Aug 30 08:26:48 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: Thor Version: 10.7.9 SCANID: S-dM24AZNR1hE
Aug 30 08:26:48 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: Thor Build: 9f8d57034f22 (2023-07-28 03:45:54) SCANID: S-dM24AZNR1hE
Aug 30 08:26:48 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: Run on system: WIN-LRTT94FA08M SCANID: S-dM24AZNR1hE
Aug 30 08:26:48 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: Running as user: WIN-LRTT94FA08M\Administrator SCANID: S-dM24AZNR1hE
Aug 30 08:26:48 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: Netbios Domain: WIN-LRTT94FA08M SCANID: S-dM24AZNR1hE
Aug 30 08:26:48 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: User has admin rights: yes SCANID: S-dM24AZNR1hE
Aug 30 08:26:48 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: Working Directory: C:\Users\Administrator\Downloads\test\Nextron_Thor_10.7.9.0_Windows_Cracked SCANID: S-dM24AZNR1hE
Aug 30 08:26:48 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: Thor Scan started SCANID: S-dM24AZNR1hE START_TIME: Fri Aug 30 08:26:48 2024 HOSTNAME: WIN-LRTT94FA08M
Aug 30 08:26:48 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: Effective argument list: [--path D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image --module Filescan] SCANID: S-dM24AZNR1hE
Aug 30 08:26:48 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: Platform: Windows Server 2019 Standard SCANID: S-dM24AZNR1hE
Aug 30 08:26:48 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: Platform DeepEval SCANID: S-dM24AZNR1hE NAME: Windows Server 2019 Standard TYPE: Multiprocessor Free VERSION: 6.3 PROC: Intel64 Family 6 Model 151 Stepping 2 ARCH: AMD64 INSTALLED_ON: Sun Jan 22 01:56:36 2023 BUILD_NUMBER: 17763
Aug 30 08:26:48 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: Language: en-US, Zone: UTC SCANID: S-dM24AZNR1hE
Aug 30 08:26:48 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: System Uptime: 17.87 days SCANID: S-dM24AZNR1hE
Aug 30 08:26:48 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: CPU Count: 24 SCANID: S-dM24AZNR1hE
Aug 30 08:26:48 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: Memory in Megabyte: 65277 SCANID: S-dM24AZNR1hE
Aug 30 08:26:48 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: Startup MESSAGE: Signature file is older than 60 days. Run 'thor-util upgrade' to get new signatures. SCANID: S-dM24AZNR1hE
Aug 30 08:26:48 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: Signature Database: 2023/09/24-052825 SCANID: S-dM24AZNR1hE
Aug 30 08:26:48 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: Sigma Database: 0.22-3134-geb2f82cbc SCANID: S-dM24AZNR1hE
Aug 30 08:26:48 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: Successfully compiled 0 false positive filters SCANID: S-dM24AZNR1hE TYPE: log filter
Aug 30 08:26:48 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: Writing report file to: WIN-LRTT94FA08M_thor_2024-08-30_0826.txt SCANID: S-dM24AZNR1hE
Aug 30 08:26:48 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: Writing csv report file to: WIN-LRTT94FA08M_files_md5s.csv SCANID: S-dM24AZNR1hE
Aug 30 08:26:48 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: No json report file will be written SCANID: S-dM24AZNR1hE
Aug 30 08:26:48 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: Writing html report file to: WIN-LRTT94FA08M_thor_2024-08-30_0826.html SCANID: S-dM24AZNR1hE
Aug 30 08:26:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: Syslog Export: off SCANID: S-dM24AZNR1hE
Aug 30 08:26:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: IP Address 1: 10.100.5.12 SCANID: S-dM24AZNR1hE
Aug 30 08:26:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: IP Address 2: 192.168.74.1 SCANID: S-dM24AZNR1hE
Aug 30 08:26:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: IP Address 3: 192.168.119.1 SCANID: S-dM24AZNR1hE
Aug 30 08:26:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: ScanID: S-dM24AZNR1hE SCANID: S-dM24AZNR1hE
Aug 30 08:26:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Startup MESSAGE: System is not a domain controller SCANID: S-dM24AZNR1hE
Aug 30 08:26:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Max. file size to be scanned is 31.5 MB, use --max_file_size to increase the limit SCANID: S-dM24AZNR1hE
Aug 30 08:26:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Selected modules: Filescan SCANID: S-dM24AZNR1hE
Aug 30 08:26:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Deselected modules: Artifact-Collector, AtJobs, Autoruns, DNSCache, DeepDive, Dropzone, EnvCheck, EtwWatcher, Eventlog, Events, Firewall, Hosts, HotfixCheck, LSASessions, LoggedIn, MFT, Mutex, NetworkSessions, NetworkShares, Pipes, ProcessCheck, RegistryChecks, Rootkit, SHIMCache, ScheduledTasks, ServiceCheck, Thunderstorm, Timestomp, UserDir, Users, WMIStartup SCANID: S-dM24AZNR1hE
Aug 30 08:26:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Selected features: Amcache, Archive, ArchiveScan, AtJobs, Auditlog, AuthorizedKeys, Bifrost2, BulkScan, C2, CPULimit, CheckString, CronParser, DoublePulsar, ETL, EVTX, Eml, EnrichFileInfo, ExeDecompress, FilenameIOCs, Filescan, GroupsXML, KeywordIOCs, Lnk, LogScan, Logger, MagicHeader, OLE, ParseCobaltStrike, Prefetch, ProcessConnections, ProcessHandles, ProgressTracker, RecycleBin, RegistryHive, Rescontrol, SHIMCache, Sigma, SignalHandler, Stix, TeamViewer, ThorDB, VirusTotal, VulnerabilityCheck, WER, WMIPersistence, WebdirScan, WorkerProgressTracker, Yara SCANID: S-dM24AZNR1hE
Aug 30 08:26:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Deselected features: Action, AuditTrail, AuditTrailWriter, Bifrost, DumpScan, ProcessIntegrity SCANID: S-dM24AZNR1hE
Aug 30 08:26:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: System Type: Server SCANID: S-dM24AZNR1hE
Aug 30 08:26:49 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-all.yas as 'default' type SCANID: S-dM24AZNR1hE
Aug 30 08:26:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-deepscan-selectors.yasx as 'meta' type SCANID: S-dM24AZNR1hE
Aug 30 08:26:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-keywords.yas as 'keyword' type SCANID: S-dM24AZNR1hE
Aug 30 08:26:56 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-log-sigs.yas as 'log' type SCANID: S-dM24AZNR1hE
Aug 30 08:26:57 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-meta.yas as 'meta' type SCANID: S-dM24AZNR1hE
Aug 30 08:26:57 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-peids.yas as 'default' type SCANID: S-dM24AZNR1hE
Aug 30 08:26:57 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-process-memory-sigs.yas as 'process' type SCANID: S-dM24AZNR1hE
Aug 30 08:26:59 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-registry.yas as 'registry' type SCANID: S-dM24AZNR1hE
Aug 30 08:26:59 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma logsources from signatures\sigma\thor.yms SCANID: S-dM24AZNR1hE
