023884c27593aee37e2e28331158a6a415a0ac2875dd71b2e14881368a527486

Sharing

Copy URL Twitter E-mail

General

Target
kube-bench_0.7.3_linux_amd64.tar.gz
Size 27.1MB
Sample260708-pg7lpagv3l
SHA256 023884c27593aee37e2e28331158a6a415a0ac2875dd71b2e14881368a527486
MD5 983f83873b2b257c2ef1ab2693812873
SHA1 01b056d33c223172719afd00d8481ff8a81e60a2
SHA512 fa482a409d06dc4feef68f348ae9252e69bfaf9d35f69a6160631324d7b3bd61e5b4fbaef6f803b0dc2689b74a296a33f798c85c35a8f50145b47ee8fda9a395
SSDEEP 786432:EhObdRLytpM0A50wfPcyKzeW+FDEHUd35BELa4:CObdRLyfMv50wfPXF75BR4
TLSH
T1FB57336483FA7CD997E383A965EC4B24D086FF645213C4BC61EC15264D3BFF12193A4A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  cfg/ack-1.0/etcd.yaml
- Size 4KB
- SHA256 c299ae9f2b59254b6bc7b30dbef09a5fa0b5517fa59847f604a341ec4f9b4ea4
- MD5 19d14be7dd684989c63a446bfa90821e
- SHA1 4549249021b31d06dd662573bca414a52bbea4f4
- SHA512 dba9ca4a0271e62ca2b75e6a5dea0d93abfe24b2e52ff3e90522b65004a4e14f4087fa1f72b41b47e23c91f95650fb528a8490e45023e7ab0ea3273650f72f1a
- SSDEEP 96:EleP///eILEhYSryhXMOPfF1gvLUhoFrChAjfXkuS7o:gePmIwKdXXgvgyUGXkto
- TLSH
  T1FAA1F153AD47ABF1E86AC2F34BC1E0489339E09FE90BA82474DE62154F41739E1D23E4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  cfg/ack-1.0/master.yaml
- Size 39KB
- SHA256 3aa89d924675120fff0959363c4fcbc4234f4406ce3da1711991eba6b3b16186
- MD5 77d43f9cdf1283a2ccf1183f687e9ac1
- SHA1 5e1a8a3e3326d155e3781b33088f29621c8c5e4b
- SHA512 fd34bceb1c1575662f1f21829513185cbad1eeef07c2e06f83328c1978d2ceb97094afc4012dead7a49a9bc1216a740a625fafcd4da7dd0ef6b14b25b50c0ada
- SSDEEP 768:6K6LECoTmYQ9+rT+cbPT+F0X4TKsU+UP+86BkfRKGswkW4es3aXCaoxix2xjxyxR:/Ix6ra6T+cjT+FLG92AHfFUW81s
- TLSH
  T1A9037303AE5E6BB7D807C1B72A65F08C5331D0DFF816A824768D820A6F42678E2D37D4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  cfg/ack-1.0/node.yaml
- Size 16KB
- SHA256 136511ea5b692771cef585eb1f132b342ed84d8a348632a49aecc78801677dd9
- MD5 1172b2f6a0c3f4273d2298cb92143167
- SHA1 6d6f3a6d0c4d31d1ca84f0f73cea6138566375ae
- SHA512 52372f4d686478ed2b60f5a2b0ee5a87f68f2f6d7c42717f5c5b4207d40b72d4ea293b31d23e42ea4d56306a7908c77c4d3d7d38fbd6977bb2551e90a953c51c
- SSDEEP 384:XYd79P0fQGpjiCjcChpv+1MCBXnmG+9EAsljKQ:XYd79P0fQGpjiCjcChpv+1MEXmG+9EAk
- TLSH
  T13D725342BB573737A08BC4732967D1894330B45FA929B018759FA2187F11B28A1E7FF6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  cfg/aks-1.0/node.yaml
- Size 12KB
- SHA256 c6fd3df406b78c9a06befc6a1798dbd7c899119c6c96b5ea3f308f8645f95652
- MD5 dcc1a1e2b3fc701e0358d7ed277363fd
- SHA1 340c8127605501c39409702dc42e74958d2e1248
- SHA512 9cc8253094ed57c705f4c5765bd1524f7a72a67a26ebf2734df1270fe73a292f322bece19524fd2fc1d71a20d5a924b3070d9135d4a152bc59dc11cefcb8e1b3
- SSDEEP 192:SKf4NyDQJW87ACxMFAPxMqXNMyaQoM/h4MkEJaM8rujlZMJOEeYlaMRvyM6Yte1i:SKwNyDoW8UCXPnwQfA24fh8i
- TLSH
  T1C7420042BF5727B3948A8433286B91854330B55F9928A01975DFF225BF06728A1E7FF3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  cfg/cis-1.20/controlplane.yaml
- Size 1KB
- SHA256 2182e7044fe0c6c24ab96f79fbc606a2c66a00a1bff813a88d2d7729226f080a
- MD5 e615e8730f99afda0f5531d3bca37b0a
- SHA1 4bf902d94d8f9fd99aefdb1d7c01bc36c528916a
