Overview

overview

10

Static

static

1

713b699c04...71.elf

ubuntu-20.04-amd64

10

Resubmissions

23-03-2024 14:11

240323-rhkjnabb4z 10

25-07-2023 23:42

230725-3pz4gagh7s 10

Analysis

  • max time kernel
    12s
  • max time network
    40s
  • platform
    ubuntu-20.04_amd64
  • resource
    ubuntu2004-amd64-20240221-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2004-amd64-20240221-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
  • submitted
    23-03-2024 14:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    713b699c04f21000fca981e698e1046d4595f423bd5741d712fd7e0bc358c771.elf

  • Size

    2.3MB

  • MD5

    171d2a50c6d7e69281d1c3ef98d510f2

  • SHA1

    322db4ca435004a127acd4171cc52be9edaf5338

  • SHA256

    713b699c04f21000fca981e698e1046d4595f423bd5741d712fd7e0bc358c771

  • SHA512

    2226d1a5e9c8a2920fa8d327b53e10f135e9b30c8c3d1e7fbb3a59a51df782f106f41f60ad8140a1de4a81ef6b230418126ffb24bd75eab3c3a298ada2f58913

  • SSDEEP

    49152:bC9tUNrb/T7vO90dL3BmAFd4A64nsfJcm9M3YJIpgfDVw0ksgg778GzvyKYUcTD1:bzcM4IyEWyKP

Score
10/10
hiveevasionpersistenceransomware

Malware Config

Extracted

Path

/MEag_HOW_TO_DECRYPT.txt

Family

hive

Ransom Note
Your network has been breached and all data were encrypted. Personal data, financial reports and important documents are ready to disclose. To decrypt all the data and to prevent exfiltrated files to be disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/ you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: 5mX2Ja7tXTQd Password: 36VFJGoJ6t4qhgbHLXyJ To get an access to .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) Follow the guidelines below to avoid losing your data: - Do not modify, rename or delete *.key.ndjmu files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to the Police, FBI, etc. They don't care about your business. They simply won't allow you to pay. As a result you will lose everything. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. - Do not reject to purchase. Exfiltrated files will be publicly disclosed.
URLs

http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

Signatures

  • Hive

    A ransomware written in Golang first seen in June 2021.

    ransomwarehive
  • Deletes itself 1 IoCs
  • Deletes journal logs 1 TTPs 1 IoCs

    Deletes systemd journal logs. Likely to evade detection.

    evasion
  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence
  • Deletes log files 1 TTPs 7 IoCs

    Deletes log files on the system.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads CPU attributes 1 TTPs 15 IoCs
  • Reads hardware information 1 TTPs 1 IoCs

    Accesses system info like serial numbers, manufacturer names etc.

  • Reads network interface configuration 2 TTPs 12 IoCs

    Fetches information about one or more active network interfaces.

  • Enumerates kernel/hardware configuration 1 TTPs 64 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/713b699c04f21000fca981e698e1046d4595f423bd5741d712fd7e0bc358c771.elf
    /tmp/713b699c04f21000fca981e698e1046d4595f423bd5741d712fd7e0bc358c771.elf
    1⤵
    • Deletes itself
    • Reads CPU attributes
    • Reads hardware information
    • Reads network interface configuration
    • Enumerates kernel/hardware configuration
    • Reads runtime system information
    • Writes file to tmp directory
    PID:1478

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /9A6ipfZGHZhCEbPmLrCLeKY_eoMoDjPd5ntObuEOtI7_.key.ndjmu
    Filesize

    1.2MB

    MD5

    b96ea7e387b7b88daf42435f939e6c2b

    SHA1

    8bdf7ae7bf1a84ad4589779cfe7826eefe0a3f00

    SHA256

    f2644bb37b14c54267939f0fa3382c4fc465e89a2a1d567e6f123f7f266480a2

    SHA512

    9043303955913048a127107a5ed40b6e5b7346a685c5336083ef4cca2f4bda1bb4d7585e4acf58bb21f57018d174cd6120a24293aa6a2c963dd8e88f3e92609a

    Download Submit

  • /MEag_HOW_TO_DECRYPT.txt
    Filesize

    1KB

    MD5

    24a4eff548b411e7716858ce77d60240

    SHA1

    757acc90bccf8dc11a1440015b4d02dcb7962d35

    SHA256

    9f3cb32b4ea42ee56ba952a09af75c5a180488d33945bb06f97df944183a46a0

    SHA512

    61abe02146c8a2d29c76f0625170cbcb903e8fc8bbf7f4fd4afcdcff70972f3042dc19a741fa5a3756ca0eb2f0e3dbf4fbb6a192e8897d952607f211177844be

    Download Submit

  • /etc/motd
    Filesize

    1KB

    MD5

    af959dd8dd251e49b8ecc2c94ee306d8

    SHA1

    55a13ec8d00b81ed5a73c2207d0591ca7bb2aa9f

    SHA256

    af8849418fa17af34ee739120a69e904d2f25fabf248d6ce23b7509037ea8fcd

    SHA512

    e51ff3da32c9e59904c7e4ebf66f5d42f1cbab74f09f8acb51e55c1c610be1d23cb81f238a6818dd4193dfde5f9e7de0e0c828a659a66d325101f07258242b5f

    Download Submit