Aug 30 08:26:59 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 7 files in C:\Users\Administrator\Downloads\test\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\category\antivirus SCANID: S-dM24AZNR1hE
Aug 30 08:26:59 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 1 files in C:\Users\Administrator\Downloads\test\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\emerging-threats\2010 SCANID: S-dM24AZNR1hE
Aug 30 08:26:59 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 4 files in C:\Users\Administrator\Downloads\test\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\emerging-threats\2014 SCANID: S-dM24AZNR1hE
Aug 30 08:26:59 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 1 files in C:\Users\Administrator\Downloads\test\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\emerging-threats\2015 SCANID: S-dM24AZNR1hE
Aug 30 08:26:59 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 12 files in C:\Users\Administrator\Downloads\test\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\emerging-threats\2017 SCANID: S-dM24AZNR1hE
Aug 30 08:26:59 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 14 files in C:\Users\Administrator\Downloads\test\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\emerging-threats\2018 SCANID: S-dM24AZNR1hE
Aug 30 08:26:59 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 23 files in C:\Users\Administrator\Downloads\test\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\emerging-threats\2019 SCANID: S-dM24AZNR1hE
Aug 30 08:26:59 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 27 files in C:\Users\Administrator\Downloads\test\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\emerging-threats\2020 SCANID: S-dM24AZNR1hE
Aug 30 08:26:59 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 67 files in C:\Users\Administrator\Downloads\test\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\emerging-threats\2021 SCANID: S-dM24AZNR1hE
Aug 30 08:26:59 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 19 files in C:\Users\Administrator\Downloads\test\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\emerging-threats\2022 SCANID: S-dM24AZNR1hE
Aug 30 08:27:00 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 76 files in C:\Users\Administrator\Downloads\test\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\emerging-threats\2023 SCANID: S-dM24AZNR1hE
Aug 30 08:27:00 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 49 files in C:\Users\Administrator\Downloads\test\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\linux\auditd SCANID: S-dM24AZNR1hE
Aug 30 08:27:00 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 27 files in C:\Users\Administrator\Downloads\test\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\linux\builtin SCANID: S-dM24AZNR1hE
Aug 30 08:27:00 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 7 files in C:\Users\Administrator\Downloads\test\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\linux\file_event SCANID: S-dM24AZNR1hE
Aug 30 08:27:00 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 3 files in C:\Users\Administrator\Downloads\test\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\linux\network_connection SCANID: S-dM24AZNR1hE
Aug 30 08:27:00 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 103 files in C:\Users\Administrator\Downloads\test\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\linux\process_creation SCANID: S-dM24AZNR1hE
Aug 30 08:27:00 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 1 files in C:\Users\Administrator\Downloads\test\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\macos\process_creation SCANID: S-dM24AZNR1hE
Aug 30 08:27:00 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 11 files in C:\Users\Administrator\Downloads\test\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\proxy SCANID: S-dM24AZNR1hE
Aug 30 08:27:00 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 3 files in C:\Users\Administrator\Downloads\test\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\web\product SCANID: S-dM24AZNR1hE
Aug 30 08:27:00 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 39 files in C:\Users\Administrator\Downloads\test\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\web\proxy_generic SCANID: S-dM24AZNR1hE
Aug 30 08:27:00 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 3 files in C:\Users\Administrator\Downloads\test\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\web SCANID: S-dM24AZNR1hE
Aug 30 08:27:00 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 12 files in C:\Users\Administrator\Downloads\test\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\web\webserver_generic SCANID: S-dM24AZNR1hE
Aug 30 08:27:01 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 359 files in C:\Users\Administrator\Downloads\test\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\windows\builtin SCANID: S-dM24AZNR1hE
Aug 30 08:27:01 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 16 files in C:\Users\Administrator\Downloads\test\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\windows\create_remote_thread SCANID: S-dM24AZNR1hE
Aug 30 08:27:01 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 9 files in C:\Users\Administrator\Downloads\test\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\windows\create_stream_hash SCANID: S-dM24AZNR1hE
Aug 30 08:27:01 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 14 files in C:\Users\Administrator\Downloads\test\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\windows\dns_query SCANID: S-dM24AZNR1hE
Aug 30 08:27:02 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 18 files in C:\Users\Administrator\Downloads\test\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\windows\driver_load SCANID: S-dM24AZNR1hE
Aug 30 08:27:02 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 183 files in C:\Users\Administrator\Downloads\test\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\windows\file SCANID: S-dM24AZNR1hE
Aug 30 08:27:03 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 94 files in C:\Users\Administrator\Downloads\test\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\windows\image_load SCANID: S-dM24AZNR1hE
Aug 30 08:27:03 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 46 files in C:\Users\Administrator\Downloads\test\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\windows\network_connection SCANID: S-dM24AZNR1hE
Aug 30 08:27:03 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 20 files in C:\Users\Administrator\Downloads\test\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\windows\pipe_created SCANID: S-dM24AZNR1hE
Aug 30 08:27:04 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 258 files in C:\Users\Administrator\Downloads\test\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\windows\powershell SCANID: S-dM24AZNR1hE
Aug 30 08:27:05 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 27 files in C:\Users\Administrator\Downloads\test\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\windows\process_access SCANID: S-dM24AZNR1hE
