Overview

overview

10

Static

static

10

penligent.....5.exe

windows10-2004-x64

10

penligent.....5.exe

windows11-ltsc_2024-x64

10

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

$PLUGINSDIR/UAC.dll

windows10-2004-x64

3

$PLUGINSDIR/UAC.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ll.dll

windows10-2004-x64

3

$PLUGINSDI...ll.dll

windows11-ltsc_2024-x64

3

resources/...770.js

windows10-2004-x64

3

resources/...770.js

windows11-ltsc_2024-x64

3

resources/...771.js

windows10-2004-x64

3

resources/...771.js

windows11-ltsc_2024-x64

3

resources/...782.js

windows10-2004-x64

3

resources/...782.js

windows11-ltsc_2024-x64

3

resources/...439.js

windows10-2004-x64

3

resources/...439.js

windows11-ltsc_2024-x64

3

resources/...584.js

windows10-2004-x64

3

resources/...584.js

windows11-ltsc_2024-x64

8

resources/...257.js

windows10-2004-x64

3

resources/...257.js

windows11-ltsc_2024-x64

3

resources/...ing.js

windows10-2004-x64

3

resources/...ing.js

windows11-ltsc_2024-x64

3

resources/...rce.js

windows10-2004-x64

3

resources/...rce.js

windows11-ltsc_2024-x64

3

resources/...rce.js

windows10-2004-x64

3

resources/...rce.js

windows11-ltsc_2024-x64

3

resources/...706.js

windows10-2004-x64

3

resources/...706.js

windows11-ltsc_2024-x64

3

resources/...171.js

windows10-2004-x64

3

resources/...171.js

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    penligent.windows_2.1.5.exe
  • Size 310.7MB
  • Sample260626-czdecaht2q
  • SHA256 e95e26eb92a83d31239a7c117f6bd474a85d06225f4a1bbbecb620079b42e8af
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
diamondfoxadwarebotnetdefense_evasiondiscoveryexecutionjavascriptlinkpdfpersistencepyinstallerransomwarespywarestealersvg

Malware Config

Extracted

Path

  • C:\Users\Admin\AppData\Local\Temp\nsp8FA9.tmp\7z-out\resources\tools\nuclei\nuclei-templates\cloud\gcp\compute\gcloud-vm-disk-csek-not-enabled.yaml

Ransom Note
  • id: gcloud-vm-disk-csek-not-enabled info: name: Virtual Machine Disk Encryption with Customer-Supplied Keys Not Enabled author: princechaddha severity: high description: | Ensure that the disks attached to your production Google Compute Engine instances are encrypted with Customer-Supplied Encryption Keys (CSEKs) in order to have complete control over the data-at-rest encryption and decryption process. CSEKs allow you to provide your own encryption keys that Google Compute Engine uses to protect the Google-generated keys used to encrypt and decrypt your instance data. impact: | Without CSEK encryption, you have limited control over the encryption process of your VM disk data. Google Compute Engine service manages the encryption keys, which may not meet strict compliance requirements for sensitive data. remediation: | Re-create your VM instances with Customer-Supplied Encryption Keys (CSEKs) by providing a 256-bit string encoded in RFC 4648 standard base64 during instance creation. Note that Compute Engine does not store your CSEKs on its servers and cannot access your protected data unless you provide the required key. reference: - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/ComputeEngine/enable-encryption-with-csek.html - https://cloud.google.com/compute/docs/disks/customer-supplied-encryption tags: cloud,devops,gcp,gcloud,compute,encryption,csek,security,gcp-cloud-config flow: | code(1) for(let projectId of iterate(template.projectIds)){ set("projectId", projectId) code(2) for(let instance of iterate(template.instances)){ instance = JSON.parse(instance) set("instanceName", instance.name) set("zone", instance.zone) code(3) for(let disk of iterate(template.disks)){ set("diskName", disk) code(4) } } } self-contained: true code: - engine: - sh - bash source: | gcloud projects list --format="json(projectId)" extractors: - type: json name: projectIds internal: true json: - '.[].projectId' - engine: - sh - bash source: | gcloud compute instances list --project $projectId --format="json(name,zone.basename())" extractors: - type: json name: instances internal: true json: - '.[]' - engine: - sh - bash source: | gcloud compute instances describe $instanceName --zone $zone --project $projectId --format="json(disks[].deviceName)" extractors: - type: json name: disks internal: true json: - '.disks[].deviceName' - engine: - sh - bash source: | gcloud compute disks describe $diskName --zone $zone --project $projectId --format="json(diskEncryptionKey.sha256)" | jq '. // "null"' matchers: - type: word words: - "null" extractors: - type: dsl dsl: - '"Disk " + diskName + " attached to instance " + instanceName + " in zone " + zone + " of project " + projectId + " is not encrypted with a Customer-Supplied Encryption Key (CSEK)"' # digest: 4b0a00483046022100c2ddf98deb81b73823578ad0f0b7a5cdcb19b78a9b724b0a8fda299bff5a09b2022100aa01c142410c386168a489b065a27d1e0b089bde93147ac022b6bbb88de194a5:922c64590222798bb761d5b6d8e72950
URLs

  • https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/ComputeEngine/enable-encryption-with-csek.html

  • https://cloud.google.com/compute/docs/disks/customer-supplied-encryption

Extracted

Path

  • C:\Users\Admin\AppData\Local\Temp\nsp8FA9.tmp\7z-out\resources\tools\nuclei\nuclei-templates\cloud\gcp\iam\gcloud-iam-unrestricted-decryption.yaml

Ransom Note
  • id: gcloud-iam-unrestricted-decryption info: name: IAM Users with Unrestricted Data Decryption Permissions author: princechaddha severity: medium description: | Ensure that IAM users with data decryption permissions should use conditions to enforce strict controls, enhancing data protection and reducing risks of unauthorized decryption. For compliance, the Cloud KMS CryptoKey Decrypter (roles/cloudkms.cryptoKeyDecrypter), Cloud KMS Crypto Operator (roles/cloudkms.cryptoOperator), and Cloud KMS CryptoKey Encrypter/Decrypter (roles/cloudkms.cryptoKeyEncrypterDecrypter) roles must have a condition preventing data decryption with any KMS key. impact: | Without conditions on decryption permissions, IAM users can decrypt data using any KMS key in the project, potentially leading to unauthorized access to sensitive data. remediation: | Add IAM conditions to roles that allow decryption operations, restricting access to specific KMS keys. This can be done using resource.type and resource.name conditions in the IAM policy. reference: - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/IAM/decryption-with-all-keys-not-allowed.html - https://cloud.google.com/kms/docs/reference/permissions-and-roles tags: cloud,devops,gcp,gcloud,iam,security,encryption,kms,gcp-cloud-config flow: | code(1) for(let projectId of iterate(template.projectIds)){ set("projectId", projectId) code(2) } self-contained: true code: - engine: - sh - bash source: | gcloud projects list --format="json(projectId)" extractors: - type: json name: projectIds internal: true json: - '.[].projectId' - engine: - sh - bash source: | gcloud projects get-iam-policy $projectId --format="json(bindings[?(@.role=='roles/cloudkms.cryptoKeyDecrypter' || @.role=='roles/cloudkms.cryptoOperator' || @.role=='roles/cloudkms.cryptoKeyEncrypterDecrypter')])" matchers: - type: word words: - '"condition":' negative: true extractors: - type: dsl dsl: - '"Project " + projectId + " has IAM users with unrestricted decryption permissions that can access all KMS keys"' # digest: 490a00463044022012b07c04fff07c91b88ee8cd99e7411c0e7d79981f997ef24f1673f40235e490022055de031c4e4baf88803b9dbe0bc30fe24c5edbf8c3d04fe0f8ff3bce3b68316e:922c64590222798bb761d5b6d8e72950
URLs

  • https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/IAM/decryption-with-all-keys-not-allowed.html

  • https://cloud.google.com/kms/docs/reference/permissions-and-roles

Targets

    • Target
      penligent.windows_2.1.5.exe
    • Size 310.7MB
    • SHA256 e95e26eb92a83d31239a7c117f6bd474a85d06225f4a1bbbecb620079b42e8af
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    botnetdefense_evasiondiscoveryexecutiondiamondfoxransomwarestealerpyinstaller

    • DiamondFox stealer

    • Family: DiamondFox

      DiamondFox is a multipurpose botnet with many capabilities.

