Analysis
-
max time kernel
67s -
max time network
64s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240226-en -
resource tags
-
submitted
28-04-2024 18:19
General
-
Target
totally real crack.elf
-
Size
2.2MB
-
MD5
c41d9625ccd175647ffa10484ab2556d
-
SHA1
77d7614156607b68265b122fb35a1d408625cb96
-
SHA256
6a0449a0b92dc1b17da219492487de824e86a25284f21e6e3af056fe3f4c4ec0
-
SHA512
7036bbdd7079b560abcfe3aac1b5951571c318708d48fea340e82185e351c3853091900b31ef0d790ca3309943318620e00f9567440693e89a259b56fc09c9b2
-
SSDEEP
49152:kOAAzrb/TYvO90dL3BmAFd4A64nsfJiTZxwuXf9nTCqw0Xfgg778laMex5D1:k1Dw+b3+
Malware Config
Extracted
/4oEi_HOW_TO_DECRYPT.txt
hive
http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/
http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/
Signatures
-
Hive
A ransomware written in Golang first seen in June 2021.
-
Deletes itself 1 IoCs
-
Deletes journal logs 1 TTPs 1 IoCs
Deletes systemd journal logs. Likely to evade detection.
-
Creates/modifies Cron job 1 TTPs 2 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Deletes log files 1 TTPs 7 IoCs
Deletes log files on the system.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads hardware information 1 TTPs 1 IoCs
Accesses system info like serial numbers, manufacturer names etc.
-
Reads network interface configuration 2 TTPs 12 IoCs
Fetches information about one or more active network interfaces.
-
Reads CPU attributes 1 TTPs 20 IoCs
-
Enumerates kernel/hardware configuration 1 TTPs 64 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
-
Writes file to shm directory 1 IoCs
Malware can drop malicious files in the shm directory which will run directly from RAM.
-
Writes file to tmp directory 2 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/totally real crack.elf"/tmp/totally real crack.elf"1⤵
- Deletes itself
- Deletes journal logs
- Creates/modifies Cron job
- Deletes log files
- Reads hardware information
- Reads network interface configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to shm directory
- Writes file to tmp directory
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD59932bbfea02ad4bb0c43b36fddd98a7a
SHA11faee3c9dbb5f005769c8123387b45cf545cac89
SHA25613f91b1c2c02259660f4d83dd7383b5bbc4f04be98331fbbcf92f1e56f8557a4
SHA512cad236319f2bc80d4223aca681e1adc446ae72dd46530e00aa9887c331b94ac95c9b23c55c3d98c4615cb05da689d68006d75c3f0d213c6f9303ee04f2d4f7ab
-
Filesize
1.1MB
MD5c5714e7c5956f799deac6aca2a58c013
SHA1e4969e832b1c3116c5d3a81f6c4c8db813bcb744
SHA256cd1def1edd311dc41715b747a3a439124ba6bf468cebde73f151ad3a856ca39c
SHA5124ec61ce9e2e65fa63c1bd6b27e9392b909c7edbdf34bf84e0039c8b4839ef8ed21a3c56ae60456b3f05c4e13d0cbd53bce1d97af85c3e6e173b34d0766fa9c33
-
Filesize
264.0MB
MD57783362152bf98436309e04554a6e4f0
SHA1baff754979a54d67ae2aa11765846cf893036573
SHA256eb45bf71bf6acb9a6315a9aabf3b75aedc8f88f4f2338453c7a3e887cab4240c
SHA5121f4be1da4c71ecd7677aeec7808a844c1a2ef86a2c61463858251f7f7a482edcb62f135fb1356abb6ddcac9a0381a7d4cb6244377e582dc07df67a06f975af85
-
Filesize
1KB
MD5ff20e9231f075f2da48939e1404433e6
SHA1b6b095abd7636ff094dc9560ae19b4902268ffb3
SHA25660195e714782a8b8ab7dab911f6f855ab9160776dca1dbc04c18c045768dbd97
SHA512e5576b08a067daa56778b614a3c58d0af923c4e4888c512daa456182c3e1c5f65aaa90dbf43d79752394d9cfc5d968f6a0b80a54517a0c468be5aabd38c282cd
-
Filesize
15.0MB
MD5b055c602a8260f4efd198399d0821dce
SHA15c35205942abc82c08f100b5eba4efb2b8ff3cda
SHA2569e890305deb5ffdcebaa2e130c00a8c3c4421c26e114c8957f83c4e9b7d2ff72
SHA512f1c278cdadcb16b0a96e519f36b6a550c25a4c6a9b96c2f339328212416261808083af4e9d0bf9084eb00e3fe1f643f0f8eb88653e349ac1b0b454c3f6ba808a
-
Filesize
31.0MB
MD5ae7f95560e3f2c219662623561ee63f7
SHA196b28ee228b32c473bf6b9536ed4e1a5c22d731c
SHA2568c746f4583f5cbfc536bcebb6ceaa9027c4af78a7dbf986fff2b93615d22173e