- SHA512 c321e5bad51249224dfd9acf584099f2ae6aa12734a8b83663965f2b18880fe6e79c34f6a0672b81583d5e6e498816db930387f3a6428abdedbd31844d77f1bb
- TLSH
  T12A21E60291AB57F1814BE0E7144393488570592FDA728D453D8DD33DEF42A7893D73DA
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  cfg/cis-1.20/etcd.yaml
- Size 4KB
- SHA256 49dbe1a2c6ce01b94b6b4716b968d0590e6d69322ba28d1e44f2cd638e52ab08
- MD5 0bc1f591c675be16fb3047ff24f77714
- SHA1 8c527a15dd6d79eee423f29b8d3c35ca26fc1fc0
- SHA512 0ece68cd9646473cdb362502fa2cc1d92f5fcc3542b71cf0bedeffffa2b678ef504354f9fe46cffdbb940ab8711c17fd9d2b3c2f29978282ecb51003a0e93d04
- SSDEEP 96:EzeP///eILEhYSryhXMOPfF1gvLUhoFrChAjfXkuS7o:wePmIwKdXXgvgyUGXkto
- TLSH
  T167A1F253AD47ABF1E86AC2F34BC1E0489339E09FE90BA82474DE62154F41739E1D23E4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  cfg/cis-1.20/master.yaml
- Size 40KB
- SHA256 c3d5ab1f29f9b2e7579bebdcd01aefb795885fa5a82bd60359d5cbdfed3c53f8
- MD5 d8a1b14e2474a9e1b729fe45eae1edbf
- SHA1 0cfe3d158c9f1aa748b8894682e1f3d8365b5899
- SHA512 c3a84ac724cc730b906951248b87675270609678d81cb794e36affd452225ef5ff0ea489e7e9fae343576d7591eefd63dc4cf46b0c9aff1d05a739cff7aa1c0f
- SSDEEP 768:qK6LECoTmYQ9+vT+vb4T+m0JfVNKPxU+UP+86BkfRKGswJZ4RBs3aXIUpv/xKxNe:PIx6raqT+vsT+mE8zG92AHp2NY2WR1s
- TLSH
  T1031363039D5E6BB7D807C1B76A66F08C5331D0AFF816A824768D821A6F42678F2D37D4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  cfg/cis-1.20/node.yaml
- Size 19KB
- SHA256 e6f9599653cf8066a7f8a299b820be27529cbfba4a6a479626ca113f989143d2
- MD5 00195d40081db34e999bced4d803f8f5
- SHA1 248384715cb6fd8dfb1f4f98044e235e8a46f077
- SHA512 ba1b833d5da9bf933abfd82c47c1566ec4f6bfa91bdebe858ba8479e27d29ff5a0b858c2cf655b655f69ca61cae27ae442df27093c69d0ecb88d9f17b2ce9d54
- SSDEEP 384:nYd79PIfQGDOiCjcChpv+1MCBXnmG+OE58z/qljKQ:nYd79PIfQGDOiCjcChpv+1MEXmG+OE5v
- TLSH
  T153924042BB573377A08BC473296791894330B45F9925B018759FA219BF11B38A1EBBE2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  cfg/cis-1.23/controlplane.yaml
- Size 1KB
- SHA256 63b6b7128c6f0729016dcc8ecffb13d6d2630fdccb058295b87d7167a144f7e0
- MD5 d0df9a495fc68e6ec564f58af3a6a673
- SHA1 62151d58d2642c8f020f557229aebfc88b8df805
- SHA512 e66496b4f82ea385379f20a0e6ba0da88ac525a481b097ad48ceb12bb50c91bb482074916ed7818a948f972d1681730a35e56802af506d2680dc372372c8a056
- TLSH
  T19F313503A28B67F6C687E0A7188363C88575782FDA2259153DCDE73C5F0266893D73C6
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  cfg/cis-1.23/etcd.yaml
- Size 4KB
- SHA256 c2bbd2b52af26f3d119ae9d5ea87c74b373a712bc64c574819f28c4e2e8f5c9b
- MD5 88741a0f306dfa9175a61a75d7edf305
- SHA1 2059e805a480dd71d19a1d973e117c6639cc97d9
- SHA512 1f8368064193248d94d2162bac87a1e26315e9de0c929e2387e131b1665cc3fc3b295f9aebfbe2a203b150e83e2282e3b57b505516410f926b790c940cc12854
- SSDEEP 96:E8eK///eILEhYSryhXMOPfF1gvLUhoFrChAjfXkuS7o:XeKmIwKdXXgvgyUGXkto
- TLSH
  T135A1E153AD47ABF1E96AC2F347C1E0488339E09FE90BA82474DE62154F41739E1D23E4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  cfg/cis-1.23/master.yaml
- Size 40KB
- SHA256 736ba72f8e369823fc5308d680eeacf7158eef7dd0c3c1d6c3a603bf50765c3c
- MD5 65b090acd51cbd76e2768e9563466553
- SHA1 b1c7a96e5ddd1d06009e204a74ebebf4efc3fc32
