| ELF 64-bit LSB shared object, x86-64, version 1 (SYSV) | |
| 246.5 KB · 252,392 bytes | |
6.379
/ 8 | |
| 1× | |
| 2026-10-18 13:34 UTC | |
| 2026-11-14 16:23 UTC |
| MD5 | 22ae3e19ec54a9d314719158c00986e3 | |
|---|---|---|
| SHA-1 | 84353fe08dd87eb2f1086dfd08c014311e7e4889 | |
| SHA-256 | 822d89e7917d41a90f5f65bee75cad31fe13995e43f47ea9ea536862884efc25 | |
| SHA-512 | a72a3e8fb908c2ed946b9266cc742b1584709205f1911e381823ef7caac10d55ccec2f35c3e7ca4a3eda7e04e1b57ec2039054c087fdc39241554cd82b62570e | |
| TLSH | T118347E5BB2D1A87DC8B6D830875BC6639636F8A41292F93F36845E702D23E305F2D761 |
Known indicators 2
| Group | Found in | Type | Indicator | Details | TLP | Added |
|---|---|---|---|---|---|---|
| hive | File strings | Onion | hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion |
Chat of hive (This domain has been seized) Source: ransomware.live group data Chatoffline |
TLP:CLEAR | |
| hive | File strings | Onion | hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion |
DLS of hive (This domain has been seized) Source: ransomware.live group data DLSoffline |
TLP:CLEAR |
YARA 2 · 500 rule files from Ransomware.live
Behaviour indicators 4 · from embedded strings
| Category | Indicator | ATT&CK | Evidence |
|---|---|---|---|
| Impact | Kills ESXi virtual machines | T1529 | /vmfs/volumes/ vim-cmd vmsvc/getallvms | grep -o -E '^[0-9]+' | xargs -r -n 1 vim-cmd vmsvc/power.off |
| Ransom note | Ransom note text | T1486 | Your network has been breached and all data were encrypted. - Do not modify or rename encrypted files. You will lose them. |
| Ransom note | References Tor / .onion | T1090.003 | http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/ To get an access to .onion websites download and install Tor Browser at: |
| Cryptography | Bundles a crypto library | T1486 | src/pk/ecc/ltc_ecc_map.c src/pk/ecc/ltc_ecc_mul2add.c src/pk/ecc/ltc_ecc_mulmod_timing.c |
MITRE ATT&CK 5 · techniques suggested by the static analysis, not observed behaviour
T1059.004
Command and Scripting Interpreter: Unix Shell
Runs shell commands
T1083
File and Directory Discovery
File enumeration
T1090.003
Proxy: Multi-hop Proxy
References Tor / .onion
T1486
Data Encrypted for Impact
Ransom note text · Bundles a crypto library
T1529
System Shutdown/Reboot
Kills ESXi virtual machines
Visual analysis · hover the charts for offsets
Entropy across the file
Shannon entropy (0–8) of 1,024-byte windows. Code and data sit around 4–6; a plateau above 7.2 means compressed or encrypted content (packed code, embedded archives, encrypted payloads). 9% of the file is above it.
File layout on disk
Each part of the file at its real size. Data after the last section (an overlay) is where droppers and installers often hide a payload.