Aug 30 08:27:10 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 1164 files in C:\Users\Administrator\Downloads\test\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\windows\process_creation SCANID: S-dM24AZNR1hE
Aug 30 08:27:10 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 1 files in C:\Users\Administrator\Downloads\test\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\windows\raw_access_thread SCANID: S-dM24AZNR1hE
Aug 30 08:27:11 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 246 files in C:\Users\Administrator\Downloads\test\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\windows\registry SCANID: S-dM24AZNR1hE
Aug 30 08:27:11 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 1 files in C:\Users\Administrator\Downloads\test\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\windows\registry_setinfo SCANID: S-dM24AZNR1hE
Aug 30 08:27:11 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 7 files in C:\Users\Administrator\Downloads\test\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\windows\sysmon SCANID: S-dM24AZNR1hE
Aug 30 08:27:11 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Adding sigma rules from 3 files in C:\Users\Administrator\Downloads\test\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\sigma\windows\wmi_event SCANID: S-dM24AZNR1hE
Aug 30 08:27:11 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Successfully compiled 1748 sigma rules SCANID: S-dM24AZNR1hE TYPE: SIGMA
Aug 30 08:27:12 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Successfully compiled 0 STIXv2 indicators (skipped 0 indicators) SCANID: S-dM24AZNR1hE TYPE: STIX
Aug 30 08:27:12 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Reading iocs from C:\Users\Administrator\Downloads\test\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\iocs\custom-evil-hashes.dat as 'hash' type SCANID: S-dM24AZNR1hE
Aug 30 08:27:12 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Reading iocs from C:\Users\Administrator\Downloads\test\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\iocs\filename-characteristics.dat as 'filename' type SCANID: S-dM24AZNR1hE
Aug 30 08:27:12 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Reading iocs from C:\Users\Administrator\Downloads\test\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\iocs\keywords.dat as 'keyword' type SCANID: S-dM24AZNR1hE
Aug 30 08:27:12 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Reading iocs from C:\Users\Administrator\Downloads\test\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\iocs\malicious-events.dat as 'handles' type SCANID: S-dM24AZNR1hE
Aug 30 08:27:12 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Reading iocs from C:\Users\Administrator\Downloads\test\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\iocs\malicious-mutexes.dat as 'handles' type SCANID: S-dM24AZNR1hE
Aug 30 08:27:12 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Reading iocs from C:\Users\Administrator\Downloads\test\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\iocs\malicious-namedpipes.dat as 'pipes' type SCANID: S-dM24AZNR1hE
Aug 30 08:27:12 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Reading iocs from C:\Users\Administrator\Downloads\test\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\iocs\malware-domains.dat as 'domains' type SCANID: S-dM24AZNR1hE
Aug 30 08:27:13 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Reading iocs from C:\Users\Administrator\Downloads\test\Nextron_Thor_10.7.9.0_Windows_Cracked\signatures\misc\file-type-signatures.cfg as 'file-type-signatures' type SCANID: S-dM24AZNR1hE
Aug 30 08:27:13 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Successfully compiled 63 keyword ioc strings SCANID: S-dM24AZNR1hE TYPE: IOC
Aug 30 08:27:13 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Successfully compiled 7642 filename ioc strings and 1219 filename ioc regexs SCANID: S-dM24AZNR1hE TYPE: IOC
Aug 30 08:27:13 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Successfully compiled 9858 malware and 0 false positive hashes SCANID: S-dM24AZNR1hE TYPE: IOC
Aug 30 08:27:13 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Successfully compiled 177 file type signatures SCANID: S-dM24AZNR1hE TYPE: IOC
Aug 30 08:27:13 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Successfully compiled 5346 malware domains SCANID: S-dM24AZNR1hE TYPE: IOC
Aug 30 08:27:13 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Successfully compiled 73 named pipe ioc strings and 65 named pipe ioc regexs SCANID: S-dM24AZNR1hE TYPE: IOC
Aug 30 08:27:13 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Successfully compiled 516 malicious handles and 229 regex malicious handles SCANID: S-dM24AZNR1hE TYPE: IOC
Aug 30 08:27:13 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: No custom registry excludes defined SCANID: S-dM24AZNR1hE
Aug 30 08:27:13 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: No custom eventlog excludes defined SCANID: S-dM24AZNR1hE
Aug 30 08:27:13 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: No custom process excludes defined SCANID: S-dM24AZNR1hE
Aug 30 08:27:17 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Yara MESSAGE: Successfully compiled 23008 default YARA rules SCANID: S-dM24AZNR1hE TYPE: YARA
Aug 30 08:27:17 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Yara MESSAGE: Successfully compiled 0 custom default YARA rules SCANID: S-dM24AZNR1hE TYPE: YARA
Aug 30 08:27:17 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Yara MESSAGE: Successfully compiled 134 meta YARA rules SCANID: S-dM24AZNR1hE TYPE: YARA
Aug 30 08:27:18 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Yara MESSAGE: Successfully compiled 9961 process YARA rules SCANID: S-dM24AZNR1hE TYPE: YARA
Aug 30 08:27:19 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Yara MESSAGE: Successfully compiled 3268 log YARA rules SCANID: S-dM24AZNR1hE TYPE: YARA
Aug 30 08:27:19 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Yara MESSAGE: Successfully compiled 544 registry YARA rules SCANID: S-dM24AZNR1hE TYPE: YARA
Aug 30 08:27:19 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Yara MESSAGE: Successfully compiled 270 keyword YARA rules SCANID: S-dM24AZNR1hE TYPE: YARA
Aug 30 08:27:20 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Init MESSAGE: Successfully created ThorDB SCANID: S-dM24AZNR1hE PATH: C:\ProgramData\thor\thor10.db
Aug 30 08:27:20 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Filescan MESSAGE: Starting module SCANID: S-dM24AZNR1hE
Aug 30 08:27:20 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Filescan MESSAGE: The following paths will be scanned: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image SCANID: S-dM24AZNR1hE
Aug 30 08:27:20 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Filescan MESSAGE: Scanning D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image RECURSIVE SCANID: S-dM24AZNR1hE
