hive

General

Target
2026-03-13_e1d21c57fd7e2b990ea1e53fd4a3a9b7_cobalt-strike_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver_snatch
Size 2.7MB
Sample260313-ec96xabs8r
SHA256 a7df09fe1d82ee508598a05ad7f2fac5a93f38015f43c56f6f395d7f80b0938c
MD5 e1d21c57fd7e2b990ea1e53fd4a3a9b7
SHA1 0b590fe830cfb11bc58bc6283b469fa72995143d
SHA512 124e49be8b1f9fca6a090d1277f94c5e8029874c86f65d2776fd23f8a182eb0cb3a126e72837ce799249aad9582688f9df356ab777d9db2a9915892a67a813ec
SSDEEP 49152:pbX+wuMYNeJkrb/T6vO90dL3BmAFd4A64nsfJKVFuxglPZ5rCrig+eNg3pItOaM5:RXJvJtVwilLuMutOa
TLSH
T149D54A43F8A1A1E9C4AEC6308D699195FA703C49073463EB2B9097B52F72BD4EF76350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Path

C:\Program Files\JZRG_HOW_TO_DECRYPT.txt

hive

Ransom Note

Your network has been breached and all data were encrypted. Personal data, financial reports and important documents are ready to disclose. To decrypt all the data and to prevent exfiltrated files to be disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/ you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: gnEFemaDs3pK Password: B3zwzo7oWHf5EjbHbSeV To get an access to .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) Follow the guidelines below to avoid losing your data: - Do not modify, rename or delete *.key.iavpt files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to the Police, FBI, etc. They don't care about your business. They simply won't allow you to pay. As a result you will lose everything. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. - Do not reject to purchase. Exfiltrated files will be publicly disclosed.

URLs

http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/
http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

Targets

- Target
  2026-03-13_e1d21c57fd7e2b990ea1e53fd4a3a9b7_cobalt-strike_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver_snatch
- Size 2.7MB
- SHA256 a7df09fe1d82ee508598a05ad7f2fac5a93f38015f43c56f6f395d7f80b0938c
- MD5 e1d21c57fd7e2b990ea1e53fd4a3a9b7
- SHA1 0b590fe830cfb11bc58bc6283b469fa72995143d
- SHA512 124e49be8b1f9fca6a090d1277f94c5e8029874c86f65d2776fd23f8a182eb0cb3a126e72837ce799249aad9582688f9df356ab777d9db2a9915892a67a813ec
- SSDEEP 49152:pbX+wuMYNeJkrb/T6vO90dL3BmAFd4A64nsfJKVFuxglPZ5rCrig+eNg3pItOaM5:RXJvJtVwilLuMutOa
- TLSH
  T149D54A43F8A1A1E9C4AEC6308D699195FA703C49073463EB2B9097B52F72BD4EF76350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution hive impact persistence ransomware spyware stealer trojan
- Hive
  A ransomware written in Golang first seen in June 2021.
  ransomware hive
- Hive family
  hive
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies security service
  defense_evasion
- Clears Windows event logs
  defense_evasion ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Disables service(s)
  defense_evasion execution
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Modifies Security services
  Modifies the startup behavior of a security service.
  defense_evasion
behavioral1 behavioral2