hive

General

Target

totally real crack.elf
Size

2.2MB
Sample

240428-wyl5msdf73
MD5

c41d9625ccd175647ffa10484ab2556d
SHA1

77d7614156607b68265b122fb35a1d408625cb96
SHA256

6a0449a0b92dc1b17da219492487de824e86a25284f21e6e3af056fe3f4c4ec0
SHA512

7036bbdd7079b560abcfe3aac1b5951571c318708d48fea340e82185e351c3853091900b31ef0d790ca3309943318620e00f9567440693e89a259b56fc09c9b2
SSDEEP

49152:kOAAzrb/TYvO90dL3BmAFd4A64nsfJiTZxwuXf9nTCqw0Xfgg778laMex5D1:k1Dw+b3+

Score

10^/10

Malware Config

Extracted

Path

/4oEi_HOW_TO_DECRYPT.txt

Family

hive

Ransom Note

Your network has been breached and all data were encrypted. Personal data, financial reports and important documents are ready to disclose. To decrypt all the data and to prevent exfiltrated files to be disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/ you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: xUvZHAXDfpoW Password: xvsX47VFucuDKUw4i77C To get an access to .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) Follow the guidelines below to avoid losing your data: - Do not modify, rename or delete *.key.21k5p files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to the Police, FBI, etc. They don't care about your business. They simply won't allow you to pay. As a result you will lose everything. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. - Do not reject to purchase. Exfiltrated files will be publicly disclosed.

URLs

http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

Targets

- Target
  
  totally real crack.elf
- Size
  
  2.2MB
- MD5
  
  c41d9625ccd175647ffa10484ab2556d
- SHA1
  
  77d7614156607b68265b122fb35a1d408625cb96
- SHA256
  
  6a0449a0b92dc1b17da219492487de824e86a25284f21e6e3af056fe3f4c4ec0
- SHA512
  
  7036bbdd7079b560abcfe3aac1b5951571c318708d48fea340e82185e351c3853091900b31ef0d790ca3309943318620e00f9567440693e89a259b56fc09c9b2
- SSDEEP
  
  49152:kOAAzrb/TYvO90dL3BmAFd4A64nsfJiTZxwuXf9nTCqw0Xfgg778laMex5D1:k1Dw+b3+
Score

10^/10

hive evasion persistence ransomware
- Hive
  A ransomware written in Golang first seen in June 2021.
  ransomware hive
- Deletes itself
- Deletes journal logs
  Deletes systemd journal logs. Likely to evade detection.
  evasion
- Creates/modifies Cron job
  Cron allows running tasks on a schedule, and is commonly used for malware persistence.
  persistence
- Deletes log files
  Deletes log files on the system.
- Enumerates running processes
  Discovers information about currently running processes on the system
- Reads hardware information
  Accesses system info like serial numbers, manufacturer names etc.
- Reads network interface configuration
  Fetches information about one or more active network interfaces.
behavioral1 behavioral2