hive

General

Target
2026-03-13_2e42b14ca7111d79fdbff72981b95933_cobalt-strike_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver_snatch
Size 3.5MB
Sample260313-dslmtagt2x
SHA256 4d919a005dcdbe12fd59652a8cdea27aa15c47eec6b9fa7cc2e1cd2fb3118193
MD5 2e42b14ca7111d79fdbff72981b95933
SHA1 45bf9e30033204cabcffc34589586cf100380b34
SHA512 9ed92f466d5112152c4903c4f79f2836cd55969d23d3fbaee051758d723a6b29990e03bddb995e6252357397e6d6c4d3058009f3eec269742ef330516a9bc789
SSDEEP 49152:XdVUVYA4tJ4Mlwrb/T6vO90dL3BmAFd4A64nsfJnDcWbce9MLtvgcoQ5C0Yhg+eD:TUk49DcUcpB4/QPnMfO
TLSH
T1A6F52A43F8A1A1E8C4A792714D2161A4AF307C8D273573EB1760B7792B32BE45FB6760
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Path

C:\Program Files\Common Files\DESIGNER\7CYT_HOW_TO_DECRYPT.txt

hive

Ransom Note

Your network has been breached and all data were encrypted. Personal data, financial reports and important documents are ready to disclose. To decrypt all the data and to prevent exfiltrated files to be disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/ you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: KHBAUpSd7hBF Password: Nvc3tSEKRMNBS7bSSjJr To get an access to .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) Follow the guidelines below to avoid losing your data: - Do not modify, rename or delete *.key.koobn files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to the Police, FBI, etc. They don't care about your business. They simply won't allow you to pay. As a result you will lose everything. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. - Do not reject to purchase. Exfiltrated files will be publicly disclosed.

URLs

http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/
http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

Targets

- Target
  2026-03-13_2e42b14ca7111d79fdbff72981b95933_cobalt-strike_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver_snatch
- Size 3.5MB
- SHA256 4d919a005dcdbe12fd59652a8cdea27aa15c47eec6b9fa7cc2e1cd2fb3118193
- MD5 2e42b14ca7111d79fdbff72981b95933
- SHA1 45bf9e30033204cabcffc34589586cf100380b34
- SHA512 9ed92f466d5112152c4903c4f79f2836cd55969d23d3fbaee051758d723a6b29990e03bddb995e6252357397e6d6c4d3058009f3eec269742ef330516a9bc789
- SSDEEP 49152:XdVUVYA4tJ4Mlwrb/T6vO90dL3BmAFd4A64nsfJnDcWbce9MLtvgcoQ5C0Yhg+eD:TUk49DcUcpB4/QPnMfO
- TLSH
  T1A6F52A43F8A1A1E8C4A792714D2161A4AF307C8D273573EB1760B7792B32BE45FB6760
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution hive impact persistence ransomware spyware stealer trojan
- Hive
  A ransomware written in Golang first seen in June 2021.
  ransomware hive
- Hive family
  hive
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies security service
  defense_evasion
- Clears Windows event logs
  defense_evasion ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Disables service(s)
  defense_evasion execution
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Modifies Security services
  Modifies the startup behavior of a security service.
  defense_evasion
behavioral1 behavioral2