diamondfox | cef07b00f19592b93cc5e4455543cb0ed55f24a4088c3db338578fbea69d8392

Sharing

General

Target
nuclei-templates-main.zip
Size 17.5MB
Sample260705-wsv6csav4q
SHA256 cef07b00f19592b93cc5e4455543cb0ed55f24a4088c3db338578fbea69d8392
MD5 dea347841856cd67113f8d666c138bf9
SHA1 6a4409677c9906173db5b0fa3534e1e2c13e2be3
SHA512 ef964f0de27f1c939ff2ec49ca556da5ef013a556fa23ccd51d0483bed8a310d1fb80e28a7664023030e6d29cb9399191bdb760f52ebcbb3cd761e2e20c5d4d1
SSDEEP 393216:f5ArYUax4oonO/3gpM9GcOwzLF2yxhIZwUovgqmljD:f5GaxIkg0GcXvFI6UdqmdD
TLSH
T17707BF8EC39ABDA8E75215BFBD021696D730D4801B88550339F8B62D0CDA46F3FBA15D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  nuclei-templates-main/.github/scripts/assign_tasks.py
- Size 5KB
- SHA256 97791e1381dc048c05af2d1c644de11cb73291f08d0a694601a2e950ada53c35
- MD5 bdab449966b5c4be6dff13ee8d6fc7a7
- SHA1 e9f0e102d31e4587ce2e3fef554d773f66d92af9
- SHA512 91fa8aa72db16e302a07ffadf74e23af2b88181f2b7ab54f8be56963c52037d3174f362b9d8dd5f2f3d25e671b7dede47a9f7969089b12ff9c2097a9b24d4f91
- SSDEEP 96:9IR3odXcrxRQkmefwTxaYc+EJowwxaYCn9m2QkPx0w6+Jc:9Vpcr/Q4fwEYc+EJohEYCnY2QIx0ic
- TLSH
  T120B1DF9BAC084033D76359B88C728292825BBA078BD93530B57C509C0F5976DB3FA1FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral1 behavioral2
- Target
  nuclei-templates-main/.github/scripts/count-kev-stats.py
- Size 3KB
- SHA256 1804997c53fb0bd9465c581d5a3d0ba58936591b1b613c53ae819f79d40a82e4
- MD5 d2c0d7bc026a792f49e46059428a0d80
- SHA1 fcb70192c09991f3912fc541304e297d6058aed3
- SHA512 956705f5fb25989db329f2d9639a6173f9df9f4adf4bc456dc9661fee06af9c805ce2a1d979e2c0f008a157625339bfbd4e0438cae9edf7a373f69ccf8f9850c
- TLSH
  T1BF711E01A5944A608BB3CD6CFA685B60A32374070F6B7932B8DEC2106F5406343FF9BD
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery execution
behavioral3 behavioral4 behavioral5 behavioral6
- Target
  nuclei-templates-main/.github/scripts/enhance-cve-fields.py
- Size 3KB
- SHA256 42f2b7b6162446aeea0b63f488b91b19d9832d9a13fde138d22ebd8980980374
- MD5 d1f89de5c1ded48e1eb6c4635261aa00
- SHA1 f52810d006901b4338d1e9a2a2a15121a45c9d3a
- SHA512 d7d42a4838928c5f8c34c3ba65ae9597c69b38baaae4c1a74e64b04f0957107c99a4e800b12fcc616dcad4aa4839b431b46bf55c8ac92a281f586d5a1a721240
- TLSH
  T17A713F669C92A951C75B083D8985B4066331BE2BA6851030FFDCC75E1F40276E3F6B78
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery execution
behavioral10 behavioral7 behavioral8 behavioral9
- Target
  nuclei-templates-main/.github/scripts/update-epss.py
- Size 9KB
- SHA256 388a8db33178874b9295f01100f6c30d060be718d079ecf66c45236c3bd8ea61
- MD5 5a5f95c14db9a446503054ae9c0167e1
- SHA1 d79a372eda16166546ff270bfbb19fa12a127a17
- SHA512 3c445554d1b2facfe8d5bdb98c996bfcd924ee9009f51eb9ca727ee93bd778e917dbfec8d0c4265a69678f8d76429b9ac9517f4f6285c4622a0230d76db31af7
- SSDEEP 96:iouJkOLnHw6S4WnO1H8EW1OR5jYrVeaCvbK3sD8CEFHe+SiuwiXTnU824:oZLHwqxH8EW1OR5jJnv8swbj4
- TLSH
  T15D1252625CA5A934C3A3A8BCC506A151233ABD575B443439B9DC814C1FAB331CBF9AFD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery execution
behavioral11 behavioral12 behavioral13 behavioral14
- Target
