Overview

overview

10

Static

static

10

nuclei.exe

windows10-2004-x64

10

nuclei.exe

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    nuclei_3.10.0_windows_amd64.zip
  • Size 41.5MB
  • Sample260705-wsv6csav4p
  • SHA256 c4c16fc832ba46b78e1a062966bb38e1793679dbdd79d5a5422b3b8605a606b3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
diamondfoxgafgytbotnetdefense_evasionransomwarespywarestealertrojan

Malware Config

Extracted

Family

  • gafgyt

C2

  • 8.8.8.8:538

Extracted

Path

  • C:\Users\Admin\nuclei-templates\cloud\gcp\compute\gcloud-vm-disk-csek-not-enabled.yaml

Ransom Note
  • id: gcloud-vm-disk-csek-not-enabled info: name: Virtual Machine Disk Encryption with Customer-Supplied Keys Not Enabled author: princechaddha severity: high description: | Ensure that the disks attached to your production Google Compute Engine instances are encrypted with Customer-Supplied Encryption Keys (CSEKs) in order to have complete control over the data-at-rest encryption and decryption process. CSEKs allow you to provide your own encryption keys that Google Compute Engine uses to protect the Google-generated keys used to encrypt and decrypt your instance data. impact: | Without CSEK encryption, you have limited control over the encryption process of your VM disk data. Google Compute Engine service manages the encryption keys, which may not meet strict compliance requirements for sensitive data. remediation: | Re-create your VM instances with Customer-Supplied Encryption Keys (CSEKs) by providing a 256-bit string encoded in RFC 4648 standard base64 during instance creation. Note that Compute Engine does not store your CSEKs on its servers and cannot access your protected data unless you provide the required key. reference: - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/ComputeEngine/enable-encryption-with-csek.html - https://cloud.google.com/compute/docs/disks/customer-supplied-encryption tags: cloud,devops,gcp,gcloud,compute,encryption,csek,security,gcp-cloud-config flow: | code(1) for(let projectId of iterate(template.projectIds)){ set("projectId", projectId) code(2) for(let instance of iterate(template.instances)){ instance = JSON.parse(instance) set("instanceName", instance.name) set("zone", instance.zone) code(3) for(let disk of iterate(template.disks)){ set("diskName", disk) code(4) } } } self-contained: true code: - engine: - sh - bash source: | gcloud projects list --format="json(projectId)" extractors: - type: json name: projectIds internal: true json: - '.[].projectId' - engine: - sh - bash source: | gcloud compute instances list --project $projectId --format="json(name,zone.basename())" extractors: - type: json name: instances internal: true json: - '.[]' - engine: - sh - bash source: | gcloud compute instances describe $instanceName --zone $zone --project $projectId --format="json(disks[].deviceName)" extractors: - type: json name: disks internal: true json: - '.disks[].deviceName' - engine: - sh - bash source: | gcloud compute disks describe $diskName --zone $zone --project $projectId --format="json(diskEncryptionKey.sha256)" | jq '. // "null"' matchers: - type: word words: - "null" extractors: - type: dsl dsl: - '"Disk " + diskName + " attached to instance " + instanceName + " in zone " + zone + " of project " + projectId + " is not encrypted with a Customer-Supplied Encryption Key (CSEK)"' # digest: 4b0a00483046022100c2ddf98deb81b73823578ad0f0b7a5cdcb19b78a9b724b0a8fda299bff5a09b2022100aa01c142410c386168a489b065a27d1e0b089bde93147ac022b6bbb88de194a5:922c64590222798bb761d5b6d8e72950
URLs

  • https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/ComputeEngine/enable-encryption-with-csek.html

  • https://cloud.google.com/compute/docs/disks/customer-supplied-encryption

Extracted

Path

  • C:\Users\Admin\nuclei-templates\cloud\gcp\iam\gcloud-iam-unrestricted-decryption.yaml

Ransom Note
  • id: gcloud-iam-unrestricted-decryption info: name: IAM Users with Unrestricted Data Decryption Permissions author: princechaddha severity: medium description: | Ensure that IAM users with data decryption permissions should use conditions to enforce strict controls, enhancing data protection and reducing risks of unauthorized decryption. For compliance, the Cloud KMS CryptoKey Decrypter (roles/cloudkms.cryptoKeyDecrypter), Cloud KMS Crypto Operator (roles/cloudkms.cryptoOperator), and Cloud KMS CryptoKey Encrypter/Decrypter (roles/cloudkms.cryptoKeyEncrypterDecrypter) roles must have a condition preventing data decryption with any KMS key. impact: | Without conditions on decryption permissions, IAM users can decrypt data using any KMS key in the project, potentially leading to unauthorized access to sensitive data. remediation: | Add IAM conditions to roles that allow decryption operations, restricting access to specific KMS keys. This can be done using resource.type and resource.name conditions in the IAM policy. reference: - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/IAM/decryption-with-all-keys-not-allowed.html - https://cloud.google.com/kms/docs/reference/permissions-and-roles tags: cloud,devops,gcp,gcloud,iam,security,encryption,kms,gcp-cloud-config flow: | code(1) for(let projectId of iterate(template.projectIds)){ set("projectId", projectId) code(2) } self-contained: true code: - engine: - sh - bash source: | gcloud projects list --format="json(projectId)" extractors: - type: json name: projectIds internal: true json: - '.[].projectId' - engine: - sh - bash source: | gcloud projects get-iam-policy $projectId --format="json(bindings[?(@.role=='roles/cloudkms.cryptoKeyDecrypter' || @.role=='roles/cloudkms.cryptoOperator' || @.role=='roles/cloudkms.cryptoKeyEncrypterDecrypter')])" matchers: - type: word words: - '"condition":' negative: true extractors: - type: dsl dsl: - '"Project " + projectId + " has IAM users with unrestricted decryption permissions that can access all KMS keys"' # digest: 490a00463044022012b07c04fff07c91b88ee8cd99e7411c0e7d79981f997ef24f1673f40235e490022055de031c4e4baf88803b9dbe0bc30fe24c5edbf8c3d04fe0f8ff3bce3b68316e:922c64590222798bb761d5b6d8e72950
URLs

  • https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/IAM/decryption-with-all-keys-not-allowed.html

  • https://cloud.google.com/kms/docs/reference/permissions-and-roles

Targets

    • Target
      nuclei.exe
    • Size 131.1MB
    • SHA256 2079d913d3d7b8c5e5c77dd93c4cf2bebac3f3bbd8121564bff495c9354e5110
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    botnetdefense_evasiondiamondfoxransomwarespywarestealertrojan

    • DiamondFox stealer

    • Family: DiamondFox

      DiamondFox is a multipurpose botnet with many capabilities.

      botnetstealerdiamondfox
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks