7cfd243802fe48f24149d95961e07d8008f64a6113e8e0c0271a9da962f1161e

Sharing

Copy URL Twitter E-mail

General

Target
gitlab-agent-2.28.0.tgz
Size 75KB
Sample260707-wzag8scw2k
SHA256 7cfd243802fe48f24149d95961e07d8008f64a6113e8e0c0271a9da962f1161e
MD5 fbe4fd5569b3d6cfcd65e687120d8a43
SHA1 cf476fcc0e40fb2bbea12547a56cdcbca1ea8872
SHA512 4a9f951c29cfcba8b5ee0e09047fd6effdf746a4ab24644acd5d588878953f39b4552e583f1374df7a7ec7e94e440dab0412c2d05df9ff582caa141ad232c158
SSDEEP 1536:xY2hTiEDj/TiL4srvBFxOqyBLah8SPG14V6gB525mZDntAxHs8o7i:fRie0zg9LROwq1cNN
TLSH
T189730231293FED246602FD30CCAE5C8920481D5219FF7A4D9B2D1B9485B6E7EB35CE25
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  gitlab-agent/charts/ingress-nginx/templates/_helpers.tpl
- Size 8KB
- SHA256 a6c3621cf9a95e4683d702578cdf4a9df596539e4601e905cef2cf839f162ac3
- MD5 b7c4271bb4b7a12da740bc9e6fafd6a2
- SHA1 d847a40da61151f87d5f1382dce779e6a38e2d3f
- SHA512 629c9f4a8bdaecdde1ca0ffd0a4ac0af6024317370357bab898f46b84618683786c49b448f9ae19b685749f114286b8ba144cd5e45b4de1a87350cc375285dc2
- SSDEEP 192:ie0q16NCX9Gn5aSgOWzUMjGxkf+elWkNytyVoFr:ie0q16Vn5aSHW3hNrWp
- TLSH
  T14D124406A3D9417687F3896335AFD8152F2EC6DD215EBFD654E0E61C62D018B70E33A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  gitlab-agent/charts/ingress-nginx/tests/admission-webhooks/cert-manager_test.yaml
- Size 1KB
- SHA256 8cbb0ac637207563646f8ced028f6670e6ddc386181a603f1e34120ddfc2b818
- MD5 0b53160cddf08e8077c304e78a53a60d
- SHA1 9dcdecaaab1c5865bf8eaaed35f8afd80f0328c2
- SHA512 5504409158a3eabf5ba0a0b8d8b385c483105fd1b3a33ec2a2b1fc59686d958dbc0fd65125d920e95c885176628f4d5ba47b9abad425942c97210434d20db845
- TLSH
  T1D5213607566819B446A8D6F7E873E47E2436FD87A08A089E346CD2782B073054373B54
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  gitlab-agent/charts/ingress-nginx/tests/admission-webhooks/job-patch/clusterrole_test.yaml
- Size 345B
- SHA256 f659e60007aade8352ef2872f95aa14703f8159aafae52d0a647f96daa9d2b17
- MD5 139da688dd479327fadd9a8749405f9e
- SHA1 f1367173297f703f5208e062bec9ec0fcec110e2
- SHA512 4f3c426543ab2d3a177db160d2cecc7ea12c0534c430b66414e8ebd3358151041385c114864834c59f6b759b45642b27ec2bb644e14c50d45841b0765367d2e2
- TLSH
  T1C0E0DFAF42A412740541D0D76A3BE2FE9863CCCBF64858DA349DDA30AB036481027B21
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  gitlab-agent/charts/ingress-nginx/tests/admission-webhooks/job-patch/clusterrolebinding_test.yaml
- Size 366B
- SHA256 e3623fa1b93ef2dd59b4e4bd687595988f08fd37a10ae264e3344cc32e07d4a9
- MD5 a17ea4805143e2fcd5c324b97e8f3a0f
- SHA1 671c11edb133c5c36adffb4f0a94cc9b3103cbbc
- SHA512 c303288a6d10e5558835b9dc7dd796b37d31b37071649e66c1580de0944753160e9ec9d10bb1c10f41c365f04200bb696f886bc85bf388232d50ae99c4511aa7
- TLSH
  T198E0D8AF45A011704591D4D77A3BE2FF5463DCD7F74854DA346DD630BB072182067B22
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  gitlab-agent/charts/ingress-nginx/tests/admission-webhooks/job-patch/job-createSecret_test.yaml
- Size 2KB
- SHA256 bfd5768537ea051817b4a6e3817145ccaa30bcab54827eb77df868638494a7f2
- MD5 0a208ca25fdb4ab77f357ddfd01e066c
- SHA1 686075300b616cad4d28820f230f4a9fe32aa2be
- SHA512 04e55309769b9c6f8013f3b0fc59aefbf6668fdd6b6d2351478ebcb0a3ea4bd0add1290c5c8cc1fd336be2e049110a9f8cf9a1533f063610b4413850b2c87bf1
- TLSH
  T11051B15AA8B421B4E72580A36EBBF16C5566BDC7E148287971CCD2A03F84A4FC1E37D4
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  gitlab-agent/charts/ingress-nginx/tests/admission-webhooks/job-patch/job-patchWebhook_test.yaml
- Size 2KB
- SHA256 d42beee3e2ea5397b2a1a61af948d25bb86b2094e8048c97832af099c3c5bd76
- MD5 98a5275dab78c7f791df83c7eb20904f
- SHA1 f8d1c27a8f2f4d1343e58a2b51ec69b965d0e288
- SHA512 e9cb7303fe139d7bcc8d58a05afa01039c0decd05cc4d06c6b74f07fa82ca8323266cac69c2837062e7fff9b8f91de70848b22ba15f96b4fdb4fb87dd90770a2
- TLSH
  T19451B09699B415B4E77081925EBBF1AC2126BDC7D24C28B571CCD3703F41A0E81F37A5
- MD5 SHA1 SHA512 TLSH
Score

8^/10

persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
behavioral11 behavioral12
- Target
  gitlab-agent/charts/ingress-nginx/tests/admission-webhooks/job-patch/role_test.yaml
- Size 324B
- SHA256 a0eba9f5b6f96389745e5ebbafd7e7487cf196bcfb614132ca75270d9120b27d
- MD5 140ec657d64168acacc6b2c83dd1e674
- SHA1 ee8e461b741e6a3ef6b95c989c5485f63820ba74
- SHA512 44779b6c87fc7e2d690d8d2b511866bdd17efb6bf19f801b73cbb16b24f301e54fd3460dfded8e4812da44570bef0fb5f0d979d1ecc27aced62e8c3ec1a19e6f
- TLSH
  T1BDE0269F01A412740241C0C76237E2BFE873CCCBF64854AA389DDA30BB027480017B21
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  gitlab-agent/charts/ingress-nginx/tests/admission-webhooks/job-patch/rolebinding_test.yaml
- Size 345B
- SHA256 8a2086eb99487345811fdf436aa3dbe448d838256b548b54d07093578d3947fb
- MD5 3d0ad35e20c2f6933bd95ba5fc930f89
- SHA1 a3689831b18ee4dc4393e2c5308c96f89714b7e0
- SHA512 72c2df7517b122b3aa8e73ee86fd8e31683aed5f23d93506abdf866944aeaf4400da8d19dd29f2aaf1cc8994faa2a721cd1f11cc99653b5cb4af142c5e0bc8ce
- TLSH
  T10AE0D8AF05A01170419180C76637A2AF5463DCDBF74454DA38ADD630BB02258102BB22
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  gitlab-agent/charts/ingress-nginx/tests/admission-webhooks/job-patch/serviceaccount_test.yaml
- Size 1KB
- SHA256 29ca24191d693d2c465d8996f02cd097157ce87c89bfa250e8a30664e822b71f
- MD5 5561dc61df3297bbe5ca7120b1af4870
- SHA1 660e5d34e4c06cbd372218b0865284b7884040c0
- SHA512 de37ac6807ebb560a4d9410144dcb39266c2d27f8cd512d10a7bec7117025acff7150eedf71db7f97f2bfd100f4741333c09cebfed41b2248f10eefced1bd0f5
- TLSH
  T18031F95A8DE022F0C78090A63E73E1AD3616A9CBE24474B932DCF7246F87E495197A15
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  gitlab-agent/charts/ingress-nginx/tests/admission-webhooks/validating-webhook_test.yaml
- Size 1KB
- SHA256 3b3fbca9127243428a6dd77da56c4fb9f3ff65cff0e26c34ac4c580c0a1083d3
- MD5 d0e880698a46e1ec9551c104889f14dd
- SHA1 b7c221b9a9d1339e3a2a904cc7f5a527e0842619
- SHA512 dbc7f0b9e86ebf5d5d804a195e5b65694b9a6e6df2a5e74f3cd9f6cb74d02b26a780e2463f5f86b6f7957f85b4e1c408f7577339815da6c9c4b334a53b800a70
- TLSH
  T133113B0B46B025B64698C3FBA473F07E29BBED83B0495CAD359CD2752F4AB490357B24
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  gitlab-agent/charts/ingress-nginx/tests/controller-configmap-addheaders_test.yaml
- Size 708B
- SHA256 1682efdda4ac22209ab412fd7e463da2e0fa1e3afcf9f82ccc2dedcfa60f1e5f
- MD5 c5df575a447340cf1b9ea0c929320a69
- SHA1 941f5265439d1ec979149dde5d7ea12131ed3d9b
- SHA512 aecaddfb9cbc8d167f23fa70842f2e93c2b0c7529ca9998989757b34d8bda34582a7a52236a48c89099823672f7d6da43e6c69cdcb4097641945f357e1a46cbe
- TLSH
  T115017B0A10B475E286B00AE6F457D93E0921FBC3C240D86A36FD940F1FCA24CE14782D
