hive

General

Target
2026-03-13_714a846e2d9f1df472b495c455e832ee_cobalt-strike_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver_snatch
Size 2.7MB
Sample260313-d1xeaagv2s
SHA256 5eebe471c5bc63c876470f15a5a54e5905865665b960e572828a5396c0c56e01
MD5 714a846e2d9f1df472b495c455e832ee
SHA1 a6ef382b08d3f10e93be19e491c7b1dc2addc466
SHA512 b12ead826b3377a0a8433f0bbbea64d160d850316bc7d38af3504c629b2ebb58593c365fad6ee25f1821885dee7952894c439e584c195832be43a7005b913fa0
SSDEEP 49152:Emt098YEX6Gvnrb/TKvO90dL3BmAFd4A64nsfJL0RdutteBf1C6hECBXg+eNg3pe:ttSO6G14o3eLC6MMu/OE
TLSH
T1BBD54A43F8A155F8C4AAD770896A9261FA303C49073673DB2B5097B22F72BE4DE76350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Path

C:\Program Files\a84r_HOW_TO_DECRYPT.txt

hive

Ransom Note

Your network has been breached and all data were encrypted. Personal data, financial reports and important documents are ready to disclose. To decrypt all the data and to prevent exfiltrated files to be disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/ you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: rJGFixNYAMkp Password: YSiKYbjT3zHD1cvEgtNe To get an access to .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) Follow the guidelines below to avoid losing your data: - Do not modify, rename or delete *.key.pruhs files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to the Police, FBI, etc. They don't care about your business. They simply won't allow you to pay. As a result you will lose everything. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. - Do not reject to purchase. Exfiltrated files will be publicly disclosed.

URLs

http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/
http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

Targets

- Target
  2026-03-13_714a846e2d9f1df472b495c455e832ee_cobalt-strike_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver_snatch
- Size 2.7MB
- SHA256 5eebe471c5bc63c876470f15a5a54e5905865665b960e572828a5396c0c56e01
- MD5 714a846e2d9f1df472b495c455e832ee
- SHA1 a6ef382b08d3f10e93be19e491c7b1dc2addc466
- SHA512 b12ead826b3377a0a8433f0bbbea64d160d850316bc7d38af3504c629b2ebb58593c365fad6ee25f1821885dee7952894c439e584c195832be43a7005b913fa0
- SSDEEP 49152:Emt098YEX6Gvnrb/TKvO90dL3BmAFd4A64nsfJL0RdutteBf1C6hECBXg+eNg3pe:ttSO6G14o3eLC6MMu/OE
- TLSH
  T1BBD54A43F8A155F8C4AAD770896A9261FA303C49073673DB2B5097B22F72BE4DE76350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution hive impact persistence ransomware spyware stealer trojan
- Hive
  A ransomware written in Golang first seen in June 2021.
  ransomware hive
- Hive family
  hive
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies security service
  defense_evasion
- Clears Windows event logs
  defense_evasion ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Disables service(s)
  defense_evasion execution
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Modifies Security services
  Modifies the startup behavior of a security service.
  defense_evasion
behavioral1 behavioral2