Overview

overview

10

Static

static

1

totally re...ck.elf

ubuntu-18.04-amd64

10

totally re...ck.elf

ubuntu-20.04-amd64

10

Analysis

  • max time kernel
    74s
  • max time network
    38s
  • platform
    ubuntu-20.04_amd64
  • resource
    ubuntu2004-amd64-20240221-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2004-amd64-20240221-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
  • submitted
    28-04-2024 18:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    totally real crack.elf

  • Size

    2.2MB

  • MD5

    c41d9625ccd175647ffa10484ab2556d

  • SHA1

    77d7614156607b68265b122fb35a1d408625cb96

  • SHA256

    6a0449a0b92dc1b17da219492487de824e86a25284f21e6e3af056fe3f4c4ec0

  • SHA512

    7036bbdd7079b560abcfe3aac1b5951571c318708d48fea340e82185e351c3853091900b31ef0d790ca3309943318620e00f9567440693e89a259b56fc09c9b2

  • SSDEEP

    49152:kOAAzrb/TYvO90dL3BmAFd4A64nsfJiTZxwuXf9nTCqw0Xfgg778laMex5D1:k1Dw+b3+

Score
10/10
hiveevasionpersistenceransomware

Malware Config

Extracted

Path

/4oEi_HOW_TO_DECRYPT.txt

Family

hive

Ransom Note
Your network has been breached and all data were encrypted. Personal data, financial reports and important documents are ready to disclose. To decrypt all the data and to prevent exfiltrated files to be disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/ you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: xUvZHAXDfpoW Password: xvsX47VFucuDKUw4i77C To get an access to .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) Follow the guidelines below to avoid losing your data: - Do not modify, rename or delete *.key.21k5p files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to the Police, FBI, etc. They don't care about your business. They simply won't allow you to pay. As a result you will lose everything. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. - Do not reject to purchase. Exfiltrated files will be publicly disclosed.
URLs

http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

Signatures

  • Hive

    A ransomware written in Golang first seen in June 2021.

    ransomwarehive
  • Deletes itself 1 IoCs
  • Deletes journal logs 1 TTPs 1 IoCs

    Deletes systemd journal logs. Likely to evade detection.

    evasion
  • Creates/modifies Cron job 1 TTPs 2 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence
  • Deletes log files 1 TTPs 7 IoCs

    Deletes log files on the system.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads hardware information 1 TTPs 1 IoCs

    Accesses system info like serial numbers, manufacturer names etc.

  • Reads network interface configuration 2 TTPs 12 IoCs

    Fetches information about one or more active network interfaces.

  • Reads CPU attributes 1 TTPs 15 IoCs
  • Enumerates kernel/hardware configuration 1 TTPs 64 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to shm directory 1 IoCs

    Malware can drop malicious files in the shm directory which will run directly from RAM.

  • Writes file to tmp directory 2 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/totally real crack.elf
    "/tmp/totally real crack.elf"
    1⤵
    • Deletes itself
    • Deletes journal logs
    • Creates/modifies Cron job
    • Deletes log files
    • Reads hardware information
    • Reads network interface configuration
    • Reads CPU attributes
    • Enumerates kernel/hardware configuration
    • Reads runtime system information
    • Writes file to shm directory
    • Writes file to tmp directory
    PID:1471

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /4oEi_HOW_TO_DECRYPT.txt
    Filesize

    1KB

    MD5

    9932bbfea02ad4bb0c43b36fddd98a7a

    SHA1

    1faee3c9dbb5f005769c8123387b45cf545cac89

    SHA256

    13f91b1c2c02259660f4d83dd7383b5bbc4f04be98331fbbcf92f1e56f8557a4

    SHA512

    cad236319f2bc80d4223aca681e1adc446ae72dd46530e00aa9887c331b94ac95c9b23c55c3d98c4615cb05da689d68006d75c3f0d213c6f9303ee04f2d4f7ab

    Download Submit

  • /Qzld9vsH-gE3GRsTFuV6y7BjJAXI8wHvjcXLaZb2AOH_.key.21k5p
    Filesize

    1.1MB

    MD5

    b6aa1d724e063fd545ed5162d64dff63

    SHA1

    5480131a79f377ae117e2e8b6c16734275558fcd

    SHA256

    beba1efc0911fcc9556a5677153ada73bfeeddad376c8c6394ea03a4511345a3

    SHA512

    69f85009c92097e80ab6eea6122ee250700914f2c8af6b19f490eec330d53185699b39ded90191494e07139ec02a1ff51998e2c306792b79c3f9ed5a62052d0a