SHA512c54519920830c5f384ee65c8bdd7c4188d6da6528557a20acc2a45c8349cac837b28c0e44220c646877433a35fb06db61bf7183dcb3005137a0ee062dac7fbef
-
Filesize
11.0MB
MD51bfd81f72ff41bd0f07ad33f4f09a556
SHA1fce8fa0d651052f26957036e0a9d8c7056384cde
SHA256aa17318f1d432a08b2bc0c631088a50eb3b4714d62e7c842b872c5f7f98b73ee
SHA512751f3ba5398e61270e91c09ce57beae32aaacdadade822c0a1bf593c831a5633aa3367498453e6dc391a2863be776f4395a4c69acbcde9f17a69e6fd018162d3
-
Filesize
97.0MB
MD5d6fe8e53968781a3040d34559b8f7fee
SHA186d890eb2585e05c57a98840856f46c25a3363fd
SHA25639bcdf212400de0ff454668344da03c18977c2a9b4e74fdab41192e27fd52edd
SHA512ad5d9f5e56517f07de163e1fc006c82993a6614fcaecd8ac863028e1246f1470ed4c903f61efca019c52b6e3ed3066b5e95d860f4751bdcb8cda2acf012d6125
-
Filesize
1021.0MB
MD5452e5ca0ae197622dc510f9d69d07ff7
SHA1946ea0865a7aa45f696c28753bcd919bad7a7b51
SHA256d0f5ee06314fbb9532a9e125ddd4e084cb2ee7c05ec03842faeab5a9d6427367
SHA512a9e56927ddf6eb058bd3f3b5db7c1ee13b5418c9f5ce950b7a988b38facc78113991abb2ed67fe446a1f7ba392d1dfc3f3a2d3923946910ff8fbfe98308b5924
-
Filesize
306.0MB
MD52dcaf7d6e4d12853d38a54f5520dcc84
SHA1f7a18d301f5a7af8b805b87b8e69b96221c4d173
SHA2563686fa82460952915c7520644a66e253e8cfced8877ed0eb07607586d396f1dc
SHA5122d9518beb734a559269f4ff9ae81e8ed44f02d11aaf1491ceaaa78f1dc0309b3313da134f2b0e4672260c5fa94d9908d6b296dd7c38d4dea8c8a802719c02243
-
Filesize
995.0MB
MD5a7934a722eba41f6f87e30ce656d4763
SHA113a0fd2eeabc108a7e1b4065ba42e56ae3a7827c
SHA256e1056c69b41e8d7da2ffd058c776e94ff6e3fff7667cb2042df90db178517085
SHA51290409944cc43dd559e63fd89a6c2a661dda9093c10d900ace15a243cfa3bf43902fad40b1b473f602813b6be483e4dc2a9adc597b31005e49afcb73afce5dbf8
-
Filesize
1003.0MB
MD5f250c8c1d5d4befe119f3749724682fd
SHA1a137b6c7e701f28a29f0a0787555f3b21fb6ea56
SHA256a88270c9a189bf5ca2bbffab8fc8f0640ea4b0706fa48cfa07501d818642b79f
SHA51253a12ae09cde18245d177afcedea6dba7786118a90ed13c849eedbbbfbeb1c6f797e1b2dfbfad45c8366e26940b87b936cf5d6e06bdb025e8af3dfbc38e63f03
-
Filesize
968.0MB
MD5165455fc94a37d12005f9ac3f56d7be7
SHA15754ed56a86799a88a02bda32c57b4255c3d160a
SHA256d4d4b4449cfb4a3750195b58bca1c205a9105a669b995f2d15bd387ff307e9a1
SHA512316bf9b81ec3be08a0f1bc669813e4efe5d21a56a5710245db5fabc3719c9f77eaa379acc26dbb7775796c4c5b0189f743e65baac2d873edbbd0cfb58a3d9a35
-
Filesize
999.0MB
MD58a9bb96b1fe4e1990cd5fd7ed7bb2dc3
SHA1be458a1370dfd198a8f49812d805cc6feccff5b6
SHA25687817aca88f1ef7de87746899e9082b446c919d7cad37f9544f802cd5e108917
SHA512eddee15a6970a6440fa1b2d49c903cf1f96f11fb729126ad21cbd58c5c65260e96be6572abc3e2c517041c4fbdadf01aa9716b9163050b86f1aa9521e356058c
-
Filesize
1017.0MB
MD5c8ae8aaa2b77d6bdd3795d758d757a2c
SHA1d9dbd9f379d1cf67b895f00f03786c11f95961c1
SHA25644c9500b98b9f9a323c179e7d3feac60a7c93332b738b4811cac17ae9add5473
SHA512d9a326e53ce195daba210f930933e2879354da95f782e2dd69a01fcb2063db4bec4c5489a4b2fd5c4ba498a6ab9535a15e795945ea6fcfc3a6c581d6d2527860
-
Filesize
996.0MB
MD5c6396c48620e677d9e861760ce3dd50f
SHA1f0ccce7fb1edb3543de2611d4064d2d59fa72f93
SHA25627aded503da4ac27c07e7619ede4a8388f01a90a7afd4648afb5686744f249cf
SHA5120a7151e06f2363340ad539550869c2854eea1f4df4c1023cc33d31c70d19791626a74e29ce0247ba886cf9aa117193e52e21e0345aafed225b244f68ea74aa99
-
Filesize
1021.0MB
MD58734e15d1a0e5eeb7ad8c558793ad0ca
SHA1899d5c278dc91be70e4b2ffb57d3e314aed77cbe
SHA2561e279fd508e4c8d65c758aa5c35eac453a8c8b73ec89f129314f4d0ee438d263
SHA512f098eb45a6bc976128da7a225430028449c0cd87a8ec114c8e3b2bbea1fb1982fde66d3c2ec5e55d5fe2ecf1a4adc1521a428c028b0742d64a9e07683e378e05
-
Filesize
1003.0MB
MD55f5a33bf0c65b1d0e7ba92ee33b7dcdb
SHA179208e8f2b5a398e09276134f926314b5106b807
SHA256111459be987e83e1dc7d8919cdadb12c36a5b133526e28cf4d019ebe32f84056
SHA512e59ef6da3f6d528fb882cdcaf32aa7a25344f7ad37063c2beb3a69c0e0e1e193d5d877ad75eb1b05273642fa0aee6cc72b7f6c8c26f3bbced783da9f57b35f9a