Verdict

Known ransomware

hive, snatch ransomware · Windows executable · 2 known IOCs · 3 YARA hits · 3 behaviour indicators · 6 ATT&CK techniques · seen 1×

YARA: Snatch hive
Links to the onion site of: hive

File details
File name
Type	PE32 executable for MS Windows 6.01 (GUI), Intel i386 (stripped to external PDB), UPX compressed, 3 sections
Size	764.1 KB · 782,394 bytes
Entropy	7.999 / 8
Submitted	1×
First seen	2026-10-18 13:34 UTC
Analysed	2026-11-14 16:23 UTC

Hashes
MD5	2f9fc82898d718f2abe99c4a6fa79e69
SHA-1	9d336b8911c8ffd7cc809e31d5b53796bb0cc7bb
SHA-256	88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1
SHA-512	19f0879b1c54d305ab7a97a0d46ab79c103d4687fe37d5f9ef1934904eea48a1c66b1ac2de3dace6dc0d91623309287044c198cb0b3fc9f8453fbc9d1c0cae8b
Imphash	6ed4f5f04d62b18d96b26d6db7c18840
TLSH	T197F423F804553C05C4A6B3F5CA8F7BCF81C5183A65CAFB48DF1CA92869FA0609525A9F

Look it up elsewhere VirusTotal MalwareBazaar Hybrid Analysis Triage

Known indicators 2

Group	Found in	Type	Indicator	Details	TLP	Added
hive	File strings	Onion	hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion	Chat of hive (This domain has been seized) Source: ransomware.live group data Chatoffline	TLP:CLEAR
hive	File strings	Onion	hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion	DLS of hive (This domain has been seized) Source: ransomware.live group data DLSoffline	TLP:CLEAR

Negotiations on file · leaked or shared chats with the group this file is attributed to

Group	Chats	Median demand	Median after negotiation	Marked paid
hive read the chats	8	$1,100,000	$275,800	0

Amounts come from the chats where they are known; most chats don't say whether the victim paid.

YARA 3 · 500 rule files from Ransomware.live

Group	Rule	Description	Author
snatch	snatch_ransomware_safe_go_ransomware	snatch-ransomware - file safe.exe	DFIR Report
hive	Windows_Ransomware_Hive_55619cd0 in unpacked (UPX)	—	Elastic Security
hive	Windows_Ransomware_Hive_b97ec33b in unpacked (UPX)	—	Elastic Security

8 low-confidence ransom-note rules matched (ignored for executables)

bertdreadglobalrampshadowunknownunsafevect

Behaviour indicators 3 · from embedded strings, including those of the files inside

Category	Indicator	ATT&CK	Evidence
Recovery inhibition	Deletes shadow copies in unpacked (UPX)	T1490	RtlDosPathNameToNtPathName_U_WithStatusasn1: Unmarshal recipient value is nil math/big: buffer too small to fit valuemismatched count during itab table copymissing argument to repetition operatormspan
Ransom note	Ransom note text in unpacked (UPX)	T1486	- Do not modify or rename encrypted files. You will lose them.
Ransom note	References Tor / .onion in unpacked (UPX)	T1090.003	x509: cannot verify signature: algorithm unimplementedSOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zonescasfrom_Gscanstatus:top gp->status is not in scan stategentraceback callback cannot be used

MITRE ATT&CK 6 · techniques suggested by the static analysis, not observed behaviour

T1055 Process Injection Process injection T1083 File and Directory Discovery File enumeration T1090.003 Proxy: Multi-hop Proxy References Tor / .onion T1486 Data Encrypted for Impact Ransom note text · Encryption (crypto library) T1489 Service Stop Process termination T1490 Inhibit System Recovery Deletes shadow copies

Visual analysis · hover the charts for offsets

Entropy across the file

Shannon entropy (0–8) of 3,057-byte windows. Code and data sit around 4–6; a plateau above 7.2 means compressed or encrypted content (packed code, embedded archives, encrypted payloads). 100% of this file is above that line.

File layout on disk

Each part of the file at its real size. Data after the last section (an overlay) is where droppers and installers often hide a payload.

