Malware Analysis Report

2024-10-16 03:10

Sample ID 240806-skjktawdkh
Target f24767aa5b3c45b8947b25d353119474c77cdae40ffd71b1d36f1e4403afc6c1
SHA256 f24767aa5b3c45b8947b25d353119474c77cdae40ffd71b1d36f1e4403afc6c1
Tags
hive ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f24767aa5b3c45b8947b25d353119474c77cdae40ffd71b1d36f1e4403afc6c1

Threat Level: Known bad

The file f24767aa5b3c45b8947b25d353119474c77cdae40ffd71b1d36f1e4403afc6c1 was found to be: Known bad.

Malicious Activity Summary

hive ransomware

Hive

Enumerates kernel/hardware configuration

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-06 15:10

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-06 15:10

Reported

2024-08-06 15:13

Platform

ubuntu2404-amd64-20240523-en

Max time kernel

20s

Max time network

131s

Command Line

[/tmp/f7122a670e8ff23808fff2029ff69bf35930dd14785140f3bbcd491f89876377]

Signatures

Hive

ransomware hive

Enumerates kernel/hardware configuration

Description Indicator Process Target
File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size /tmp/f7122a670e8ff23808fff2029ff69bf35930dd14785140f3bbcd491f89876377 N/A

Processes

/tmp/f7122a670e8ff23808fff2029ff69bf35930dd14785140f3bbcd491f89876377

[/tmp/f7122a670e8ff23808fff2029ff69bf35930dd14785140f3bbcd491f89876377]

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp

Files

/root/encrypted_aes_key.txt

MD5 de172b23a41a6f580cc3e1f199c670b3
SHA1 11227b44f737ecca511f70721a579241a300748a
SHA256 8d07e857332c627cc9fe42de4716a49dd94e2790234d1387e993985807e53e7d
SHA512 836507c724bd79e4aeb26d07210b5d7833c35c253502b25a6bda9852f3bf9548beba3021cf07b689a3b4f298939be13f774d3e726150a6c86796a33c8d638645

/root/HOW_TO_DECRYPT.txt

MD5 8495d3b1386ad028a6966ac58bbe2287
SHA1 a7f41a6cc5aa3f07191956ef5cd5a27df66dd9ac
SHA256 39be18add82aa64d33e66bfab20c0675c6094c19b25dde6c49c631da8bab6190
SHA512 e8b0d1759d5aa7179b38da9336248afa6b8d20d3aaffd205b10bf8b0fbd7d5ea43179958889c4e0b5c2e77642941bcb118be5ffc2533a3bc2c29266af87daaf8