Aug 30 08:27:20 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: AuthorizedKeys MESSAGE: Found public key that has SSH access SCANID: S-dM24AZNR1hE PATH: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\administrator\.ssh\authorized_keys TYPE: ssh-rsa KEY: AAAAB3NzaC[...]x4Kz4e4Rc= COMMENT: administrator@msk-scriptserv-2
Aug 30 08:27:26 WIN-LRTT94FA08M/10.100.5.12 THOR: Alert: MODULE: LogScan MESSAGE: Malicious Log Entry found SCANID: S-dM24AZNR1hE ENTRY: 192.241.193.117 - - [05/May/2024:05:06:30 +0300] "GET /autodiscover/autodiscover.json?@zdi/Powershell HTTP/1.1" 403 199 "-" "Mozilla/5.0 zgrab/0.x" SCORE: 90 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\it_sec\httpd\access_log LOG_MODIFIED: Tue May  7 07:55:38 2024 LOG_ACCESSED: Tue May 14 16:22:15 2024 LOG_CREATED: Thu Aug 29 15:34:29 2024 REASON_1: YARA rule EXPL_Exchange_ProxyShell_Successful_Aug21_1 / Detects successful ProxyShell exploitation attempts in log files SUBSCORE_1: 85 REF_1: https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: " /autodiscover/autodiscover.json?@zdi/Powershell" RULEDATE_1: 2021-08-08 TAGS_1: EXPLOIT, SCRIPT RULENAME_1: EXPL_Exchange_ProxyShell_Successful_Aug21_1 AUTHOR_1: Florian Roth REASON_2: YARA rule EXPL_Exchange_ProxyShell_Aug21_1 / Detects successful ProxyShell exploitation attempts in log files SUBSCORE_2: 70 REF_2: https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html SIGTYPE_2: internal SIGCLASS_2: YARA Rule MATCHED_2: Str1: " /autodiscover/autodiscover.json?@zdi/Powershell" RULEDATE_2: 2021-08-08 TAGS_2: EXPLOIT, SCRIPT RULENAME_2: EXPL_Exchange_ProxyShell_Aug21_1 AUTHOR_2: Florian Roth REASONS_COUNT: 2
Aug 30 08:27:26 WIN-LRTT94FA08M/10.100.5.12 THOR: Alert: MODULE: LogScan MESSAGE: Malicious Log Entry found SCANID: S-dM24AZNR1hE ENTRY: 192.241.193.117 - - [05/May/2024:05:06:45 +0300] "GET /autodiscover/autodiscover.json?@zdi/Powershell HTTP/1.1" 403 199 "-" "Mozilla/5.0 zgrab/0.x" SCORE: 90 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\it_sec\httpd\access_log LOG_MODIFIED: Tue May  7 07:55:38 2024 LOG_ACCESSED: Tue May 14 16:22:15 2024 LOG_CREATED: Thu Aug 29 15:34:29 2024 REASON_1: YARA rule EXPL_Exchange_ProxyShell_Successful_Aug21_1 / Detects successful ProxyShell exploitation attempts in log files SUBSCORE_1: 85 REF_1: https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: " /autodiscover/autodiscover.json?@zdi/Powershell" RULEDATE_1: 2021-08-08 TAGS_1: EXPLOIT, SCRIPT RULENAME_1: EXPL_Exchange_ProxyShell_Successful_Aug21_1 AUTHOR_1: Florian Roth REASON_2: YARA rule EXPL_Exchange_ProxyShell_Aug21_1 / Detects successful ProxyShell exploitation attempts in log files SUBSCORE_2: 70 REF_2: https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html SIGTYPE_2: internal SIGCLASS_2: YARA Rule MATCHED_2: Str1: " /autodiscover/autodiscover.json?@zdi/Powershell" RULEDATE_2: 2021-08-08 TAGS_2: EXPLOIT, SCRIPT RULENAME_2: EXPL_Exchange_ProxyShell_Aug21_1 AUTHOR_2: Florian Roth REASONS_COUNT: 2
Aug 30 08:27:26 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: LogScan MESSAGE: Notable Log Entry found SCANID: S-dM24AZNR1hE ENTRY: 10.16.6.250 - - [06/May/2024:11:56:51 +0300] "GET /autodiscover/autodiscover.json?@test.com/owa/?&Email=autodiscover/autodiscover.json%3F@test.com HTTP/1.1" 403 199 "-" "-" SCORE: 50 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\it_sec\httpd\access_log LOG_MODIFIED: Tue May  7 07:55:38 2024 LOG_ACCESSED: Tue May 14 16:22:15 2024 LOG_CREATED: Thu Aug 29 15:34:29 2024 REASON_1: YARA rule LOG_EXPL_Exchange_ProxyShell_Attempt_Aug21_1 / Detects ProxyShell exploitation attempts in log files SUBSCORE_1: 50 REF_1: https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "/autodiscover/autodiscover.json?@test.com/owa/?&Email=autodiscover/autodiscover.json%3F@" RULEDATE_1: 2021-08-09 TAGS_1: EXPLOIT, LOG RULENAME_1: LOG_EXPL_Exchange_ProxyShell_Attempt_Aug21_1 AUTHOR_1: Florian Roth REASONS_COUNT: 1
Aug 30 08:27:27 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: LogScan MESSAGE: Notable Log Entry found SCANID: S-dM24AZNR1hE ENTRY: 10.16.6.250 - - [07/May/2024:10:31:56 +0300] "GET /autodiscover/autodiscover.json?@test.com/owa/?&Email=autodiscover/autodiscover.json%3F@test.com HTTP/1.1" 403 199 "-" "-" SCORE: 50 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\it_sec\httpd\access_log LOG_MODIFIED: Tue May  7 07:55:38 2024 LOG_ACCESSED: Tue May 14 16:22:15 2024 LOG_CREATED: Thu Aug 29 15:34:29 2024 REASON_1: YARA rule LOG_EXPL_Exchange_ProxyShell_Attempt_Aug21_1 / Detects ProxyShell exploitation attempts in log files SUBSCORE_1: 50 REF_1: https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "/autodiscover/autodiscover.json?@test.com/owa/?&Email=autodiscover/autodiscover.json%3F@" RULEDATE_1: 2021-08-09 TAGS_1: EXPLOIT, LOG RULENAME_1: LOG_EXPL_Exchange_ProxyShell_Attempt_Aug21_1 AUTHOR_1: Florian Roth REASONS_COUNT: 1
Aug 30 08:27:27 WIN-LRTT94FA08M/10.100.5.12 THOR: Alert: MODULE: Filescan MESSAGE: Malware file found SCANID: S-dM24AZNR1hE SCORE: 85 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\it_sec\httpd\access_log EXT:  TYPE: IP Log SIZE: 703152 MD5: 857a3b06303b8c133060b62f06f817cd SHA1: 4660e22431e4423208ffb7a2eeb65ae00efbfaf9 SHA256: 04bb63cd98f63ba08f945ad5e91ddc8656eb7c55d809b13d99a9c71741306d50 FIRSTBYTES: 3139322e3234312e3233312e3531202d202d205b / 192.241.231.51 - - [ CREATED: Thu Aug 29 15:34:29.290 2024 MODIFIED: Tue May  7 07:55:38.000 2024 ACCESSED: Tue May 14 16:22:15.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXPL_Exchange_ProxyShell_Successful_Aug21_1 / Detects successful ProxyShell exploitation attempts in log files SUBSCORE_1: 85 REF_1: https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: " /autodiscover/autodiscover.json?@zdi/Powershell" in ".241.193.117 - - [05/May/2024:05:06:30 +0300] \"GET /autodiscover/autodiscover.json?@zdi/Powershell HTTP/1.1\" 403 199 \"-\" \"Mozilla/5.0 zgrab/0.x\"\x0a192" at 0x187f RULEDATE_1: 2021-08-08 TAGS_1: EXPLOIT, SCRIPT RULENAME_1: EXPL_Exchange_ProxyShell_Successful_Aug21_1 AUTHOR_1: Florian Roth REASONS_COUNT: 1
Aug 30 08:28:17 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: Filescan MESSAGE: Malware file found SCANID: S-dM24AZNR1hE SCORE: 83 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\mpirogova\.cache\composer\files\phpunit\phpunit\1f77ae2d4af2b1612629468e2c7afc682466b121.zip\sebastianbergmann-phpunit-6e35126\src\Util\PHP\eval-stdin.php EXT: .php TYPE: PHP SIZE: 54 MD5: 120ac49800671dc383b6f3709c25c099 SHA1: 5f1ec986c407846c7cde2bc5d939cdfab7125967 SHA256: 64589452b166cb815b3f7ab28324bd743fc606e7a3a8ca207d2faa313e5d4cf3 FIRSTBYTES: 3c3f7068700a0a6576616c28273f3e27202e2066 / <?php  eval('?>' . f MODIFIED: Thu Feb 11 14:56:33.000 2016 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\mpirogova\.cache\composer\files\phpunit\phpunit\1f77ae2d4af2b1612629468e2c7afc682466b121.zip ARCHIVE_TYPE: ZIP ARCHIVE_SIZE: 593998 ARCHIVE_MD5: 37db7eb21d082a60ca7d1ec77a7b86c8 ARCHIVE_SHA1: 77383c303ab5aa4110129074e8bec4da69c7d0b9 ARCHIVE_SHA256: b4efd93e85bd67b8097a13f58020bb2cba7de73cc01e265859ef49984db58172 ARCHIVE_FIRSTBYTES: 504b03040a000000000010374b48000000000000 / PK 7KH ARCHIVE_CREATED: Thu Aug 29 15:38:58.104 2024 ARCHIVE_MODIFIED: Tue Sep  3 10:20:38.000 2019 ARCHIVE_ACCESSED: Tue May 14 16:10:01.