    Download Submit

  • /boot/efi/temp1.swap.21k5p
    Filesize

    146.0MB

    MD5

    fff19b5a62f946842c031cc78b62c3b6

    SHA1

    dc7f8573a6449f5900a57f0c8c2d959cba656060

    SHA256

    01d90ef3500836c04eb4926733e661cc35bfc8881a683a704d0ab1a1d3f81c7c

    SHA512

    8192999576374a9806c2f4a8511aa3081570b126c8df40401004acb52047f5540a6198bb0d3850f25030bee9ab225f82f7a686bc0b1a73bc8f627e36b8bc584f

    Download Submit

  • /dev/shm/temp1.swap.21k5p
    Filesize

    206.0MB

    MD5

    f15419e6b06f4277efb8223e8cfd0520

    SHA1

    04b0a8a44c3085e2881fd44c09e9bb211c76350d

    SHA256

    a2eb978bb81f14ec2a28c1913f95f69060c1819798b784af8eb990c74bf15ced

    SHA512

    1978b9f28908825dc4b676ef5566437e203054ceb0b29679be1fe27321ff7f02a3a7e00f8b9f71d6931d34c476b7898d05a3442552db099dba7962a16eae627a

    Download Submit

  • /etc/motd
    Filesize

    1KB

    MD5

    ff20e9231f075f2da48939e1404433e6

    SHA1

    b6b095abd7636ff094dc9560ae19b4902268ffb3

    SHA256

    60195e714782a8b8ab7dab911f6f855ab9160776dca1dbc04c18c045768dbd97

    SHA512

    e5576b08a067daa56778b614a3c58d0af923c4e4888c512daa456182c3e1c5f65aaa90dbf43d79752394d9cfc5d968f6a0b80a54517a0c468be5aabd38c282cd

    Download Submit

  • /run/temp1.swap.21k5p
    Filesize

    7.0MB

    MD5

    47839d1df8c7e700df318d3d01909290

    SHA1

    39819072c20daee074ebe2b5400dae212cdf81ed

    SHA256

    cae73a33631b742ff4f66696988c1d4ef2eb94af5b69109f9f9906fdffbd0e73

    SHA512

    8bd5af88adf4c15f74a2fe0f6e5fe04b6c55460806d9f72735463f4078f92a152f612398cc2d0a06f94eed02736c9121128d3b350f888ae510e70820cdb5a636

    Download Submit

  • /run/user/126/temp1.swap.21k5p
    Filesize

    6.0MB

    MD5

    6876240a950ceadd244ab0b1f5078f93

    SHA1

    1d6a80cc9f40e76566f6035d0563265f63edaa00

    SHA256

    f8673f79a3dc57f98f06c61a79b79abf7abaffe6b0533ba930f8659059412806

    SHA512

    ea00ae921524176099ec038c8db2c941ef4336ca27773b0b33fb7c3fce8b90e99104cf1a45362394952b79148b8496ed67bae4d6e1c29c594a0d7baed110a97b

    Download Submit

  • /temp1.swap.21k5p
    Filesize

    512.0MB

    MD5

    a00522249d70e3179a5f1fb8bfbe51aa

    SHA1

    59c388035c96f8b9a083137aea207cc922fd90e5

    SHA256

    16baf5f89c194ffb8a4227e6d3285fba4484dbcd7ead3841cf711cb1424a4194

    SHA512

    c177acc9c5fe2579da39f76ec867367ad6fe009df59ca60bed90f1925b0cfac7d33b27ba591d36b5353a4bab746f85d30c33f713bf2a87df61efd54fcf60618f

    Download Submit

  • /temp10.swap.21k5p
    Filesize

    154.0MB

    MD5

    10be6497b626c553cde7223a3b7b17fa

    SHA1

    61c9167ace8a63b4856ff6731a7de5f8524d4162

    SHA256

    6e3c9a5abb947305738783e0e9e9dcb1e74b4ba08258f93603b323ce2dddfe73

    SHA512

    02f4c2285825b57d20c7dbf51f1834b0384c8bd051d68495a4671e01a51d42d654e13fc79bd8bc2354b4251ebef7be3342db0da19d5f7e0768c2b7e3396735ab

    Download Submit

  • /temp2.swap.21k5p
    Filesize

    986.0MB

    MD5

    dfa51cbab6282cff549ef56c9d829c6b

    SHA1

    093294607dfeac3fe64e6c27428425c64eba0ed4

    SHA256

    c1bf0b919c3d172f76a9eb711fdbe14f122d2e03ebae566d642101a948a45b2d

    SHA512

    a524c54ee248f32e468c35ec5ad73c70350c53b0da20cbf30ecd7f3ee82addaa0a871dca62e86c7711182c98269e319585cf0b91592c1a2247cc6fe0ac152266

