312d02689779a9a35f62fd7899a082cdd5267d8e6272ae9a454d4edee4f7bb34

Sharing

Copy URL Twitter E-mail

General

Target
DataDog-datadog-operator-9c71245c6822_GH0.tar.gz
Size 37.3MB
Sample261002-g267naaf76
SHA256 312d02689779a9a35f62fd7899a082cdd5267d8e6272ae9a454d4edee4f7bb34
MD5 117b2634645c4947c7466e752ea606fc
SHA1 24e8decc68eb44afd68b6966fe9e6df44000eed4
SHA512 1c1caa55c1c3834b44a683bb96b540458fbc356d65312091881054ca209c86fcad5fbb7c635fc585b2afeb5d75fb84fb53724c0e1d297fc909685c8ed10ccb36
SSDEEP 98304:T3KTQ3KTq69h8eflcqY/QWnZWo6ld5cPyCs1WFfN:tVhs1Wv
TLSH
T1AD874C82B78D4273C9432074AE4470C5F3AEF43398F141A9F8DC56E5B34946EC6B97AA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  datadog-operator-9c71245c6822/build/bin/entrypoint
- Size 381B
- SHA256 e019bf8327e0f049033606f0ff2c6e3c98b482cff979039943f8fd28969992b8
- MD5 590543f89017e56d88c86956a6f5ec4b
- SHA1 233ad2194a54f140cfb8d1b6c4f32d26f1321c8c
- SHA512 ad4c081ec0db079ef1077a867404203017a6837556496ad9120d4d50d436e1acab8cf3823521caf0fe66705dfe94f53a8671127d05f49a6ea78f9884e1438383
- TLSH
  T17DE0F106DF440970E633D198C14C3A403252B89D8725FB982236DA80B85F1138359471
- MD5 SHA1 SHA512 TLSH
Score