UPX1

Part	Offset	Size	Share	Entropy
Headers	0x0	4.0 KB	0.5%	7.66
UPX1	0x1000	759.5 KB	99.4%	8.0
UPX2	0xbee00	512 B	0.1%	1.51
Overlay	0xbf000	58 B	0.0%	2.65
Import table (inside a section)	0xbee00	136 B	0.0%

Byte map

The whole file as a 128×128 picture: each pixel is 47.75 bytes, laid along a Hilbert curve so that bytes close in the file stay close in the picture and each part shows as a block. Starts top-left, ends top-right.

Compressed / encrypted 99.4%
Dense data 0.1%
Code / structured data 0.3%
0x00 padding 0.1%

Windows executable packed

Type

EXE

Machine

I386 (32-bit)

Subsystem

WINDOWS_GUI

Compile time

zeroed / invalid

Entry point

0x260f30

Image base

0x400000

Signature

Not signed

Imports

4 functions from 1 DLLs

Overlay

58 bytes after the last section

Packer

UPX

Exploit mitigations · set by the linker; hand-built malware often ships without them

ASLR DEP CFG SafeSEH Stack cookies (/GS)

Packers, installers and compilers identified (1)

Name	Kind	Evidence
UPX	packer	section upx0

Sections

Name	Virtual address	Virtual size	Raw size	Flags	Entropy	Notes
UPX0	0x1000	1,712,128	0	RWX	0.0	writable + executableempty on disk
UPX1	0x1a3000	782,336	781,312	RWX	8.0	high entropy (packed/encrypted?)writable + executableentry point
UPX2	0x262000	4,096	512	RW-	1.508

Imports (4)

KERNEL32.DLL

LoadLibraryA, ExitProcess, GetProcAddress, VirtualProtect

Unpacked image · UPX removed in the sandbox, then analysed like the file itself

The packed file only shows the unpacking stub. The YARA, behaviour, IOC and ATT&CK results above include what was found in the original image below.

Kind

Windows executable (Go)

Size

2,292,794 bytes

Imports

39 functions from 1 DLLs

YARA

Windows_Ransomware_Hive_55619cd0, Windows_Ransomware_Hive_b97ec33b

MD5	61a8fc763aa8bfdb1e43001566bcfce7
SHA-256	8d797c2e404f3162c836020500b99c524deedabfc4770ee54fd9e0ea8bfd2ef4
Imphash	4035d2883e01d64f3e7a9dccb1d63af5
TLSH	T110B53950F8DB84F2D903763149A7A3AF27307A055B35DBC7D740AEAAFC366E10932616

Capabilities from imports

Capability	APIs / types	ATT&CK
Process injection	SetThreadContext	T1055
Encryption (crypto library)	crypto/cipher.initcrypto/rsa.EncryptOAEP	T1486
File enumeration	os.(*File).ReadDirpath/filepath.WalkDir	T1083
Process termination	os.(*Process).Kill	T1489

Imports (39)

KERNEL32.DLL

WriteFile, WriteConsoleW, WaitForMultipleObjects, WaitForSingleObject, VirtualQuery, VirtualFree, VirtualAlloc, SwitchToThread, SuspendThread, Sleep, SetWaitableTimer, SetUnhandledExceptionFilter, SetProcessPriorityBoost, SetEvent, SetErrorMode, SetConsoleCtrlHandler, ResumeThread, PostQueuedCompletionStatus, LoadLibraryA, LoadLibraryW, SetThreadContext, GetThreadContext, GetSystemInfo, GetSystemDirectoryA, GetStdHandle, GetQueuedCompletionStatusEx, GetProcessAffinityMask, GetProcAddress, GetEnvironmentStringsW, GetConsoleMode, FreeEnvironmentStringsW, ExitProcess, DuplicateHandle, CreateWaitableTimerExW, CreateThread, CreateIoCompletionPort, CreateEventA, CloseHandle, AddVectoredExceptionHandler

Indicators extracted from strings · from 1,322 strings. Only those listed under Known indicators are in our database

IP addresses (6)

2.5.4.102

4.52.5.4

5.4.112.5

5.4.32.5

5.4.82.5

62.5.4.72

Onion addresses (2)

hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion

hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion

URLs (1)

http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/too

Generated YARA rule

Drafted from this file's static analysis: strings the analyzer found (PDB path, embedded indicators, names, behaviour evidence), the imphash for PE files, and the exact SHA-256 as a fallback. Review and tune it before deploying.

IOC matches are re-checked against the database every time this page loads. YARA and static analysis ran once, when the file was first analysed (analyzer v6).