• Services
    • Assess
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Press Release
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Alert – GuLoader Malspam Campaign – Active IOCs
March 16, 2022
Rewterz Threat Alert – Mirai Botnet – Active IOCs
March 16, 2022

Rewterz Threat Alert – Hive Ransomware – Active IOCs

March 16, 2022

Severity

High

Analysis Summary

Hive ransomware, which was first observed in June 2021 and likely operates as an affiliate-based ransomware, employs a wide variety of tactics, techniques, and procedures (TTPs), creating significant challenges for defense and mitigation. Hive ransomware uses multiple mechanisms to compromise business networks, including phishing emails with malicious attachments to gain access and Remote Desktop Protocol (RDP) to move laterally once on the network. After compromising a victim network, Hive ransomware actors exfiltrate data and encrypt files on the network. The actors leave a ransom note in each affected directory within a victim’s system, which provides instructions on how to purchase the decryption software. The ransom note also threatens to leak exfiltrated victim data on the Tor site, “HiveLeaks.”

Impact

  • Unauthorized Access
  • Data Exfiltration
  • File Encryption

Indicators of Compromise

MD5

  • c3aceb1e2eb3a6a3ec54e32ee620721e
  • d14afc1019e09ab7efdcd4fc133e9301
  • 78d7516f2b75aceb180f7afee7a810ff
  • 318a6f65e3f7a40b6a85079a912e3f21
  • 16cde93b441e4363700dfbf34c687b08
  • 2e936942613b9ef1a90b5216ef830fbf

SHA-256

  • 77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618
  • a70729b3241154d81f2fff506e5434be0a0c381354a84317958327970a125507
  • 2ef9a4f7d054b570ea6d6ae704602b57e27dee15f47c53decb16f1ed0d949187
  • c170717a69847bb7b050832c55fcd2a214e9180c8cde5f86088bd4e5266e2fd9
  • a290ce75c6c6b37af077b72dc9c2c347a2eede4fafa6551387fa8469539409c7
  • e097cde0f76df948f039584045acfa6bd7ef863141560815d12c3c6e6452dce4

SHA-1

  • cd8e4372620930876c71ba0a24e2b0e17dcd87c9
  • f64219ef30d34067e9a5a085151f43f5469c5675
  • db00db3f885f8382e9aa708d20110c9159fcddb9
  • 9b68ebd37d17b5f54d465d128bcabb9fa8dd698c
  • 092ac6f8d072c4cf045e35a839d5bb8f1360f1ae
  • 32c2ecf9703aec725034ab4a8a4c7b2944c1f0b7

Remediation

  • Block all threat indicators at your respective controls.
  • Search for IOCs in your environment.
  • Services
    • Assess
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.