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_WEBSHELL_PHP_Generic / php webshell having some kind of input and some kind of payload. restricted to small files or big ones inclusing suspicious strings SUBSCORE_1: 75 REF_1: Internal Research SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "<?" in "<?php\x0a\x0aeval('?>' . file_get_contents('php://input'))" at 0x0 Str2: "<?php" in "<?php\x0a\x0aeval('?>' . file_get_contents('php://input'));\x0a" at 0x0 Str3: "php://input" in "<?php\x0a\x0aeval('?>' . file_get_contents('php://input'));\x0a" at 0x26 Str4: "eval('" in "<?php\x0a\x0aeval('?>' . file_get_contents('php://input'));\x0a" at 0x7 Str5: "eval('" in "<?php\x0a\x0aeval('?>' . file_get_contents('php://input'));\x0a" at 0x7 RULEDATE_1: 2021-01-14 TAGS_1: GEN, T1033, T1087_002, T1505_003, VENDOR, WEBSHELL RULENAME_1: EXT_WEBSHELL_PHP_Generic AUTHOR_1: Arnim Rupp (https://github.com/ruppde) REASON_2: YARA rule SUSP_WEBSHELL_Tiny_Eval_Oct20 / Detects suspicious tiny files including an eval statement SUBSCORE_2: 65 REF_2: Internal Research SIGTYPE_2: internal SIGCLASS_2: YARA Rule MATCHED_2: Str1: "eval(" in "<?php\x0a\x0aeval('?>' . file_get_contents('php://input'));\x0a" at 0x7 RULEDATE_2: 2020-10-15 TAGS_2: FILE, SUSP, T1505_003, WEBSHELL RULENAME_2: SUSP_WEBSHELL_Tiny_Eval_Oct20 AUTHOR_2: Florian Roth REASONS_COUNT: 2
Aug 30 08:28:53 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: Filescan MESSAGE: Possibly Dangerous file found SCANID: S-dM24AZNR1hE SCORE: 70 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\mpirogova\.cache\composer\repo\https---repo.packagist.org\p-provider-2019-07.json EXT: .json TYPE: UNKNOWN SIZE: 2579459 MD5: 375539ac49b5bbb3d4210f5e2f8693b0 SHA1: 5a327f54f00968c113eeacb8090f97db3b678d8c SHA256: 9333a714c76df9ed3d7206446e4c8f9ff33dcb46545e1278aa7453bc35a5e6f6 FIRSTBYTES: 7b2270726f766964657273223a7b22302e302e30 / {"providers":{"0.0.0 CREATED: Thu Aug 29 15:38:55.954 2024 MODIFIED: Thu Dec  5 09:35:54.000 2019 ACCESSED: Tue May 14 16:14:59.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule SUSP_JS_Dropping_Exe_Aug23 / Detects JavaScript file that drops executables SUBSCORE_1: 70 REF_1: https://twitter.com/James_inthe_box/status/1674105216575373312 SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\"4d5a" in "c88af246862def815\"},\"carno-php/serving\":{\"sha256\":\"4d5abf1f8ae6ebf1fa75860d47845d9a8c944ee01d8529c95c571d" at 0x5081e Str2: "powershell" in "0eca93a8c250536ecb27819edf\"},\"alissonpelizaro/ssh_powershell\":{\"sha256\":\"d542da6654214697055931a1024fc2ffc2862" at 0x13de3 RULEDATE_1: 2023-08-03 TAGS_1: EXE, FILE, SUSP RULENAME_1: SUSP_JS_Dropping_Exe_Aug23 AUTHOR_1: X__Junior REASONS_COUNT: 1
Aug 30 08:29:45 WIN-LRTT94FA08M/10.100.5.12 THOR: Alert: MODULE: LogScan MESSAGE: Malicious Log Entry found SCANID: S-dM24AZNR1hE ENTRY: 192.241.193.117 - - [05/May/2024:05:06:30 +0300] "GET /autodiscover/autodiscover.json?@zdi/Powershell HTTP/1.1" 403 199 "-" "Mozilla/5.0 zgrab/0.x" SCORE: 90 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\mpirogova\sites\site2\core\Logs[deleted]\httpd\access_log LOG_MODIFIED: Tue May  7 07:55:38 2024 LOG_ACCESSED: Tue May 14 16:22:15 2024 LOG_CREATED: Fri Aug 30 07:25:01 2024 REASON_1: YARA rule EXPL_Exchange_ProxyShell_Successful_Aug21_1 / Detects successful ProxyShell exploitation attempts in log files SUBSCORE_1: 85 REF_1: https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: " /autodiscover/autodiscover.json?@zdi/Powershell" RULEDATE_1: 2021-08-08 TAGS_1: EXPLOIT, SCRIPT RULENAME_1: EXPL_Exchange_ProxyShell_Successful_Aug21_1 AUTHOR_1: Florian Roth REASON_2: YARA rule EXPL_Exchange_ProxyShell_Aug21_1 / Detects successful ProxyShell exploitation attempts in log files SUBSCORE_2: 70 REF_2: https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html SIGTYPE_2: internal SIGCLASS_2: YARA Rule MATCHED_2: Str1: " /autodiscover/autodiscover.json?@zdi/Powershell" RULEDATE_2: 2021-08-08 TAGS_2: EXPLOIT, SCRIPT RULENAME_2: EXPL_Exchange_ProxyShell_Aug21_1 AUTHOR_2: Florian Roth REASONS_COUNT: 2
Aug 30 08:29:45 WIN-LRTT94FA08M/10.100.5.12 THOR: Alert: MODULE: LogScan MESSAGE: Malicious Log Entry found SCANID: S-dM24AZNR1hE ENTRY: 192.241.193.117 - - [05/May/2024:05:06:45 +0300] "GET /autodiscover/autodiscover.json?@zdi/Powershell HTTP/1.1" 403 199 "-" "Mozilla/5.0 zgrab/0.x" SCORE: 90 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\mpirogova\sites\site2\core\Logs[deleted]\httpd\access_log LOG_MODIFIED: Tue May  7 07:55:38 2024 LOG_ACCESSED: Tue May 14 16:22:15 2024 LOG_CREATED: Fri Aug 30 07:25:01 2024 REASON_1: YARA rule EXPL_Exchange_ProxyShell_Successful_Aug21_1 / Detects successful ProxyShell exploitation attempts in log files SUBSCORE_1: 85 REF_1: https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: " /autodiscover/autodiscover.json?@zdi/Powershell" RULEDATE_1: 2021-08-08 TAGS_1: EXPLOIT, SCRIPT RULENAME_1: EXPL_Exchange_ProxyShell_Successful_Aug21_1 AUTHOR_1: Florian Roth REASON_2: YARA rule EXPL_Exchange_ProxyShell_Aug21_1 / Detects successful ProxyShell exploitation attempts in log files SUBSCORE_2: 70 REF_2: https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html SIGTYPE_2: internal SIGCLASS_2: YARA Rule MATCHED_2: Str1: " /autodiscover/autodiscover.json?@zdi/Powershell" RULEDATE_2: 2021-08-08 TAGS_2: EXPLOIT, SCRIPT RULENAME_2: EXPL_Exchange_ProxyShell_Aug21_1 AUTHOR_2: Florian Roth REASONS_COUNT: 2
Aug 30 08:29:45 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: LogScan MESSAGE: Notable Log Entry found SCANID: S-dM24AZNR1hE ENTRY: 10.16.6.250 - - [06/May/2024:11:56:51 +0300] "GET /autodiscover/autodiscover.json?@test.com/owa/?&Email=autodiscover/autodiscover.json%3F@test.com HTTP/1.1" 403 199 "-" "-" SCORE: 50 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\mpirogova\sites\site2\core\Logs[deleted]\httpd\access_log LOG_MODIFIED: Tue May  7 07:55:38 2024 LOG_ACCESSED: Tue May 14 16:22:15 2024 LOG_CREATED: Fri Aug 30 07:25:01 2024 REASON_1: YARA rule LOG_EXPL_Exchange_ProxyShell_Attempt_Aug21_1 / Detects ProxyShell exploitation attempts in log files SUBSCORE_1: 50 REF_1: https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "/autodiscover/autodiscover.json?@test.com/owa/?&Email=autodiscover/autodiscover.json%3F@" RULEDATE_1: 2021-08-09 TAGS_1: EXPLOIT, LOG RULENAME_1: LOG_EXPL_Exchange_ProxyShell_Attempt_Aug21_1 AUTHOR_1: Florian Roth REASONS_COUNT: 1
Aug 30 08:29:46 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: LogScan MESSAGE: Notable Log Entry found SCANID: S-dM24AZNR1hE ENTRY: 10.16.6.250 - - [07/May/2024:10:31:56 +0300] "GET /autodiscover/autodiscover.json?@test.com/owa/?&Email=autodiscover/autodiscover.json%3F@test.com HTTP/1.1" 403 199 "-" "-" SCORE: 50 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\mpirogova\sites\site2\core\Logs[deleted]\httpd\access_log LOG_MODIFIED: Tue May  7 07:55:38 2024 LOG_ACCESSED: Tue May 14 16:22:15 2024 LOG_CREATED: Fri Aug 30 07:25:01 2024 REASON_1: YARA rule LOG_EXPL_Exchange_ProxyShell_Attempt_Aug21_1 / Detects ProxyShell exploitation attempts in log files SUBSCORE_1: 50 REF_1: https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "/autodiscover/autodiscover.json?@test.com/owa/?&Email=autodiscover/autodiscover.json%3F@" RULEDATE_1: 2021-08-09 TAGS_1: EXPLOIT, LOG RULENAME_1: LOG_EXPL_Exchange_ProxyShell_Attempt_Aug21_1 AUTHOR_1: Florian Roth REASONS_COUNT: 1
