kubectl[.]zip | Triage™

General

Target
kubectl.zip
Size 14.3MB
Sample261027-hmqrssyy7k
SHA256 544dab0bfa2a2e4ca99800137b87ab582e8767e6712f2faf6e0c513b10d9e873
MD5 84d7a6f075fbcd6c0a68fd6112225653
SHA1 30fea89baad3fa5530c3c10fe3c57dad2bc3373a
SHA512 27d1525b912f7607a826bd160aff57ae27ba725719d1eae079020d2a41f6b2c0561192625918e08dc233af59da24e2c6b2ad7e0fc5183befec30da962a1b4c73
SSDEEP 393216:07N45M0pqkpYaVF8htRb10gTpQ4VlJsBNa/RDTrFEefWEsMUm:oap3XUHDQ4puA5tE3EsM5
TLSH
T17FE6333099A12C5F352FF073A23BF985B1B6754E25C67F862E683B10A99CAC077F1452
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/kubectl.exe

File Explorer

kubectl.zip

.zip 14.3MB
kubectl.exe

.exe 46.5MB

kubectl.zip

SHA256 544dab0bfa2a2e4ca99800137b87ab582e8767e6712f2faf6e0c513b10d9e873
MD5 84d7a6f075fbcd6c0a68fd6112225653
SHA1 30fea89baad3fa5530c3c10fe3c57dad2bc3373a
SHA512 27d1525b912f7607a826bd160aff57ae27ba725719d1eae079020d2a41f6b2c0561192625918e08dc233af59da24e2c6b2ad7e0fc5183befec30da962a1b4c73
SSDEEP 393216:07N45M0pqkpYaVF8htRb10gTpQ4VlJsBNa/RDTrFEefWEsMUm:oap3XUHDQ4puA5tE3EsM5
TLSH
T17FE6333099A12C5F352FF073A23BF985B1B6754E25C67F862E683B10A99CAC077F1452
MD5 SHA1 SHA512 SSDEEP TLSH

kubectl.exe

IMPHASH ff9f3a86709796c17211f9df12aae74d
SHA256 4583757e71d34a658e036285a1310f6e676cccf4d0d27f8b06c184b69f858d44
MD5 324e88e234fc39e73c0053fd816dfff1
SHA1 a41d57b777b3e8c6b03d52880a3cb70e1205c314
SHA512 e2c66ccd643d0e628f84b01009ef50f1798cd512d4d65c6c959f55bd661cb10fa9b547c64e23046f62f4e11d4da0c179f9832516d0a3412879f4bb627cb3ec44
SSDEEP 196608:fccyr4ZuziiuvtWSCXGGrLTZtmX/luTUaugReXj5GqOFVPk6q+0E7CfeiRHL:zyM9vCXGGLTGX9SggReTb6YJ
TLSH
T172B73A83F45540E5C1AEC134CA658652BB313CC95F3023D77F61B6B82ABABD8673A358
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

453184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

21.8MB

Virtual Size

21.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

23.5MB

Virtual Size

23.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

892KB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

337KB

Virtual Size

336KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

4B

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

kubectl.zip

kubectl.exe

kernel32

generic

Sharing

General

Malware Config

Signatures

File Explorer

kubectl.zip

kubectl.exe

kernel32

generic