#StopRansomware: Hive Ransomware | CISA
Tags
Common Information
| Type | Value |
|---|---|
| UUID | f02c55eb-4c15-49de-8dca-5c0beb0dfeed |
| Fingerprint | b430a81d0f72d749 |
| Analysis status | DONE |
| Considered CTI value | 2 |
| Text language | |
| Published | Nov. 17, 2022, midnight |
| Added to db | Feb. 17, 2023, 11:52 p.m. |
| Last updated | Nov. 17, 2024, 6:56 p.m. |
| Headline | Alert (AA22-321A) |
| Title | #StopRansomware: Hive Ransomware | CISA |
| Detected Hints/Tags/Attributes | 127/4/67 |
Source URLs
| Redirection | Url | |
|---|---|---|
| Details | Source | https://us-cert.cisa.gov/ncas/alerts/aa22-321a |
| Details | Source | https://www.cisa.gov/uscert/ncas/alerts/aa22-321a |
URL Provider
RSS Feed
| Details | Id | Enabled | Feed title | Url | Added to db |
|---|---|---|---|---|---|
| Details | 257 | ✔ | — | https://us-cert.cisa.gov/ncas/alerts.xml | 2024-08-30 22:08 |
Attributes
| Details | Type | #Events | CTI | Value |
|---|---|---|---|---|
| Details | CVE | 26 | cve-2020-12812 |
|
| Details | CVE | 143 | cve-2021-31207 |
|
| Details | CVE | 168 | cve-2021-34473 |
|
| Details | CVE | 142 | cve-2021-34523 |
|
| Details | CVE | 14 | cve-2021-42321 |
|
| Details | Domain | 41 | stopransomware.gov |
|
| Details | Domain | 77 | mega.nz |
|
| Details | Domain | 13 | send.exploit.in |
|
| Details | Domain | 18 | ufile.io |
|
| Details | Domain | 20 | www.sendspace.com |
|
| Details | Domain | 10 | privatlab.net |
|
| Details | Domain | 8 | privatlab.com |
|
| Details | Domain | 8 | asq.r77vh0.pw |
|
| Details | Domain | 8 | asq.d6shiiwz.pw |
|
| Details | Domain | 4 | asq.swhw71un.pw |
|
| Details | Domain | 6 | asd.s7610rir.pw |
|
| Details | Domain | 152 | cisa.gov |
|
| Details | 37 | report@cisa.gov |
||
| Details | File | 18 | how_to_decrypt.txt |
|
| Details | File | 10 | hive.bat |
|
| Details | File | 12 | shadow.bat |
|
| Details | File | 3 | windows_x64_encrypt.dll |
|
| Details | File | 4 | windows_x64_encrypt.exe |
|
| Details | File | 3 | windows_x32_encrypt.dll |
|
| Details | File | 4 | windows_x32_encrypt.exe |
|
| Details | File | 95 | wevtutil.exe |
|
| Details | File | 345 | vssadmin.exe |
|
| Details | File | 240 | wmic.exe |
|
| Details | File | 105 | bcdedit.exe |
|
| Details | IPv4 | 4 | 84.32.188.57 |
|
| Details | IPv4 | 4 | 84.32.188.238 |
|
| Details | IPv4 | 4 | 93.115.26.251 |
|
| Details | IPv4 | 3 | 185.8.105.67 |
|
| Details | IPv4 | 4 | 181.231.81.239 |
|
| Details | IPv4 | 3 | 185.8.105.112 |
|
| Details | IPv4 | 4 | 186.111.136.37 |
|
| Details | IPv4 | 4 | 192.53.123.202 |
|
| Details | IPv4 | 4 | 158.69.36.149 |
|
| Details | IPv4 | 3 | 46.166.161.123 |
|
| Details | IPv4 | 4 | 108.62.118.190 |
|
| Details | IPv4 | 3 | 46.166.161.93 |
|
| Details | IPv4 | 3 | 185.247.71.106 |
|
| Details | IPv4 | 3 | 46.166.162.125 |
|
| Details | IPv4 | 3 | 5.61.37.207 |
|
| Details | IPv4 | 3 | 46.166.162.96 |
|
| Details | IPv4 | 3 | 185.8.105.103 |
|
| Details | IPv4 | 3 | 46.166.169.34 |
|
| Details | IPv4 | 3 | 5.199.162.220 |
|
| Details | IPv4 | 3 | 93.115.25.139 |
|
| Details | IPv4 | 3 | 5.199.162.229 |
|
| Details | IPv4 | 3 | 93.115.27.148 |
|
| Details | IPv4 | 3 | 89.147.109.208 |
|
| Details | IPv4 | 5 | 83.97.20.81 |
|
| Details | MITRE ATT&CK Techniques | 191 | T1133 |
|
| Details | MITRE ATT&CK Techniques | 310 | T1566.001 |
|
| Details | MITRE ATT&CK Techniques | 542 | T1190 |
|
| Details | MITRE ATT&CK Techniques | 235 | T1562 |
|
| Details | MITRE ATT&CK Techniques | 695 | T1059 |
|
| Details | MITRE ATT&CK Techniques | 276 | T1490 |
|
| Details | MITRE ATT&CK Techniques | 247 | T1070 |
|
| Details | MITRE ATT&CK Techniques | 550 | T1112 |
|
| Details | Url | 4 | https://mega.nz |
|
| Details | Url | 5 | https://send.exploit.in |
|
| Details | Url | 4 | https://ufile.io |
|
| Details | Url | 6 | https://www.sendspace.com |
|
| Details | Url | 3 | https://privatlab.net |
|
| Details | Url | 3 | https://privatlab.com |