Overview

overview

10

Static

static

5

211xahcou.exe

windows10-2004-x64

10

211xahcou.exe

windows11-21h2-x64

10

Hive.elf

ubuntu-18.04-amd64

4

hive.exe

windows10-2004-x64

10

hive.exe

windows11-21h2-x64

10

hive_linux_elf

ubuntu-18.04-amd64

1

linux_hive.elf

ubuntu-18.04-amd64

10

sjl8j6ap3.exe

windows10-2004-x64

1

sjl8j6ap3.exe

windows11-21h2-x64

1

windows_25...c5.exe

windows10-2004-x64

10

windows_25...c5.exe

windows11-21h2-x64

10

zi1ysv64h.exe

windows10-2004-x64

10

zi1ysv64h.exe

windows11-21h2-x64

10

Resubmissions

12/06/2026, 18:58

260612-xmk9mscx4q5

12/06/2026, 10:45

260612-mtxadabw2y10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Ransomware.Hive.zip
  • Size 6.6MB
  • Sample260612-mtxadabw2y
  • SHA256 af9e8f301a3677b457345921d7ee765a842eceb7df107714eaffc6193bfc6bbe
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
hivecredential_accessdefense_evasiondiscoveryevasionexecutionimpactlinuxpersistenceprivilege_escalationransomwarespywarestealertrojanupx

Malware Config

Extracted

Path

  • C:\Program Files\Common Files\DESIGNER\n8pw_HOW_TO_DECRYPT.txt

  • hive

Ransom Note
  • Your network has been breached and all data were encrypted. Personal data, financial reports and important documents are ready to disclose. To decrypt all the data and to prevent exfiltrated files to be disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/ you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: fTP4dtHQ51ZX Password: 7zC1gVatfxGNUwxnLe4e To get an access to .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) Follow the guidelines below to avoid losing your data: - Do not modify, rename or delete *.key.cv2gj files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to the Police, FBI, etc. They don't care about your business. They simply won't allow you to pay. As a result you will lose everything. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. - Do not reject to purchase. Exfiltrated files will be publicly disclosed.
URLs

  • http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

  • http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

Extracted

Path

  • C:\Program Files\EGdu_HOW_TO_DECRYPT.txt

  • hive

Ransom Note
  • Your network has been breached and all data were encrypted. Personal data, financial reports and important documents are ready to disclose. To decrypt all the data or to prevent exfiltrated files to be disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/ you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: jxkdVr8zZs5J Password: GHTM6Qgqyhqs4nMH53ZD To get access to .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) Follow the guidelines below to avoid losing your data: - Do not shutdown or reboot your computers, unmount external storages. - Do not try to decrypt data using third party software. It may cause irreversible damage. - Do not fool yourself. Encryption has perfect secrecy and it's impossible to decrypt without knowing the key. - Do not modify, rename or delete *.key.uj1ps files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to authorities. The negotiation process will be terminated immediately and the key will be erased. - Do not reject to purchase. Your sensitive data will be publicly disclosed.
URLs

  • http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

  • http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

Extracted

Path

  • C:\Program Files\Common Files\DESIGNER\K8zJ_HOW_TO_DECRYPT.txt

  • hive

Ransom Note
  • Your network has been breached and all data were encrypted. Personal data, financial reports and important documents are ready to disclose. To decrypt all the data and to prevent exfiltrated files to be disclosed at you will need to purchase our decryption software. Please contact our sales department at: Login: Password: To get an access to .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) Follow the guidelines below to avoid losing your data: - Do not modify, rename or delete *.key.2o4xo files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to the Police, FBI, etc. They don't care about your business. They simply won't allow you to pay. As a result you will lose everything. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. - Do not reject to purchase. Exfiltrated files will be publicly disclosed.

