hive | c5741701b3866459dd1ffa2477cfd8776713612912693a5897f78aac795d23e9

max time kernel
184s
max time network
275s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
05-02-2025 10:17

Sharing

Target

RansomwareSamples/Hive_17_07_2021_808KB.exe
Size

808KB
MD5

504bd1695de326bc533fde29b8a69319
SHA1

67f0c8d81aefcfc5943b31d695972194ac15e9f2
SHA256

a0b4e3d7e4cd20d25ad2f92be954b95eea44f8f1944118a3194295c5677db749
SHA512

18c5b28bafb13edf47f6a2b803d9d9a914945f037b266a765f2a324842c5ef04ebda27eba31851d2d63e00779a42900e0edfe4ad5bd817eb4f43fa4d4e3a4767
SSDEEP

24576:lafTGwLNdRk4RBtr/ioF4/I+CMx3cMt3/4KFG8Qz4YwY:IT7dRFr/ioFjicMtvV4z

Score

10^/10

hive ransomware upx

Detects Go variant of Hive Ransomware 1 IoCs

resource	yara_rule
behavioral29/memory/2928-1-0x0000000000A80000-0x0000000000D59000-memory.dmp	hive_go

Hive
A ransomware written in Golang first seen in June 2021.
ransomware hive
Hive family
hive

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral29/memory/2928-0-0x0000000000A80000-0x0000000000D59000-memory.dmp	upx
behavioral29/memory/2928-1-0x0000000000A80000-0x0000000000D59000-memory.dmp	upx

C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\Hive_17_07_2021_808KB.exe
C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\Hive_17_07_2021_808KB.exe dsrm -subtree -noprompt -c user"http://+:443"
1⤵
PID:2928

memory/2928-0-0x0000000000A80000-0x0000000000D59000-memory.dmp

Filesize
2.8MB

Download
memory/2928-1-0x0000000000A80000-0x0000000000D59000-memory.dmp

Filesize
2.8MB

Download