    Download Submit

  • /temp3.swap.21k5p
    Filesize

    1024.0MB

    MD5

    bdbd27accb883405ed713624f49f5d01

    SHA1

    d04496d17a9fffe803630bf5d9fa4d6a69d88d33

    SHA256

    aa7d6c65dc690229f6202adea17fb469da62d0d0542339abef94a9dae935ff6b

    SHA512

    2b59507f275033bb0c27faf4580a887763007c56cdb87ddd665d712b5c3efc200c108ac350313509f6ca76bcf29bdd616fa16d3fa248af053bfb9123204e7ab7

    Download Submit

  • /temp4.swap.21k5p
    Filesize

    1009.0MB

    MD5

    70af8e119a273b0cac3e7d1404381b26

    SHA1

    6f3b056e18797d3c419a82692328668aaaed8e15

    SHA256

    1bba6eb25c25baed6e9e7b63e2faadcdb9aefeb9b8fce21b0fe9621563dc1c08

    SHA512

    2000779a265623d0dfa99f547bde54a4349cd2b9153d0fb22d8d13281069946c458fdb6a48f65865f70dd5cf3971ccab5798f285c54b7e50bb5d4ec62e5c4e3b

    Download Submit

  • /temp5.swap.21k5p
    Filesize

    1022.0MB

    MD5

    8fce25e9712b0475af1f218cb36386a8

    SHA1

    3e149c18439ed68a25cdc8245233c67adc4e8243

    SHA256

    831e71fb53450cf947df2b008250732c9651f84bd062562b6f901ccbf241ded3

    SHA512

    c6e99f665fee3692a74db6fc20b5bef727b045eec2f8c9c91bbff4c98180e7b49be07a4e1fc2c7a97eb07b4ea9e0ab2804ea2ea52c952b4f48dbe1d074828302

    Download Submit

  • /temp6.swap.21k5p
    Filesize

    1022.0MB

    MD5

    fc2affeded5abc6811cec753d3aa1ebf

    SHA1

    741a996ecf8a872c96ffec9ebdd931d596381d06

    SHA256

    a58615384f196e6ecf80fe26ccb38ab8e6400d67961470b126fa680b4a7bd53f

    SHA512

    faa5ebf5342e899f7a1f36804d5bce960a556d06853755807865158b21cfa2c2b3d5ad9b2c99d198f1a360fb3899eb20e6a09c945c2a1d3835379cd5419bdd52

    Download Submit

  • /temp7.swap.21k5p
    Filesize

    1022.0MB

    MD5

    3fe35bd0a2af967bde77eb53aabf5e7c

    SHA1

    2a2f3bc458025337549d55757f1f24b5586bed98

    SHA256

    2240c2be82b546356decbaff4afb88df2e6198550765839ca9f1588f082b2e42

    SHA512

    26d83aeb1af78bb7fe9428785af13a2b13c947e5288d2a90370fb7b89df95b8c2532969f511c05708d95c5fbe875b45c57692a69dd8e9785457a0d75753f4c87

    Download Submit

  • /temp8.swap.21k5p
    Filesize

    1016.0MB

    MD5

    6ec0f54e0c6dac78f238c32e6c27e2d7

    SHA1

    8eca07ab0145b33157d6377c8d357edee1997f76

    SHA256

    7a95eebd130baa295c21071c763d55ccbedbe35d0bf5119ae068f970d2398b2d

    SHA512

    4b8c0349143574ebbc63ddfe14fa3b7b745f95e8567be64bc06ee9efadff4f91773d0fc1b4e9978e27f2497d0e4cbd63b5e0ae8603e32d6169289eb85dacbe84

    Download Submit

  • /temp9.swap.21k5p
    Filesize

    1020.0MB

    MD5

    131df9a38d30d4b82116298532be651f

    SHA1

    ff2091334678d9339d7a3367dac49fb14cee68e9

    SHA256

    167d51eb24a3a5f33bbde4457e78041fdfd8a5d58bfee8a1203e12fb21817ad4

    SHA512

    005834f34a387e203903883ea82f69209e85bfa2fc266d58eecdc31e9f09a6da8100b7fa4b51dba7ad12f76a5d2ecbe1081ab8ab2c699f0e3f0420aabf3b119d

    Download Submit