8^/10

credential_access defense_evasion discovery persistence
- Modifies password files for system users/ groups
  Modifies files storing password hashes of existing users/ groups, likely to grant additional privileges.
  persistence credential_access defense_evasion
behavioral1 behavioral2 behavioral3 behavioral4
- Target
  datadog-operator-9c71245c6822/build/bin/user_setup
- Size 340B
- SHA256 fd8f3b700f90e03288f4dd489400845f8c1ad2412e98c8f9798ce42a50467dac
- MD5 11969e107d63dc64398681a4c1aeadbc
- SHA1 1a460f9e31209a75c9fb8b6c224b86ab101e20dc
- SHA512 d17e67e4efd706167a3851b562c94bfe91225ed3c2e0cbc7c58e5ff5dc95df162d644832586ebe36e238d5ff8717ad15f6e2c1fea42d92e2257d829844678e54
- TLSH
  T1D0E026949B88B5F38F14AAE16A9C63E1D748F278AB600374117E4C345204ADF2723BD8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral5 behavioral6 behavioral7 behavioral8
- Target
  datadog-operator-9c71245c6822/chart/datadog-agent-with-operator/templates/_helpers.tpl
- Size 1KB
- SHA256 e1b4cecc7574c14036479ddd9049976fd039302e436538c2c029c6a3fe12bb1c
- MD5 d3c64edcf3cc14373576d0b3ad8dbcb2
- SHA1 e48e466e43a9a5f39d7af65af00c0c608d647ea7
- SHA512 bf069960902407ac0370a157076e5644e8b096a2371c3b0dcacf67ca237a6b7c9b0a5600bb10b690fc03f6260819282ee108055c8d4b352242fc9e4a74cae672
- TLSH
  T10141EF9CD28505E5C3921383680BE4017F86D604A3AFAEE565A6B99DF0C05AF79C77F0
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral10 behavioral9
- Target
  datadog-operator-9c71245c6822/chart/datadog-operator/templates/_helpers.tpl
- Size 1KB
- SHA256 c7b1529158f8d478814c6664640d506e193cc07021c11935d1501b591b67a1ca
- MD5 f44167c5bbc45a4bcee9dc9b57533bcc
- SHA1 d7ec6883039edbf13a4f2da8bee115e1ea3fc245
- SHA512 cb7753a0f9a938f5f8da863db3691d2a1d5f9dcdc3b07fb9171127b7f4879efc1c764644cb828105591f0d809011f2c21f9403a1c0a0d25c8f5e1f1c213735a0
- TLSH
  T1A9310F5CD285016AC3B146834407E4423F8AD604A3AF2FF661F5FA6DF08009F70D37A0
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral11 behavioral12
- Target
  datadog-operator-9c71245c6822/deploy/crds/datadoghq.com_datadogagents_crd.yaml
- Size 461KB
- SHA256 798d2b454e512a96aa65f9302b8978328c1a7fd090e33737a10e24dedffd4478
- MD5 f83165b3d3692791cff6d63b42e591ac
- SHA1 cb1e6f1f3940dc88af84722c4669335207136ef4
- SHA512 8a8a5449d03a1e2183fd9684bedd02e02714459d516ab1bad17833355c14098e98962430d932532cad8591e54dd7aec4fdc35b1e72333ca610fcbf0ca3799f4f
- SSDEEP 1536:eU1a80ZKQbY88uY+JuH8q/VqCm9p5oGPM6c8uY+JuHRLs9p5oGPMB68uY+JuHCb1:2ZKUshH8qNqOf6cshHJfB6shHNhJ4
- TLSH
  T187A485032F48B234D88B85855CE9E2466330E61FA671A474FACE43B82F456F1D5F26F9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral13 behavioral14
- Target
  datadog-operator-9c71245c6822/go.test.sh
- Size 1KB
- SHA256 b35a5c9fcb19a6b6ce88b3a6c0ad60b94474fd488c2c8d083aa2d7e0e28c8ae5
- MD5 50bd5be5938bb3aa739124b9868e314b
- SHA1 f42351b754b2b342b283fc55227fc265e2e9b81b
- SHA512 63e7b57ebdac859cdd1e2d7320e68f592511e08118f15ae27c82268917216d4461fd513c804a9622afc2ba58fa2c365d3db65dcd14d6bc791163a5e97b6217a1
- TLSH
  T1F921F028F4BB8C78580529172CD9E809339C974FD23252353B1CB7587776273A8E959D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral15 behavioral16 behavioral17 behavioral18
- Target
  datadog-operator-9c71245c6822/hack/generate-groups.sh
- Size 4KB
- SHA256 11fe4b584b151fa68b474e6f1552ad2405394042da7a845adb200a9b4a2ea3c5
- MD5 ad1705d0a0b9d919cd981077a1b54152
- SHA1 cf6001d404663ea4ccaa34b1a3c357a34df179e1
- SHA512 3c6d2be36a85ef7bfab5c1e12e8de676a7b24c88ee2bc79dafc19af472d663d67eda8936e192488c4ab115c55096d73579e09daf329633ecfae3116341ebeb8b
- SSDEEP 96:KEM407HFh0BkEBA36i6bb6bQXqhOwTK7cjgbliJYLM4Tynx1BlJlOQ/lC0J:KZP7HUGmbGbQaMBgEbliJY4Pnx3lJlOg
- TLSH
  T1EA81A7203484CE7D97D17FA26D8E8699B6BD9184CD4BFCDA302D43085B31A3A53BE518
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral19 behavioral20 behavioral21 behavioral22
- Target
  datadog-operator-9c71245c6822/hack/generate-olm-bundle.sh
- Size 1KB
- SHA256 3303612a1e550bcac958a0fce1799971fd0d009de68575d5532c4689fe49625a
- MD5 b3be0af73438a910c4b1a0f3d14104d6
- SHA1 fe3e38ca15ea961a3c42ac04bd28bc9db34f452a
- SHA512 0e6c5dc701c38d2b094a6122f20dbf0953a913b58aea99db2fdd55b5f207869a8391f9464b57b9b33bd0f5f76017305d7a2fa34fdf5b8066221f50bf66112b80
- TLSH
  T19821EE5A638030340317A3E4E0CED1198868214AAD0E98B7712DC190AA3E3E47BFE6B6
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral23 behavioral24 behavioral25 behavioral26
- Target
  datadog-operator-9c71245c6822/hack/golangci-lint.sh
- Size 9KB
- SHA256 01c41669b1279ecb22bdceda2fffaad213aaa304ffecf731a8af8e66bc1e3d5b
- MD5 9ad916d6de024a01b17f45c433daa60b
- SHA1 f580861b8914649ccafba05b1f02310955c49182
- SHA512 9bf208950eb900a61854dfa16f9eb34299b29d9f5abc84241e7e788b6ad0141579e3501af578a32095af70d8165292c136d804dbbbef88f960393b21c2d38c0f
- SSDEEP 192:AbcCLZ9nRb3hVjXPRtw7yWTLrY38u4stOx0V6587YHTKzn+6RczlWb01mbdMpdTp:WcCLZ9HFP6oOx0V6587YHTKD+6RczlWw
- TLSH
  T1FF1261837CEBA9320708D2765B56301BF32A680B553ECD7AF29562887F72634E17F191
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28 behavioral29 behavioral30
- Target
  datadog-operator-9c71245c6822/hack/install-operator-sdk.sh
- Size 1KB
- SHA256 ff1a31d5fa0327d03522ffe5476df827973c58c11ea31c94fd726bb1a5a00647
- MD5 42b8287df22bd970ef4cf90832e82e9a
- SHA1 82ade913d3dddc8f225aed864266684c70677e2a
- SHA512 314b203938db50404ab73983cef65ed578d2f116d7c31b074e0fb5262de893305fb51fd30e026c4c1ded802ebf6c18c800314ac89e672dbd805c3775102b1184
- TLSH
  T12D11BB477B8419220E1477CAC0EB6054EB30011AEE1998ACF50D725DD62A7E0236BAA5
- MD5 SHA1 SHA512 TLSH
Score

7^/10

defense_evasion discovery antivm
- File and Directory Permissions Modification
  Adversaries may modify file or directory permissions to evade defenses.
  defense_evasion
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Modify Authentication Process

T1556

Pluggable Authentication Modules

T1556.003

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Modify Authentication Process

T1556

Pluggable Authentication Modules

T1556.003

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Modify Authentication Process

T1556

Pluggable Authentication Modules

T1556.003

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Modifies password files for system users/ groups

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

File and Directory Permissions Modification

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32