Aug 30 08:29:46 WIN-LRTT94FA08M/10.100.5.12 THOR: Alert: MODULE: Filescan MESSAGE: Malware file found SCANID: S-dM24AZNR1hE SCORE: 85 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\mpirogova\sites\site2\core\Logs[deleted]\httpd\access_log EXT:  TYPE: IP Log SIZE: 703152 MD5: 857a3b06303b8c133060b62f06f817cd SHA1: 4660e22431e4423208ffb7a2eeb65ae00efbfaf9 SHA256: 04bb63cd98f63ba08f945ad5e91ddc8656eb7c55d809b13d99a9c71741306d50 FIRSTBYTES: 3139322e3234312e3233312e3531202d202d205b / 192.241.231.51 - - [ CREATED: Fri Aug 30 07:25:01.721 2024 MODIFIED: Tue May  7 07:55:38.000 2024 ACCESSED: Tue May 14 16:22:15.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXPL_Exchange_ProxyShell_Successful_Aug21_1 / Detects successful ProxyShell exploitation attempts in log files SUBSCORE_1: 85 REF_1: https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: " /autodiscover/autodiscover.json?@zdi/Powershell" in ".241.193.117 - - [05/May/2024:05:06:30 +0300] \"GET /autodiscover/autodiscover.json?@zdi/Powershell HTTP/1.1\" 403 199 \"-\" \"Mozilla/5.0 zgrab/0.x\"\x0a192" at 0x187f RULEDATE_1: 2021-08-08 TAGS_1: EXPLOIT, SCRIPT RULENAME_1: EXPL_Exchange_ProxyShell_Successful_Aug21_1 AUTHOR_1: Florian Roth REASONS_COUNT: 1
Aug 30 08:29:57 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: Filescan MESSAGE: Possibly Dangerous file found SCANID: S-dM24AZNR1hE SCORE: 60 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\mpirogova\sites\site2\core\components\modalconsole\files\1.php EXT: .php TYPE: PHP SIZE: 1238 MD5: 0bc2508476c9bb5e51863f1676fff755 SHA1: a8e2af20dfcea4e2ea5a6355d6605a05d24e1b2b SHA256: e2ee8470f319042893992f498d3344700b1b7c3295e95e70d5b81a79f972f13a FIRSTBYTES: 3c3f7068700a246576656e74537461747573203d / <?php $eventStatus = CREATED: Fri Aug 30 07:22:20.619 2024 MODIFIED: Mon Nov 25 12:10:57.000 2019 ACCESSED: Tue May 14 16:20:50.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: Filename IOC \\[0-9]\.(aspx|asp|jsp|jspx|php) SUBSCORE_1: 60 REF_1: Suspicious Web Shell file names https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/new-apt-group-chamelgang/#id3-1 SIGTYPE_1: internal SIGCLASS_1: Filename IOC MATCHED_1: \1.php REASONS_COUNT: 1
Aug 30 08:29:57 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: Filescan MESSAGE: Possibly Dangerous file found SCANID: S-dM24AZNR1hE SCORE: 60 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\mpirogova\sites\site2\core\components\modalconsole\files\2.php EXT: .php TYPE: PHP SIZE: 1465 MD5: 6d199d7b1d8ee58b56fb48771999a7a1 SHA1: 2bfc77a99278f1ea51f1fad04a3f5177c24d8638 SHA256: ca49ac28acf7f7cf3da6a66da9bf78c5598edbb5e822de7e5d4bc9819c0b4212 FIRSTBYTES: 3c3f7068700a246576656e74537461747573203d / <?php $eventStatus = CREATED: Fri Aug 30 07:22:20.620 2024 MODIFIED: Mon Nov 25 13:42:16.000 2019 ACCESSED: Tue May 14 16:21:01.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: Filename IOC \\[0-9]\.(aspx|asp|jsp|jspx|php) SUBSCORE_1: 60 REF_1: Suspicious Web Shell file names https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/new-apt-group-chamelgang/#id3-1 SIGTYPE_1: internal SIGCLASS_1: Filename IOC MATCHED_1: \2.php REASONS_COUNT: 1
Aug 30 08:29:57 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: Filescan MESSAGE: Possibly Dangerous file found SCANID: S-dM24AZNR1hE SCORE: 60 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\mpirogova\sites\site2\core\components\modalconsole\files\3.php EXT: .php TYPE: PHP SIZE: 1726 MD5: e7bb65f839e337812c6e6d291193d8dc SHA1: 2a029dcd757e66a68e709ba1b04c32884457509b SHA256: ba87b7a83977494070f63c3b9aa8b2143b2f84f6735a922443609163b75e8841 FIRSTBYTES: 3c3f7068700a246576656e74537461747573203d / <?php $eventStatus = CREATED: Fri Aug 30 07:22:20.622 2024 MODIFIED: Mon Nov 25 14:38:48.000 2019 ACCESSED: Tue May 14 16:21:06.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: Filename IOC \\[0-9]\.(aspx|asp|jsp|jspx|php) SUBSCORE_1: 60 REF_1: Suspicious Web Shell file names https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/new-apt-group-chamelgang/#id3-1 SIGTYPE_1: internal SIGCLASS_1: Filename IOC MATCHED_1: \3.php REASONS_COUNT: 1
Aug 30 08:29:57 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: Filescan MESSAGE: Possibly Dangerous file found SCANID: S-dM24AZNR1hE SCORE: 60 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\mpirogova\sites\site2\core\components\modalconsole\files\4.php EXT: .php TYPE: PHP SIZE: 1024 MD5: d32aee0812eb2e4d7008d136799d379d SHA1: eb9683ef7d040fcb77bb038c0ab968cca331f243 SHA256: 5dcdd7254ae41af8273bafd27c5b6b46ab2838a7e25e3abc13010088cd42cb01 FIRSTBYTES: 3c3f7068700a246576656e74537461747573203d / <?php $eventStatus = CREATED: Fri Aug 30 07:22:20.674 2024 MODIFIED: Mon Nov 25 15:21:12.000 2019 ACCESSED: Tue May 14 16:21:11.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: Filename IOC \\[0-9]\.(aspx|asp|jsp|jspx|php) SUBSCORE_1: 60 REF_1: Suspicious Web Shell file names https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/new-apt-group-chamelgang/#id3-1 SIGTYPE_1: internal SIGCLASS_1: Filename IOC MATCHED_1: \4.php REASONS_COUNT: 1
Aug 30 08:32:06 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.5p1\regress\rsa_openssh.prv EXT: .prv TYPE: Certificate PEM SIZE: 883 MD5: a6b110f820948e73bbde7b948744b3c5 SHA1: 614e6d353be614ded246a12ed6e14af20f063710 SHA256: 79b8783d0b10a3f65b9b3e349a1daa692cc27be08028131ff5a9a08799035f46 FIRSTBYTES: 2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA CREATED: Thu Aug 29 15:37:24.013 2024 MODIFIED: Tue Mar  2 10:31:47.000 2021 ACCESSED: Tue May 14 16:09:22.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x43\x57\x67\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x73\x69\x6c\x77\x4b\x63\x61\x4b\x4e\x36\x77\x53\x4d\x4e\x64\x31\x57\x67\x51\x39\x2b\x48\x52\x71\x51\x45\x6b\x44\x30\x6b\x43\x54\x56\x74\x74\x72\x61\x7a" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:07 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.5p1\regress\misc\fuzz-harness\testdata\id_dsa EXT:  TYPE: Certificate PEM SIZE: 1361 MD5: a9521c2825fbf778b6b82b1dcda95d72 SHA1: 29bc6d9b491473450487aad65a659675154b8fb8 SHA256: a6fa247970fe3fe15b9647e9ae301495d10ea278dbe9516abdf70e69b1849744 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Thu Aug 29 15:37:23.979 2024 MODIFIED: Tue Mar  2 10:31:47.000 2021 ACCESSED: Tue May 14 16:22:49.