  nuclei-templates-main/.github/scripts/update-kev.py
- Size 14KB
- SHA256 8a1bce668776fee44fff22350219763052f90c45f961e4f661b9499ffa878e8e
- MD5 c7b235ba4a915e58a7eab6927c43c710
- SHA1 f865b104e7c68687ac6ecc7ab8637f4d2393cd52
- SHA512 eae1d769fff0265c55b85bc5b2d41949a91b86e9148c65f4884f62adb2ae572f43dfc134ba96818c03eea63a864f51ed3f32bdbb23c8063f81e3b9596f464f04
- SSDEEP 192:UI709bebPBtlIKtXZ0KEs2j2lpppkZz+WmXjIRwXma5PoG6Nr8whcE9XYtdAf4:UI709WPP1R7ppO+WujIRQmaCpTkv
- TLSH
  T159525212A4818674D3F38CADD996B012172A7D235B4D7131B5EC418CEF92660D2FBEFA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery execution
behavioral15 behavioral16 behavioral17 behavioral18
- Target
  nuclei-templates-main/.github/scripts/update-readme.py
- Size 1KB
- SHA256 35b411d57842542d7b615f55ed6022dc4e6e1383a84b0f60c2d80f63687ab2d9
- MD5 edda1ba34021278f347f0b5c2876c627
- SHA1 d2cb6838fb7683dea1de057c07853df563dfbba0
- SHA512 8aa8fc776743c8a90b72f8c9485a447c7b7ac11203d3524b9a754d5afa7a34dddb922ffde4d7362b1c31016d01952803226df264209869aa23c50c030b4e9985
- TLSH
  T10F41720ADFEEC7030B506CBCE4285FD1A6FC96622796843250E0C943008C587C2FEA6E
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery execution
behavioral19 behavioral20 behavioral21 behavioral22
- Target
  nuclei-templates-main/.github/scripts/weak-matcher-checks.sh
- Size 994B
- SHA256 1c4e0a544dc5715e5d760390e0664c933a0ce5bfbca7ef278cccfc3696ae0255
- MD5 bf2b8f8ea33e7244a4bbd96b2e5e33f8
- SHA1 709488d6fae92f179ab107cd07361720ef881e53
- SHA512 7c399793cd04f028a2482853240c2a63ae0e4342c46cb0558b1b97f1c089660b8a266215d5898be33981fd0dbf9970339e608bd2ec492099f1c6d100d916953d
- TLSH
  T13311CEF5B7A325E9A47BD222BF5C02E38CB1F0A8F4390859A15855791129C66D03C576
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral23 behavioral24 behavioral25 behavioral26
- Target
  nuclei-templates-main/.github/scripts/wordpress-plugins-update.py
- Size 6KB
- SHA256 d0d294ed73c3469600fbff7ab78640d4ae83aac77426792666bf0b7cf661fb63
- MD5 7e8d643a284ddb865bfd9c31605ccdd7
- SHA1 10ad3d10abcf3df168bdca6643bbd587751592a9
- SHA512 be368220b7347a751f2bc53ce34448354b5069fac1f6b26b1f1ea4577dd06ea05ac4d895082a0dd21cbf08c1f9e06e15a137f177caac4f073643ffc54379bd7c
- SSDEEP 96:qF9QCV7OdwtwSU2/ig+c5g684CiTPI5oJFY8Vtex+HAOx:+9+uy2Kdc+QkQSx+gOx
- TLSH
  T1FDD1A527DC19697343B6C56CD4DAA481D3B70217BB99B811339C40681F986BDE3FA1EC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery execution
behavioral27 behavioral28 behavioral29 behavioral30
- Target
  nuclei-templates-main/cloud/azure/storageaccounts/azure-blob-immutable-not-enabled.yaml
- Size 2KB
- SHA256 5a0256e7bb04bff74d572f13f555a0686d513f50b446f65a9aff4c65bb0e354a
- MD5 5b8e61922bea07413fbcd670dbaa9dd3
- SHA1 0b80358e6f53d0eac90d88cbfbb09fb9250cbcc0
- SHA512 3cc4431719c2c49278fd8f1b25f10ecd7f4b89108128bdc62f3adf0247fc290a9edd3ea18e5d7fa6c55025cad8afa0fa8b4c36a28b914dc659e2d5ee5aba35c9
- TLSH
  T1DB5174455F61A131F7AA80BED321D345DF34A85B92058E3239CDC24D6F86216E36F9E0
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Python

T1059.006

Unix Shell

T1059.004

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32