Hive_Player_Files.zip
- SHA256 9dcd88f66dd3afd936b97d131ae54182849d16b63fec5faf93a25d512638be2e
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Hive.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral2
Sample
Hive.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
900 seconds
Behavioral task
behavioral3
Sample
Hive.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
900 seconds
Behavioral task
behavioral4
Sample
Hive.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
General
- Target Hive_Player_Files.zip
- Size 80KB
- Sample260822-j7bdaaee99
- SHA256 9dcd88f66dd3afd936b97d131ae54182849d16b63fec5faf93a25d512638be2e
- MD5 74bc6b5880fdcd69f8c3c27fdee6602f
- SHA1 29b725d779b9df7c951aa23cb465b99bc702e131
- SHA512 49e27a2d713362089b33fe52b2477d5d5401f70b3c3700f0a216b1fbca7943eeea1f31da6d5d6d23e42aff66e5ed00a188d5b0054946f6a95985aab4fc78c71a
- SSDEEP 1536:OFipcU3KopijvioGNAE45VCrKChfLDP1Mq5Jt0PyNYbhbG5nm3D4Dh/K5d:iibNAEgCphfn6AtJKZvzwhc
- TLSH T16D8312B387AF44A9DC3C86B4EDF126A254727644133C084F78B3E1C4E9E9A5DBA04787
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Hive.dll unpack001/Hive.exe
File Explorer
-
Hive_Player_Files.zip.zip 80KB
-
Hive.deps.json404B
-
Hive.dll.exe 14KB
-
Hive.exe.exe 148KB
-
Hive.pdb13KB
-
Hive.runtimeconfig.json340B
Hive.deps.json
- SHA256 fc045417551b675ab8763e6ef81b7a321980c040550a78a6e1c30d6cc288898a
- MD5 a49f3171dd22d0de41d5f895dfe3d2bc
- SHA1 8d9dded7b2d493f30c34236dac447a14ed276b92
- SHA512 c652bee0f6a399cd498ac23df3f5f196cd7dc23032ae5ab3dcc4988bab01392d51401cd872df43fd0f5dba0244f14fb9981b4236df9d11b324ec02842e43e154
- TLSH T158E0DF09D1884D9742F2A7B258378382F53257730021184A79FE801C4F72C1B5410FB9
- MD5 SHA1 SHA512 TLSH
Hive.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 d6c82abaf5453afc2bf41e8fdabd59a12b75fce865f8e17d7a5c98fd151830a0
- MD5 106a8f8a324672b766623a37cfdbc667
- SHA1 b78a5f8624d7c79dd51bf63416b5015c6d4ce437
- SHA512 84ba1975f54f03936ed18f8c52d1bf52a7205cff0ed7070fed4195717aaf3e8a2a2d5b314b5308ec6048b80fddb0f654aa08a18def866285960e0430e058d7ee
- SSDEEP 384:LI/yVIHaQFde+xxuJbrNb17TZueDhLdiWIdUvVUVHgC:advxeJbdTilJ
- TLSH T11D623B0873F8402AE6FE1BF849B3930C4776FB4A4D26EB6C29C4645E9F173849951FA1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19910
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Saad Al-Safadi\Downloads\HivetNet\Hive\obj\Release\net8.0\Hive.pdb
mscoree
_CorExeMain
Name
.text
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Hive.exe
- IMPHASH bb3ac2c21e02c68abcad237dc3fa6d00
- SHA256 61ff33eba84e7026149b2430dd888506b46209befdce60c6758d266d291f8699
- MD5 a77dfae792ce64fa03a59a2a2e3c8292
- SHA1 6ab1c635accd8b2fb9963748c66797adff3ff438
- SHA512 4d6ffdebb3ad02595b82e78d6c9e2bc2bce0367b56753b45e7498675b3cc6e75a4369819ecc3fe883da50c20bd3e72d59519dd026907e717da92eb2404d6c3be
- SSDEEP 3072:JqeXA/4yIg9vkNPNu6H6xCYOiEUE265AJF:JvgvkNFNaxm0EgJ
- TLSH T190E33B07A2A851BDE1B7D679CD924D41FB7378598B71A7CF03504AB60E63BD0AE39302
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
72400
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
kernel32
FreeLibrary
LoadLibraryExW
OutputDebugStringW
FindFirstFileExW
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
GetModuleHandleW
MultiByteToWideChar
GetFileAttributesExW
LoadLibraryA
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
GetProcAddress
GetWindowsDirectoryW
FindResourceW
GetLastError
ActivateActCtx
FindClose
CreateActCtxW
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
SwitchToThread
GetCurrentThreadId
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
user32
MessageBoxW
shell32
ShellExecuteW
advapi32
RegOpenKeyExW
RegGetValueW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegCloseKey
api-ms-win-crt-runtime-l1-1-0
_invoke_watson
__p___argc
_exit
exit
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_errno
_initialize_onexit_table
abort
_c_exit
_register_thread_local_exe_atexit_callback
terminate
__p___wargv
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
_set_fmode
fputwc
__p__commode
fputws
_wfsopen
fflush
__stdio_common_vfwprintf
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf
setvbuf
api-ms-win-crt-heap-l1-1-0
calloc
_set_new_mode
free
_callnewh
malloc
api-ms-win-crt-string-l1-1-0
wcsncmp
toupper
strcmp
strlen
_wcsdup
wcsnlen
strcpy_s
api-ms-win-crt-convert-l1-1-0
wcstoul
_wtoi
api-ms-win-crt-time-l1-1-0
wcsftime
_gmtime64_s
_time64
api-ms-win-crt-locale-l1-1-0
___mb_cur_max_func
_configthreadlocale
___lc_codepage_func
___lc_locale_name_func
__pctype_func
_lock_locales
setlocale
_unlock_locales
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
89KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
47KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
824B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=35207,
count=12, id=260, version=35207,
count=87, id=261, version=35207,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=33145,
count=204, id=1, productName=Unmarked objects,
count=10, id=265, version=35223,
count=1, id=258, version=35223,
Hive.pdb
- SHA256 14f67045ee57efad3ea1163bb0dc23b0c13cbf76a982794a23f1b0695535d114
- MD5 ddbbf5d3d37581e081c4613290236023
- SHA1 8083978b938d72b849ead1939fffbd7fed8dda4a
- SHA512 3dad14f30979b44c310819267956f30430b51ce2bb09dd5505f0c3c6c9bced57c54de9e7899fb44620e578060ea7377a48bad71ae368af225170b3e4fc1c4038
- SSDEEP 384:Iw2JXLop3s3E+1jKaw+j/Eys1wYR6iecV4iwKAdHXVfaqZrJyPtFT/wYcF:2bo8SJhNwetdm
- TLSH T17852D433974CD662C54556765A32C29C333183142382EF79F2C43A2ADDAFB9E03F66A5
- MD5 SHA1 SHA512 SSDEEP TLSH
Hive.runtimeconfig.json
- SHA256 28329cf08f6505e73806b17558b187c02f0c1c516fe47ebfb7a013d082aaa306
- MD5 253333997e82f7d44ea8072dfae6db39
- SHA1 03b9744e89327431a619505a7c72fd497783d884
- SHA512 56d99039e0fb6305588e9f87361e7e0d5051507bf321ba36619c4d29741f35c27c62f025a52523c9e1c7287aabf1533444330a8cdf840fa5af0fa2241fcb4fc2
- TLSH T114E02664CE006CA701FA727FC531C183EB30632700101891B4FC080C2F775B50112F5A
- MD5 SHA1 SHA512 TLSH