.text
.rodata
.eh_frame
| Part | Offset | Size | Share | Entropy |
|---|---|---|---|---|
| ELF header | 0x0 | 64 B | 0.0% |
2.28 |
| Program headers | 0x40 | 616 B | 0.2% |
1.82 |
| .interp | 0x2a8 | 28 B | 0.0% |
3.94 |
| .note.gnu.build-id | 0x2c4 | 36 B | 0.0% |
4.19 |
| .note.ABI-tag | 0x2e8 | 32 B | 0.0% |
1.56 |
| .gnu.hash | 0x308 | 40 B | 0.0% |
2.57 |
| .dynsym | 0x330 | 1.5 KB | 0.6% |
0.98 |
| .dynstr | 0x900 | 709 B | 0.3% |
4.64 |
| Gap | 0xbc5 | 1 B | 0.0% |
0.0 |
| .gnu.version | 0xbc6 | 124 B | 0.0% |
1.67 |
| Gap | 0xc42 | 6 B | 0.0% |
0.0 |
| .gnu.version_r | 0xc48 | 112 B | 0.0% |
2.73 |
| .rela.dyn | 0xcb8 | 3.8 KB | 1.6% |
2.22 |
| .rela.plt | 0x1c18 | 1.3 KB | 0.5% |
1.68 |
| Gap | 0x2140 | 3.7 KB | 1.5% |
0.0 |
| .init | 0x3000 | 27 B | 0.0% |
4.31 |
| Gap | 0x301b | 5 B | 0.0% |
0.0 |
| .plt | 0x3020 | 896 B | 0.4% |
4.17 |
| .plt.got | 0x33a0 | 8 B | 0.0% |
3.0 |
| Gap | 0x33a8 | 8 B | 0.0% |
0.0 |
| .text | 0x33b0 | 160.1 KB | 65.0% |
6.41 |
| Gap | 0x2b445 | 3 B | 0.0% |
0.0 |
| .fini | 0x2b448 | 13 B | 0.0% |
3.24 |
| Gap | 0x2b455 | 2.9 KB | 1.2% |
0.0 |
| .rodata | 0x2c000 | 41.1 KB | 16.7% |
6.99 |
| .eh_frame_hdr | 0x36488 | 2.8 KB | 1.1% |
5.34 |
| Gap | 0x36f94 | 4 B | 0.0% |
0.0 |
| .eh_frame | 0x36f98 | 18.1 KB | 7.3% |
5.09 |
| Gap | 0x3b800 | 2.9 KB | 1.2% |
0.0 |
| .init_array | 0x3c3b0 | 8 B | 0.0% |
1.06 |
| .fini_array | 0x3c3b8 | 8 B | 0.0% |
1.06 |
| .data.rel.ro | 0x3c3c0 | 2.1 KB | 0.8% |
2.71 |
| .dynamic | 0x3cc08 | 512 B | 0.2% |
1.53 |
| .got | 0x3ce08 | 504 B | 0.2% |
1.69 |
| .data | 0x3d000 | 408 B | 0.2% |
2.39 |
| .comment | 0x3d198 | 81 B | 0.0% |
4.32 |
| .shstrtab | 0x3d1e9 | 251 B | 0.1% |
4.25 |
| Gap | 0x3d2e4 | 4 B | 0.0% |
0.0 |
| Section headers | 0x3d2e8 | 1.8 KB | 0.7% |
1.55 |
Byte map
The whole file as a 128×128 picture: each pixel is 15.4 bytes, laid along a Hilbert curve so that bytes close in the file stay close in the picture and each part shows as a block. Starts top-left, ends top-right.
- Compressed / encrypted 9.0%
- Dense data 12.2%
- Code / structured data 63.0%
- Low entropy (headers, tables) 8.0%
- Text / strings 2.9%
- 0x00 padding 4.8%
- 0xFF fill 0.1%
Linux / ELF executable
Type
shared object / PIE
Machine
x86-64 (64-bit, little-endian)
OS ABI
System V
Entry point
0x3450
Linking
Dynamic · /lib64/ld-linux-x86-64.so.2
Libraries
libpthread.so.0, libc.so.6
Imports
60 functions
Symbols
Stripped
Capabilities from symbols
Cryptographic constants 3
Tables and constants of the algorithms compiled into the file, recognised without running or decrypting anything. A locker that brings its own cipher (ChaCha20, AES, Curve25519) needs no CryptoAPI import; many legitimate programs carry the same libraries, so this is context, not a verdict.
| Algorithm | Kind | Evidence | Confidence | Hits | First at |
|---|---|---|---|---|---|
| AES | block cipher | Te0 table | high | 1 | 0x33ba0 |
| AES | block cipher | Td0 table | high | 1 | 0x337a0 |
| SHA-256 | hash | initial values | medium | 2 | 0x2f2ec |
| SHA-512 | hash | K constants | high | 1 | 0x2f060 |
Indicators extracted from strings · from 495 strings. Only those listed under Known indicators are in our database
IP addresses (2)
1.3.101.110
1.3.101.112
Onion addresses (2)
hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion
hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion
URLs (3)
http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/
http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/
https://www.torproject.org/
IOC matches are re-checked against the database every time this page loads. YARA and static analysis ran once, when the file was first analysed (analyzer v6).