Overview

overview

10

Static

static

1

Filecoder....ux.bin

ubuntu-18.04-amd64

10

Resubmissions

03-03-2024 13:05

240303-qbxpzabd88 10

24-05-2023 16:08

230524-tk9bxadc98 3

23-05-2023 16:48

230523-vbmbfsha9z 10

29-10-2021 20:23

211029-y55axaagcj 1

Analysis

  • max time kernel
    22s
  • max time network
    18s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20240226-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20240226-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    03-03-2024 13:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Filecoder.Hive_linux.bin

  • Size

    2.2MB

  • MD5

    c41d9625ccd175647ffa10484ab2556d

  • SHA1

    77d7614156607b68265b122fb35a1d408625cb96

  • SHA256

    6a0449a0b92dc1b17da219492487de824e86a25284f21e6e3af056fe3f4c4ec0

  • SHA512

    7036bbdd7079b560abcfe3aac1b5951571c318708d48fea340e82185e351c3853091900b31ef0d790ca3309943318620e00f9567440693e89a259b56fc09c9b2

  • SSDEEP

    49152:kOAAzrb/TYvO90dL3BmAFd4A64nsfJiTZxwuXf9nTCqw0Xfgg778laMex5D1:k1Dw+b3+

Score
10/10
hiveransomware

Malware Config

Extracted

Path

/4oEi_HOW_TO_DECRYPT.txt

Family

hive

Ransom Note
Your network has been breached and all data were encrypted. Personal data, financial reports and important documents are ready to disclose. To decrypt all the data and to prevent exfiltrated files to be disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/ you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: xUvZHAXDfpoW Password: xvsX47VFucuDKUw4i77C To get an access to .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) Follow the guidelines below to avoid losing your data: - Do not modify, rename or delete *.key.21k5p files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to the Police, FBI, etc. They don't care about your business. They simply won't allow you to pay. As a result you will lose everything. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. - Do not reject to purchase. Exfiltrated files will be publicly disclosed.
URLs

http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

Signatures

  • Hive

    A ransomware written in Golang first seen in June 2021.

    ransomwarehive
  • Deletes itself 1 IoCs
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads CPU attributes 1 TTPs 22 IoCs
  • Reads hardware information 1 TTPs 1 IoCs

    Accesses system info like serial numbers, manufacturer names etc.

  • Reads network interface configuration 2 TTPs 12 IoCs

    Fetches information about one or more active network interfaces.

  • Enumerates kernel/hardware configuration 1 TTPs 64 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/Filecoder.Hive_linux.bin
    /tmp/Filecoder.Hive_linux.bin
    1⤵
    • Deletes itself
    • Reads CPU attributes
    • Reads hardware information
    • Reads network interface configuration
    • Enumerates kernel/hardware configuration
    • Reads runtime system information
    PID:1559

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /4oEi_HOW_TO_DECRYPT.txt
    Filesize

    1KB

    MD5

    9932bbfea02ad4bb0c43b36fddd98a7a

    SHA1

    1faee3c9dbb5f005769c8123387b45cf545cac89

    SHA256

    13f91b1c2c02259660f4d83dd7383b5bbc4f04be98331fbbcf92f1e56f8557a4

    SHA512

    cad236319f2bc80d4223aca681e1adc446ae72dd46530e00aa9887c331b94ac95c9b23c55c3d98c4615cb05da689d68006d75c3f0d213c6f9303ee04f2d4f7ab

    Download Submit

  • /Thy5Fr6CIs_J_B13hrpFnerSWkbO8c6xRf7yjcWsPA7_.key.21k5p
    Filesize

    1.1MB

    MD5

    b37af5aa0dbe0f1fe416b39bc2df7064

    SHA1

    65f42fc2a44f6e4476b568ae4b17c8f250060715

    SHA256

    b3c48290c576128db6e9857e0d164dcf35d57fc182a4cdf707eff8c82af33321

    SHA512

    2bce5f378d18e2e8de2bdfe157f41078b5d0bedb61cc821282441be79836c89ede44a500df8347af403175748b8506fc7945ca3eb413c0d81b55566c17110074

    Download Submit