- SHA512 6f7d5b6431dc9618f554cc6fa44c32c88f840402b6e2519c8c8b8db70b9a93ea58ce0103d19686fb524bccfa233f4f9d8a98c1e8e2f25b9a7fd72740c99e564d
- SSDEEP 768:ZKhL/C5TJYR9tvT+Kb4T+F06UVqKPmUmjPn8/B3fRfGLnaU4RmhdN/2n7vHMxRxe:kBqVyrpT+KsT+FS5eT85ZOR2OWRWjK7
- TLSH
  T13D139503AE6E6BB7E406C0BB2B66E08C1331D09FF816B925755D921A5F81678E2D37C4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  cfg/cis-1.23/node.yaml
- Size 19KB
- SHA256 4c164b99fc733470cde98b6b0449ef65d38364e2d31306278f5a38cb1615a406
- MD5 6234e6c1f89bab824c2cbb7533694101
- SHA1 e302fbee3214f6b1326baf593a9b991d05e84131
- SHA512 d1b335a864f42fd70eac7bb8c0810c5b11dfb3fbca029b41e1d04db349cf4fc77d13657b2fab780d0265db1ac806c13afa1f348f1e5fd4e546ab46fe93753018
- SSDEEP 384:EYv79PIfQGDOiCjcChpv+1u8LNtKS6RNjAJmqlDKQ:EYv79PIfQGDOiCjcChpv+1uUPKS6RNj4
- TLSH
  T1FC925442BB573777A48BC473296791894330B05F9925B00875DFA229BF01B3861EBBF6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  cfg/cis-1.24-microk8s/controlplane.yaml
- Size 1KB
- SHA256 09dcf359edae55b6cdbd9b56c41ce77c8c10ae7c756998e6c4f7e287da4c8278
- MD5 d1a3e34d0e88bc8e4b723ee4f820239f
- SHA1 07764d447c206aac62b7ac8e95f3c9d101156413
- SHA512 526cd3def1942ee6b1588aad2439a69b1274f0a900872ec14aa5b5d7653c6d64dc9d6da10ea82c60b28936736e8b0390413267c46751fa489a82480c927beb62
- TLSH
  T1C7313503A28B27F6C687A09718C363C88575682FD72119193DCDE77C5F0266893D73C6
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  cfg/cis-1.24-microk8s/etcd.yaml
- Size 4KB
- SHA256 7a870545dba3547925b5e58dd40f49a2a0af6ddaafcf8b09d04b2aacb39cc1b0
- MD5 698ffe02059aec3021ddd11acc13e82b
- SHA1 56cdb986a4cf5e5ca6990867e6ca11cc0aa51ccb
- SHA512 467f93aee8e902fdabd6a7504933b38de38aee46cb53c31e3f79172850d47b588031dd59797915ad6d5ed3d4e8da282c547ee2901710d62575f3491dfcbfbbab
- SSDEEP 96:Em6eK/444cIL144jSrP44u0CPA7iRvLjxsjIFrrPSXkCPr:ceKQ2IhN8E0QvvEIEXk8
- TLSH
  T10DA14342D65BEAF2D9EBE0B71AF1E448A738914FDA16682C755CA2290F4033CD2D23D0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  cfg/cis-1.24-microk8s/master.yaml
- Size 39KB
- SHA256 caa6b2b1b3541f8312acfcbe2581c150d9b85c4d2515e5c35cb5686281eedc45
- MD5 3b9791f3f9c81556b396c1004ce6d12d
- SHA1 6a768e696f30de3cbab8ef44096a1cd363e47f93
- SHA512 e48e3b26d22df0b1ca205086c6c544340754e29fe99f24872b4bcf24a18a5433b85e236fd4c30a7ff98e2f05b1a0288ac169f09f7486683f20f928c7fc7bb1ec
- SSDEEP 768:IKhL/a5TJIR9tHT2Ob4Td80EGuj8MmePIMnB3f5HGLrQ24C6P6koXcUdhTxDx5xG:VBCVKrRT2OsTd8WwLBBmB/6aMmWpKu
- TLSH
  T1A5036303AE6E27B7E40680BB6B66E08D1331D0DFF912B929728D921E5F41578E2C37D4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  cfg/cis-1.24-microk8s/node.yaml
- Size 19KB
- SHA256 38ecba9a2faf0c88d9e78ea0b3b1e26ceaaf81c04bea1ce340fcfbbcf0773b7a
- MD5 6e460e62ceccedb974f00263ecc7ed11
- SHA1 43be0e28d2771110a23caf8ea6126af932facbad
- SHA512 30f29266c859e13db07ca376e729f3eb63375fa3334595e2b827f2a9cc0886a50074060bacf409aad98ad7ddc4471c10832719f005ed71cfa66134c9add85470
- SSDEEP 384:Dq3j3yxSW78JCXTzCoKebcLAts3G4GkCEqADKQ:Dq3j3yxSW78JCDzCoKeb0es3G4GkCEqq
- TLSH
  T161924302BB573777908B8473696B91894330B14F5925B00875CFE229BF11B39A1FBBE6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32