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  gitlab-agent/charts/ingress-nginx/tests/controller-configmap-proxyheaders_test.yaml
- Size 718B
- SHA256 66a4fb07f46791c0967b067887d755b0ab475a18a191ffa4c3244b651381d378
- MD5 ef3a6dd22de528bba56f5ca4611a7906
- SHA1 c676a7c1fba68f32b2f0ce016df21d954d0572a5
- SHA512 9d27544263f82f87529e8bafaad6e1fcabd3ea475e6dfa24cee1ba4e40cd15982629e735a216a1fc1d2eb677aabdb21ff74b751dbe6e3187d005974b4f9ad7df
- TLSH
  T19101F70555B075A6C2B80A76F467DE7E0811FB8BD201A45F3AED940F1FC924CE143918
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  gitlab-agent/charts/ingress-nginx/tests/controller-configmap_test.yaml
- Size 804B
- SHA256 c5f0dd47d4d9d3ab3c1c3890bff6c0974e3302a2e88f0d784371dfbe7095d5a7
- MD5 54a5d6e093f13d468b1de3642ea3c094
- SHA1 ecfdb586b002e295fb8c387576ec7b3402672d16
- SHA512 c3453bbc9f0557e381ac2465992a61d92af858e6cb522deebda1a09fc1dccf23124cf77e7d3ae9cb58d3ffd175dc0c6087cd8b265dbd7c495ab2ef8a42ac6dea
- TLSH
  T1E701D002B1D02592C36947B9D557E1290470EBDBD78400EF30DDBA052F5D12CA277549
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  gitlab-agent/charts/ingress-nginx/tests/controller-daemonset_test.yaml
- Size 9KB
- SHA256 68e0279960169513b02aa68f261c6288e4aac89ed043dd8e515eb0bec2504992
- MD5 f75716234732625d77e4f08fa758d298
- SHA1 7f1c51c5481f368acf42355e766f923ea348f2d1
- SHA512 b6ed4701d4aaac86d785519145f0809e12d37ffb7d1eb2fd58be88572bb24afcff8ef58db68b82ad348d1f748eece849ab8db52a63dba93bfa3ad1e603361fa0
- SSDEEP 192:Ck9ViMmaYC5YEc5YrKXUcKXkbfo5qAEzA/R0/+0g+gaLcW:J9ViU/R0/+oD
- TLSH
  T1E5126304B7304636E3D9457DAC6BD22D56A2E9D3D18088AE358CFB423FC129DC6E396C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  gitlab-agent/charts/ingress-nginx/tests/controller-deployment_test.yaml
- Size 10KB
- SHA256 5c2bac5ff6a8bd57d9008cac67894c7218f5c402819dbecd5ec29f922cd35ed5
- MD5 ddcac8cc2072a151cd07b69ef260506f
- SHA1 e220377e71c927fb853b3ba2fb5921ebcf5af59a
- SHA512 617ed58654fe00521a0f6e1b561a13e7003ef7e7444eda58d46d7241569327d997e8c29dad94b30a0939c5df5c84cead7ffbc6a3ad2e16422d9d48f21becc5f2
- SSDEEP 192:OL1kH8ezmQQY5YEc5YrKXUcKXNbLJ5qAEzv/a0dR5g+ga6ccT:OmH8eC/a0dRzk
- TLSH
  T105228604E7705674C7A4027E69BBE12A1612EEC7C285D86E34CCE6453FC939CC6E35B8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  gitlab-agent/charts/ingress-nginx/tests/controller-hpa_test.yaml
- Size 824B
- SHA256 98671bd456086ad8ad8845207a09d312ad93bb457c86c429ad2c29c92b2303d5
- MD5 dc309f0b79f10ef27c154586792ac577
- SHA1 8eb1a94000a1ac36817e1f42f6b812161079c896
- SHA512 4776d2af1e2609c72cfa208a9a4cf194d2bfed590862a415979d4e281e6b6c2016e847b702288b0ac58bdc6cf32eca3123c2f207f3875076e6daa02ea286bea2
- TLSH
  T168014509517126718BD981EFFA63E53F4125FD8BD102A87F318CE8397F467946283A35
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32