Extracted

Path

  • C:\$Recycle.Bin\HOW_TO_DECRYPT.txt

  • hive

Ransom Note
  • Your network has been breached and all data is encrypted. To decrypt all the data you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: EQA9oydTxwXS Password: vNtgAgb3kMFmCooANNQr Follow the guidelines below to avoid losing your data: - Do not shutdown or reboot your computers, unmount external storages. - Do not try to decrypt data using third party software. It may cause irreversible damage. - Do not fool yourself. Encryption has perfect secrecy and it's impossible to decrypt without knowing the key. - Do not modify, rename or delete *.key.hive files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to authorities. The negotiation process will be terminated immediately and the key will be erased. - Do not reject to purchase. Your sensitive data will be publicly disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/
URLs

  • http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

  • http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

Extracted

Path

  • /FVUV_HOW_TO_DECRYPT.txt

  • hive

Ransom Note
  • Your network has been breached and all data were encrypted. Personal data, financial reports and important documents are ready to disclose. To decrypt all the data and to prevent exfiltrated files to be disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/ you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: FqRAvHSSJR6Z Password: fWqzu3Kqd31FWKUvb5rq To get an access to .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) Follow the guidelines below to avoid losing your data: - Do not modify, rename or delete *.key.mrvk3 files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to the Police, FBI, etc. They don't care about your business. They simply won't allow you to pay. As a result you will lose everything. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. - Do not reject to purchase. Exfiltrated files will be publicly disclosed.
URLs

  • http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

  • http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

Targets

    • Target
      211xahcou.dll
    • Size 3.9MB
    • SHA256 33aceb3dc0681a56226d4cfce32eee7a431e66f5c746a4d6dc7506a72b317277
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasiondiscoveryevasionexecutionhiveimpactpersistenceransomwarespywarestealertrojan

    • Family: Hive

      A ransomware written in Golang first seen in June 2021.

      ransomwarehive

    • Modifies Windows Defender DisableAntiSpyware settings

      evasiontrojan

    • Modifies Windows Defender Real-time Protection settings

      defense_evasiontrojan

    • Modifies security service

      defense_evasion

    • Clears Windows event logs

      defense_evasionransomware

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Renames multiple (114) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Disables one or more Microsoft Defender components

      Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

      defense_evasion

    • Disables service(s)

      defense_evasionexecution

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Modifies Security services

      Modifies the startup behavior of a security service.

      defense_evasion
    behavioral1behavioral2
    • Target
      Hive.elf
    • Size 246KB
    • SHA256 822d89e7917d41a90f5f65bee75cad31fe13995e43f47ea9ea536862884efc25
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    4/10
    discovery
    behavioral3
    • Target
      hive.bin_exe
    • Size 764KB
    • SHA256 88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    credential_accessdefense_evasiondiscoveryhivepersistenceransomwarespywarestealerupx

    • Detects Go variant of Hive Ransomware

    • Family: Hive

      A ransomware written in Golang first seen in June 2021.

      ransomwarehive

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Drops file in Drivers directory

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

      credential_accessstealer

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral4behavioral5
    • Target
      hive_linux_elf
    • Size 2.4MB
    • SHA256 bdf3d5f4f1b7c90dfc526340e917da9e188f04238e772049b2a97b4f88f711e3
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral6
    • Target
      linux_hive.elf
    • Size 2.3MB
    • SHA256 12389b8af28307fd09fe080fd89802b4e616ed4c961f464f95fdb4b3f0aaf185
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasiondiscoveryexecutionhivepersistenceprivilege_escalationransomware

    • Family: Hive

      A ransomware written in Golang first seen in June 2021.

      ransomwarehive

    • Deletes itself

    • Deletes journal logs

      Deletes systemd journal logs. Likely to evade detection.

      defense_evasion

    • Reads AppArmor ptrace settings

      Discovery of allowed ptrace capabilities by AppArmor.

      discovery

    • Creates/modifies Cron job

      Cron allows running tasks on a schedule, and is commonly used for malware persistence.

      executionpersistenceprivilege_escalation

    • Deletes log files

      Deletes log files on the system.

      defense_evasion

    • Enumerates running processes

      Discovers information about currently running processes on the system

    • Reads hardware information

      Accesses system info like serial numbers, manufacturer names etc.

      discovery

    • Reads network interface configuration

      Fetches information about one or more active network interfaces.