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x42\x73\x67\x41\x41\x41\x41\x64\x7a\x63\x32\x67\x74\x5a\x48\x0a\x4e\x7a\x41\x41\x41\x41\x67\x51\x43\x73" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:07 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.5p1\regress\misc\fuzz-harness\testdata\id_ecdsa EXT:  TYPE: Certificate PEM SIZE: 492 MD5: b14d14c4a2eb3a89c43be1d828fe2604 SHA1: 56c94a39972cc4c2ab982f6b206702cf3b558bde SHA256: 00120fd3e06a2c9a2debabe94c75cb9a8fb313d17b3a114dda6264874ae56c60 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Thu Aug 29 15:37:23.981 2024 MODIFIED: Tue Mar  2 10:31:47.000 2021 ACCESSED: Tue May 14 16:23:02.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x61\x41\x41\x41\x41\x42\x4e\x6c\x59\x32\x52\x7a\x59\x53\x0a\x31\x7a\x61\x47\x45\x79\x4c\x57\x35\x70" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:07 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.5p1\regress\misc\fuzz-harness\testdata\id_ecdsa_sk EXT:  TYPE: Certificate PEM SIZE: 858 MD5: c87bc24fa8b257e7af7374511f44d2c5 SHA1: 2c1d6e64ad0052837b53739841f6acfc60a191ed SHA256: 50e6649901ffdf7bc4d85dd0f45937b9d99bdd85e472c112f8586bd3e35beb58 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Thu Aug 29 15:37:23.984 2024 MODIFIED: Tue Mar  2 10:31:47.000 2021 ACCESSED: Tue May 14 16:23:15.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x66\x77\x41\x41\x41\x43\x4a\x7a\x61\x79\x31\x6c\x59\x32\x0a\x52\x7a\x59\x53\x31\x7a\x61\x47\x45\x79" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:07 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.5p1\regress\misc\fuzz-harness\testdata\id_ed25519 EXT:  TYPE: Certificate PEM SIZE: 387 MD5: 904e0a369a7fbe86bcb4e0bc1363c539 SHA1: 1074da4383390925d414ad562a0818a88e116208 SHA256: 6efecdbb70364afc9cf004e325a9a1d2673d86e85a6238e1126d6d105cea56c1 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Thu Aug 29 15:37:23.985 2024 MODIFIED: Tue Mar  2 10:31:47.000 2021 ACCESSED: Tue May 14 16:23:28.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:07 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.5p1\regress\misc\fuzz-harness\testdata\id_ed25519_sk EXT:  TYPE: Certificate PEM SIZE: 496 MD5: c3c7cad31e9edf76f806848501011568 SHA1: f936a6c0f3b1250ef7fd0cbf4ea5a5d3c9c63507 SHA256: 5fd315701b14a13467331e1d0819a8016abdf5888ab695f068fce488bd37169d FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Thu Aug 29 15:37:23.987 2024 MODIFIED: Tue Mar  2 10:31:47.000 2021 ACCESSED: Tue May 14 16:23:44.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x53\x67\x41\x41\x41\x42\x70\x7a\x61\x79\x31\x7a\x63\x32\x0a\x67\x74\x5a\x57\x51\x79\x4e\x54\x55\x78" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:07 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.5p1\regress\misc\fuzz-harness\testdata\id_rsa EXT:  TYPE: Certificate PEM SIZE: 1799 MD5: 0e4d9d0e310d6dc6a5c2d33660f70542 SHA1: 7bef427ad9067a465009d543787063fdaceef3e5 SHA256: 83822e39fb2ee059431a45c3c48cffcda3fb869273a364a45898ce9abad09e84 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Thu Aug 29 15:37:23.989 2024 MODIFIED: Tue Mar  2 10:31:47.000 2021 ACCESSED: Tue May 14 16:23:58.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x42\x46\x77\x41\x41\x41\x41\x64\x7a\x63\x32\x67\x74\x63\x6e\x0a\x4e\x68\x41\x41\x41\x41\x41\x77\x45\x41" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:08 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.5p1\regress\unittests\sshkey\testdata\dsa_1 EXT:  TYPE: Certificate PEM SIZE: 672 MD5: aebcad00ac7fb84f1a7de01322c99be3 SHA1: a9a0e1cf84bee8c27802295819b399833e5d4d08 SHA256: b7f7c2bb695b28e585951a2da4ad2d6c933c440afe118798c6e2363e17da2b93 FIRSTBYTES: 2d2d2d2d2d424547494e20445341205052495641 / -----BEGIN DSA PRIVA CREATED: Thu Aug 29 15:37:24.200 2024 MODIFIED: Tue Mar  2 10:31:47.000 2021 ACCESSED: Tue May 14 16:20:25.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x44\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x42\x76\x41\x49\x42\x41\x41\x4b\x42\x67\x51" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x44\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x42\x76\x41\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x36\x6b\x75\x74\x4e\x46\x52\x73\x48\x54\x77\x45\x41\x76\x36\x64\x33\x39\x4c\x68\x73\x71\x79\x31\x61\x70\x64\x48\x42\x5a\x39\x63\x32\x48\x66\x79\x52\x72\x37\x57\x6d\x79\x70\x79\x47\x49\x79\x32\x6d" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:08 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.5p1\regress\unittests\sshkey\testdata\dsa_n EXT:  TYPE: Certificate PEM SIZE: 1361 MD5: 6fcf088f9850b2f2213186cee4dc4811 SHA1: a04d604886c6a7c2217df9b7eea5c998da91d561 SHA256: db691de6aa454ec8aa45c84c58022a54611427f6f44c20d152ac05e0ea2284ba FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Thu Aug 29 15:37:24.213 2024 MODIFIED: Tue Mar  2 10:31:47.000 2021 ACCESSED: Tue May 14 16:21:26.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x42\x73\x77\x41\x41\x41\x41\x64\x7a\x63\x32\x67\x74\x5a\x48\x0a\x4e\x7a\x41\x41\x41\x41\x67\x51\x44\x36" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:08 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.5p1\regress\unittests\sshkey\testdata\ecdsa_1 EXT:  TYPE: Certificate PEM SIZE: 227 MD5: 610b43e1fd8e09f2794aba398c6950eb SHA1: c7e5b5ff84b30ff8880e4d75942a600d012516b6 SHA256: 42a90746ef5975c6ef98c6d56305dad0bc698a1b05c83518bc90584c83935d5c FIRSTBYTES: 2d2d2d2d2d424547494e20454320505249564154 / -----BEGIN EC PRIVAT CREATED: Thu Aug 29 15:37:24.214 2024 MODIFIED: Tue Mar  2 10:31:47.000 2021 ACCESSED: Tue May 14 16:21:35.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x48\x63\x43\x41\x51\x45\x45\x49\x50\x50\x4e\x79\x55\x41\x6e\x6a\x76\x46\x72\x2b\x65\x54\x2f\x37\x74\x2f\x49\x79\x6a\x75\x51\x51\x64\x2f\x61\x4c\x46\x69\x54\x59\x39\x32\x4c\x42\x39\x67\x49\x6a\x79\x72" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:08 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.5p1\regress\unittests\sshkey\testdata\ecdsa_2 EXT:  TYPE: Certificate PEM SIZE: 365 MD5: 0346ad9a21f23d98cb3abe4845df078d SHA1: 07091af93e22c676e03e6f96e9d0e53c9b53d775 SHA256: 320396e36bd5ecc12089f26849f8e7b6e0ab3c037f0492dee978cef6646d5826 FIRSTBYTES: 2d2d2d2d2d424547494e20454320505249564154 / -----BEGIN EC PRIVAT CREATED: Thu Aug 29 15:37:24.217 2024 MODIFIED: Tue Mar  2 10:31:47.000 2021 ACCESSED: Tue May 14 16:22:18.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x48\x63\x41\x67\x45\x42\x42\x45\x49\x42\x71\x42\x74\x4e\x37\x65\x36\x45\x73\x73\x64\x33\x64\x6c\x73\x67\x49\x53\x56\x69\x50\x43\x58\x58\x43\x30\x61\x74\x6c\x4e\x6b\x47\x74\x6f\x4d\x67\x53\x51\x64" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:08 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.5p1\regress\unittests\sshkey\testdata\ecdsa_n EXT:  TYPE: Certificate PEM SIZE: 492 MD5: 0ffc5b7197ecb4b69f503d4f3cc24c8c SHA1: c2c7fd9527d9cc84781346a3ac8e2100d4d20ad3 SHA256: 1cccaa23aca49238099494fc7b49b550311719c9ac6bb138797e1077f4d7973d FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Thu Aug 29 15:37:24.224 2024 MODIFIED: Tue Mar  2 10:31:47.000 2021 ACCESSED: Tue May 14 16:22:50.