256

    cbe412af0212f987731c4360eeecb881f6c55a996dcb47265efa2f1d8fd8f8ce

  • SHA512

    7889082e8cc9bc7eaa8b720cb5b7e54ede3e546c37872afec8da18d15ba56bcd7d4410b09ab6e74c1de4ce2f69bab57ede8ab3fef357c9e6505dc5c3b0c88651

  • SSDEEP

    49152:A2UcA0FRjzo+49Q/VLjUv9BN5aUGX6xdj5DVw0ksgg778GzvyKYUcTD1iJb/TJ8+:nMDGYtzEWyKPKWJ

Score
10/10
hiveransomware

Malware Config

Extracted

Path

/MEag_HOW_TO_DECRYPT.txt

Family

hive

Ransom Note
Your network has been breached and all data were encrypted. Personal data, financial reports and important documents are ready to disclose. To decrypt all the data and to prevent exfiltrated files to be disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/ you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: 5mX2Ja7tXTQd Password: 36VFJGoJ6t4qhgbHLXyJ To get an access to .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) Follow the guidelines below to avoid losing your data: - Do not modify, rename or delete *.key.ndjmu files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to the Police, FBI, etc. They don't care about your business. They simply won't allow you to pay. As a result you will lose everything. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. - Do not reject to purchase. Exfiltrated files will be publicly disclosed.
URLs

http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

Signatures

  • Hive

    A ransomware written in Golang first seen in June 2021.

    ransomwarehive
  • Deletes itself 1 IoCs
  • Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

Processes

  • /tmp/2024-02-23_d99cbe3d21530f3416cd19cf6043a109_hive
    /tmp/2024-02-23_d99cbe3d21530f3416cd19cf6043a109_hive
    1⤵
    • Enumerates kernel/hardware configuration
    PID:1559

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /MEag_HOW_TO_DECRYPT.txt
    Filesize

    1KB

    MD5

    24a4eff548b411e7716858ce77d60240

    SHA1

    757acc90bccf8dc11a1440015b4d02dcb7962d35

    SHA256

    9f3cb32b4ea42ee56ba952a09af75c5a180488d33945bb06f97df944183a46a0

    SHA512

    61abe02146c8a2d29c76f0625170cbcb903e8fc8bbf7f4fd4afcdcff70972f3042dc19a741fa5a3756ca0eb2f0e3dbf4fbb6a192e8897d952607f211177844be

    Download Submit

  • /oKvJPadv5xYBDdXYUagLRiyG8u-8Ce2a5Na7nvxYCA3_.key.ndjmu
    Filesize

    1.2MB

    MD5

    4241cff8e45c479a76399d09ba88bf52

    SHA1

    8a858010831372cae7737daf457833ad78b659c2

    SHA256

    caef552218b326d2f513456122fee5e2d152d9135518b71e2dbd54517dfd93bd

    SHA512

    8c17b4b7700131c871463aa19e2650fa3171cd3afafbebc4304e9921d5c426eb89af9e1206fe3744e0aca8727e155500cfd81f681b0396e246770607df59b326

    Download Submit