      discovery
    behavioral7
    • Target
      sjl8j6ap3.dll
    • Size 661KB
    • SHA256 b6b1ea26464c92c3d25956815c301caf6fa0da9723a2ef847e2bb9cd11563d8b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral8behavioral9
    • Target
      windows_25bfec0c3c81ab55cf85a57367c14cc6803a03e2e9b4afd72e7bbca9420fe7c5
    • Size 884KB
    • SHA256 25bfec0c3c81ab55cf85a57367c14cc6803a03e2e9b4afd72e7bbca9420fe7c5
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasiondiscoveryevasionexecutionhiveimpactransomwarespywarestealertrojanupx

    • Family: Hive

      A ransomware written in Golang first seen in June 2021.

      ransomwarehive

    • Modifies Windows Defender DisableAntiSpyware settings

      evasiontrojan

    • Modifies Windows Defender Real-time Protection settings

      defense_evasiontrojan

    • Modifies security service

      defense_evasion

    • Clears Windows event logs

      defense_evasionransomware

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Disables one or more Microsoft Defender components

      Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

      defense_evasion

    • Disables service(s)

      defense_evasionexecution

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Modifies Security services

      Modifies the startup behavior of a security service.

      defense_evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral10behavioral11
    • Target
      zi1ysv64h.dll
    • Size 3.3MB
    • SHA256 3858e95bcf18c692f8321e3f8380c39684edb90bb622f37911144950602cea21
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasiondiscoveryevasionexecutionhiveimpactpersistenceransomwarespywarestealertrojan
    behavioral12behavioral13

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Scheduled Task/Job

1
T1053

Cron

1
T1053.003

System Services

1
T1569

Service Execution

1
T1569.002

Windows Management Instrumentation

1
T1047

Persistence

Boot or Logon Autostart Execution

1
T1547

Active Setup

1
T1547.014

Create or Modify System Process

4
T1543

Windows Service

4
T1543.003

Scheduled Task/Job

1
T1053

Cron

1
T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Active Setup

1
T1547.014

Create or Modify System Process

4
T1543

Windows Service

4
T1543.003

Scheduled Task/Job

1
T1053

Cron

1
T1053.003

Defense Evasion

Direct Volume Access

1
T1006

Impair Defenses

4
T1562

Disable or Modify Tools

3
T1562.001

Indicator Removal

5
T1070

Clear Linux or Mac System Logs

2
T1070.002

Clear Windows Event Logs

1
T1070.001

File Deletion

2
T1070.004

Modify Registry

5
T1112

Credential Access

Credentials from Password Stores

2
T1555

Credentials from Web Browsers

1
T1555.003

Windows Credential Manager

1
T1555.004

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

Query Registry

1
T1012

Remote System Discovery

1
T1018

System Information Discovery

4
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

2
T1016

Internet Connection Discovery

1
T1016.001

System Network Connections Discovery

1
T1049

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

3
T1490

Service Stop

1
T1489

Tasks

static1

upx
Score
5/10

behavioral1

defense_evasiondiscoveryevasionexecutionhiveimpactpersistenceransomwarespywarestealertrojan
Score
10/10

behavioral2

defense_evasiondiscoveryevasionexecutionhiveimpactpersistenceransomwarespywarestealertrojan
Score
10/10

behavioral3

discovery
Score
4/10

behavioral4

credential_accessdefense_evasiondiscoveryhivepersistenceransomwarespywarestealerupx
Score
10/10

behavioral5

credential_accessdefense_evasiondiscoveryhivepersistenceransomwarespywarestealerupx
Score
10/10

behavioral6

Score
1/10

behavioral7

defense_evasiondiscoveryexecutionhivepersistenceprivilege_escalationransomware
Score
10/10

behavioral8

Score
1/10

behavioral9

Score
1/10

behavioral10

defense_evasiondiscoveryevasionexecutionhiveimpactransomwarespywarestealertrojanupx
Score
10/10

behavioral11

defense_evasiondiscoveryevasionexecutionhiveimpactransomwarespywarestealertrojanupx
Score
10/10

behavioral12

defense_evasiondiscoveryevasionexecutionhiveimpactpersistenceransomwarespywarestealertrojan
Score
10/10

behavioral13

defense_evasiondiscoveryevasionexecutionhiveimpactpersistenceransomwarespywarestealertrojan
Score
10/10