• Services
    • Assess
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Press Release
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Alert – Remcos RAT – Active IOCs
July 6, 2022
Rewterz Threat Alert – ZLoader Banking Trojan – Active IOCs
July 6, 2022

Rewterz Threat Alert – Hive Ransomware Upgrades To Rust For More Improved Encryption Method – Active IOCs

July 6, 2022

Severity

High

Analysis Summary

Hive is one of the quickest evolving ransomware families which was first observed in June 2021 and likely operates as an affiliate-based ransomware, employs a wide variety of tactics, techniques, and procedures (TTPs), creating significant challenges for defense and mitigation. Hive ransomware uses multiple mechanisms to compromise business networks, including phishing emails with malicious attachments to gain access and Remote Desktop Protocol (RDP) to move laterally once on the network. 

The latest variant introduced by this ransomware is written in Rust languaguage as opposed to the previous variants, which were written in GoLang or Go. 
According to researchers:

The new variation employs a unique collection of algorithms, including Elliptic Curve Diffie-Hellmann (ECDH) with Curve25519 and XChaCha20-Poly1305″ (authenticated encryption with ChaCha20 symmetric cipher)

The latest Hive version approaches file encryption in a distinctive manner. It produces two sets of keys in memory, uses them to encrypt files, and then encrypts and writes the sets to the root of the drive it encrypts, with a .key extension. 

hive-ransomware-new-variant.png?ssl=1

Impact

  • Unauthorized Access 
  • Data Exfiltration 
  • File Encryption

Indicators of Compromise

MD5

  • 0f3e5603cf3f5cc91e8eb031a4b5c45d
  • 44aba241dd3f0d156c6ed82a0ab3a9e1
  • 4144a0d0777073b1c5d83d743682c5e9
  • 2eafe1d0f2579e730ed03445bff12d0c
  • d7fb1939cf5bda2d2c6b792324554dfc

SHA-256

  • 88b1d8a85bf9101bc336b01b9af4345ed91d3ec761554d167fe59f73af73f037
  • 065208b037a2691eb75a14f97bdbd9914122655d42f6249d2cca419a1e4ba6f1
  • 33744c420884adf582c46a4b74cbd9c145f2e15a036bb1e557e89d6fd428e724
  • afab34235b7f170150f180c7afb9e3b4e504a84559bbd03ab71e64e3b6541149
  • 36759cab7043cd7561ac6c3968832b30c9a442eff4d536e901d4ff70aef4d32d

SHA-1

  • 594347df314d674bac4ea744b274f6d17556c40b
  • 8516db624f17ad1cc56f71a69555272b216a8aee
  • 6b557c3dbe83d7e2fd77e2f6e649495c25a20181
  • 0c7297f37db3a6f4d73ccadf16553401780b1321
  • 3e5577716dbac03b32a272e0c6104127ce52b2d0

Remediation

  • Search for IOCs in your environment.
  • Block all threat indicators at your respective controls.
  • Maintain cyber hygiene by updating your anti-virus software and implement patch management lifecycle.
  • Maintain Offline Backups – In a ransomware attack, the adversary will often delete or encrypt backups if they have
  • access to them. That’s why it’s important to keep offline (preferably off-site), encrypted backups of data and test them
  • regularly.
  • Emails from unknown senders should always be treated with caution.
  • Never trust or open ” links and attachments received from unknown sources/senders
  • Services
    • Assess
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.