      botnetstealerdiamondfox

    • Loads dropped DLL

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution
    behavioral1behavioral2
    • Target
      $PLUGINSDIR/StdUtils.dll
    • Size 100KB
    • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral3behavioral4
    • Target
      $PLUGINSDIR/System.dll
    • Size 12KB
    • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral5behavioral6
    • Target
      $PLUGINSDIR/UAC.dll
    • Size 14KB
    • SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral7behavioral8
    • Target
      $PLUGINSDIR/WinShell.dll
    • Size 3KB
    • SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    discovery
    behavioral10behavioral9
    • Target
      resources/tools/nuclei/nuclei-templates/http/cves/2025/CVE-2025-53770.yaml
    • Size 31KB
    • SHA256 1d60620cb30bd24a2901fbecf61c8e2f585400b568272b5533dbe70a11221990
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral11behavioral12
    • Target
      resources/tools/nuclei/nuclei-templates/http/cves/2025/CVE-2025-53771.yaml
    • Size 31KB
    • SHA256 abb6aad784f148500de86b9abe54b13921b027e9a57281d94e6d7dc2407e1ba4
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral13behavioral14
    • Target
      resources/tools/nuclei/nuclei-templates/http/cves/2025/CVE-2025-54782.yaml
    • Size 2KB
    • SHA256 4506fef96629827f1a728ad9ee53db93de49f9da970a7e91a3ab7721a90f1602
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral15behavioral16
    • Target
      resources/tools/nuclei/nuclei-templates/http/cves/2026/CVE-2026-33439.yaml
    • Size 10KB
    • SHA256 de5513b79082392824c6a047bc9e0b9bdfefc742d60654ef01b5914dc6616613
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral17behavioral18
    • Target
      resources/tools/nuclei/nuclei-templates/http/cves/2026/CVE-2026-3584.yaml
    • Size 3KB
    • SHA256 0fd87b759c850cec88c71a8607851c1582a2eed3cb7efdbacf902b40a3716c15
    • MD5 SHA1 SHA512 TLSH
    Score
    8/10
    executionadwarepersistenceransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral19behavioral20
    • Target
      resources/tools/nuclei/nuclei-templates/http/cves/2026/CVE-2026-4257.yaml
    • Size 2KB
    • SHA256 5f6cc9f6095d62ac1e118349dfeaa0f861eac539315c5c2fac5837721c6e4434
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral21behavioral22
    • Target
      resources/tools/nuclei/nuclei-templates/http/miscellaneous/directory-listing.yaml
    • Size 2KB
    • SHA256 0de4cb1dc1d0593140aedce2d5bac5c1dd56718e3992084725c9e86e744b674c
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral23behavioral24
    • Target
      resources/tools/nuclei/nuclei-templates/http/vulnerabilities/landray/landray-oa-treexml-rce.yaml
    • Size 1KB
    • SHA256 eb866b87a18411a1fe0296df071fc0a0606b403cc4df29bc38f5d7e47fe6e4dc
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral25behavioral26
    • Target
      resources/tools/nuclei/nuclei-templates/http/vulnerabilities/opencpu/opencpu-rce.yaml
    • Size 1KB
    • SHA256 e731787ec86f2da8ac11d74d692efc5744450745df2ca27b9642d7f00fd0cd55
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral27behavioral28
    • Target
      resources/tools/nuclei/nuclei-templates/javascript/cves/2016/CVE-2016-8706.yaml
    • Size 2KB
    • SHA256 db298375b8240ed21e44dfd22345b3f31c8fcdeee5a296884102901981a3f7d4
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral29behavioral30
    • Target
      resources/tools/nuclei/nuclei-templates/javascript/cves/2018/CVE-2018-0171.yaml
    • Size 3KB
    • SHA256 019e0a7ffa08bee8195da40e178bdeca5780a6811e992444e85dc61d1806540c
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral31behavioral32

MITRE ATT&CK Enterprise v16

Tasks

static1

pdflinksvgjavascriptbotnetstealerdiamondfox
Score
10/10

behavioral1

botnetdefense_evasiondiscoveryexecutiondiamondfoxransomwarestealer
Score
10/10

behavioral2

botnetdefense_evasiondiscoveryexecutiondiamondfoxpyinstallerransomwarestealer
Score
10/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
3/10

behavioral9

discovery
Score
3/10

behavioral10

discovery
Score
3/10

behavioral11

execution
Score
3/10

behavioral12

execution
Score
3/10

behavioral13

execution
Score
3/10

behavioral14

execution
Score
3/10

behavioral15

execution
Score
3/10

behavioral16

execution
Score
3/10

behavioral17

execution
Score
3/10

behavioral18

execution
Score
3/10

behavioral19

execution
Score
3/10

behavioral20

adwareexecutionpersistenceransomwarespyware
Score
8/10

behavioral21

execution
Score
3/10

behavioral22

execution
Score
3/10

behavioral23

execution
Score
3/10

behavioral24

execution
Score
3/10

behavioral25

execution
Score
3/10

behavioral26

execution
Score
3/10

behavioral27

execution
Score
3/10

behavioral28

execution
Score
3/10

behavioral29

execution
Score
3/10

behavioral30

execution
Score
3/10

behavioral31

execution
Score
3/10

behavioral32

execution
Score
3/10