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x61\x41\x41\x41\x41\x42\x4e\x6c\x59\x32\x52\x7a\x59\x53\x0a\x31\x7a\x61\x47\x45\x79\x4c\x57\x35\x70" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:08 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.5p1\regress\unittests\sshkey\testdata\ecdsa_sk1 EXT:  TYPE: Certificate PEM SIZE: 849 MD5: 97206cfa158fdda5a45c6eb542f739c0 SHA1: e55ec614db8cea92d7269d5f903cf72baca36454 SHA256: e4df7ea4ca133a7457069be073203c556166c65635ed6fb6c12b9a84f027346e FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Thu Aug 29 15:37:24.225 2024 MODIFIED: Tue Mar  2 10:31:47.000 2021 ACCESSED: Tue May 14 16:22:58.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x66\x77\x41\x41\x41\x43\x4a\x7a\x61\x79\x31\x6c\x59\x32\x0a\x52\x7a\x59\x53\x31\x7a\x61\x47\x45\x79" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:08 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.5p1\regress\unittests\sshkey\testdata\ecdsa_sk2 EXT:  TYPE: Certificate PEM SIZE: 849 MD5: 14ecb7595ee296b15d413ae395454a4c SHA1: 909379299593aeebc79f44df0ec22578123acce7 SHA256: de6f60d862f799ca088bd4611865e24bb0635d81097bb9496f0178aefa4acbae FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Thu Aug 29 15:37:24.240 2024 MODIFIED: Tue Mar  2 10:31:47.000 2021 ACCESSED: Tue May 14 16:23:29.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x66\x77\x41\x41\x41\x43\x4a\x7a\x61\x79\x31\x6c\x59\x32\x0a\x52\x7a\x59\x53\x31\x7a\x61\x47\x45\x79" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:08 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.5p1\regress\unittests\sshkey\testdata\ed25519_1 EXT:  TYPE: Certificate PEM SIZE: 411 MD5: 514e8e39c48edb2b8934ef78a5030042 SHA1: a7a368a6f3d09bc2cfc1315f6e0899bde0574ffd SHA256: 74f95c1990e3512af471cf6fb58d08a8078bbab597e7ee86a7ccd233f6855fd1 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Thu Aug 29 15:37:24.243 2024 MODIFIED: Tue Mar  2 10:31:47.000 2021 ACCESSED: Tue May 14 16:23:49.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:08 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.5p1\regress\unittests\sshkey\testdata\ed25519_2 EXT:  TYPE: Certificate PEM SIZE: 411 MD5: bfc2ac8495dbc6070241303ec50a6dc2 SHA1: 53e388e7c836c6ba874e852d71a6e1e708611d25 SHA256: 31689f4706b3bdad29ee21b05af62e9f2257399d07092089944514ed5edb131d FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Thu Aug 29 15:37:24.248 2024 MODIFIED: Tue Mar  2 10:31:47.000 2021 ACCESSED: Tue May 14 16:24:23.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:08 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.5p1\regress\unittests\sshkey\testdata\ed25519_sk1 EXT:  TYPE: Certificate PEM SIZE: 484 MD5: ab9dcdbff00763217a3f85069a9c2f67 SHA1: 05396ad046c37370093f48c0bdb2510b8894aa76 SHA256: 45c058d08280c4ca36a9d020478504cd550e7c5752c207d182363c3edf669ce8 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Thu Aug 29 15:37:24.254 2024 MODIFIED: Tue Mar  2 10:31:47.000 2021 ACCESSED: Tue May 14 16:24:45.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x53\x67\x41\x41\x41\x42\x70\x7a\x61\x79\x31\x7a\x63\x32\x0a\x67\x74\x5a\x57\x51\x79\x4e\x54\x55\x78" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:08 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.5p1\regress\unittests\sshkey\testdata\ed25519_sk2 EXT:  TYPE: Certificate PEM SIZE: 484 MD5: 8a666562de41f71d57d47c5f6404293a SHA1: 069c9341d4b0cd94669ff23feab92853b6a42540 SHA256: b862e169114ee63ae5e8497110075a9e67c4e3f24bad01e7c06951d268a3ec0f FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Thu Aug 29 15:37:24.258 2024 MODIFIED: Tue Mar  2 10:31:47.000 2021 ACCESSED: Tue May 14 16:25:17.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x53\x67\x41\x41\x41\x42\x70\x7a\x61\x79\x31\x7a\x63\x32\x0a\x67\x74\x5a\x57\x51\x79\x4e\x54\x55\x78" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:08 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.5p1\regress\unittests\sshkey\testdata\rsa_1 EXT:  TYPE: Certificate PEM SIZE: 887 MD5: 197f14927e89c5c573213416bde709cb SHA1: 2f5cfafbddd00c351ce72e2f140458fb5ac7b60a SHA256: 07586a53bef4dd9daf59c473399fca5fcb39891bed0d2c2f8a88249e02392ac5 FIRSTBYTES: 2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA CREATED: Thu Aug 29 15:37:24.261 2024 MODIFIED: Tue Mar  2 10:31:47.000 2021 ACCESSED: Tue May 14 16:25:39.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x43\x58\x41\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x4c\x56\x35\x6c\x55\x54\x74\x37\x46\x72\x41\x44\x73\x65\x42\x2f\x43\x47\x68\x45\x5a\x7a\x70\x6f\x6f\x6a\x6a\x45\x57\x35\x79\x38\x2b\x65\x50\x76\x4c\x70" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:08 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.5p1\regress\unittests\sshkey\testdata\rsa_1_sha1 EXT:  TYPE: Certificate PEM SIZE: 887 MD5: 197f14927e89c5c573213416bde709cb SHA1: 2f5cfafbddd00c351ce72e2f140458fb5ac7b60a SHA256: 07586a53bef4dd9daf59c473399fca5fcb39891bed0d2c2f8a88249e02392ac5 FIRSTBYTES: 2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA CREATED: Thu Aug 29 15:37:24.266 2024 MODIFIED: Tue Mar  2 10:31:47.000 2021 ACCESSED: Tue May 14 16:09:43.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x43\x58\x41\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x4c\x56\x35\x6c\x55\x54\x74\x37\x46\x72\x41\x44\x73\x65\x42\x2f\x43\x47\x68\x45\x5a\x7a\x70\x6f\x6f\x6a\x6a\x45\x57\x35\x79\x38\x2b\x65\x50\x76\x4c\x70" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:08 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.5p1\regress\unittests\sshkey\testdata\rsa_1_sha512 EXT:  TYPE: Certificate PEM SIZE: 887 MD5: 197f14927e89c5c573213416bde709cb SHA1: 2f5cfafbddd00c351ce72e2f140458fb5ac7b60a SHA256: 07586a53bef4dd9daf59c473399fca5fcb39891bed0d2c2f8a88249e02392ac5 FIRSTBYTES: 2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA CREATED: Thu Aug 29 15:37:24.268 2024 MODIFIED: Tue Mar  2 10:31:47.000 2021 ACCESSED: Tue May 14 16:09:57.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x43\x58\x41\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x4c\x56\x35\x6c\x55\x54\x74\x37\x46\x72\x41\x44\x73\x65\x42\x2f\x43\x47\x68\x45\x5a\x7a\x70\x6f\x6f\x6a\x6a\x45\x57\x35\x79\x38\x2b\x65\x50\x76\x4c\x70" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:08 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.5p1\regress\unittests\sshkey\testdata\rsa_2 EXT:  TYPE: Certificate PEM SIZE: 1679 MD5: c8860a2d208d222eade1e9866449ccbc SHA1: 64133ddc79d593e467c864c429e3793c69e4dc22 SHA256: e42925e663a7215e19cdc89bd9fe018903eeb013f131b188d3c87f0ef01c5a24 FIRSTBYTES: 2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA CREATED: Thu Aug 29 15:37:24.270 2024 MODIFIED: Tue Mar  2 10:31:47.000 2021 ACCESSED: Tue May 14 16:10:10.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x45\x70\x41\x49\x42\x41\x41\x4b\x43\x41\x51\x45\x41\x39\x4e\x45\x55\x58\x70\x37\x38\x53\x41\x6b\x6d\x4c\x34\x2b\x65\x41\x6a\x34\x6d\x42\x7a\x50\x4f\x6a\x6b\x2b\x63\x63\x43\x50\x56\x7a\x6b\x54\x52\x2b" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:08 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.5p1\regress\unittests\sshkey\testdata\rsa_n EXT:  TYPE: Certificate PEM SIZE: 1020 MD5: d60f55c106077131ba136f02e9b9ba88 SHA1: d6a3a8961cb40e8a4ff03dbfd5983c9fc5dfeb39 SHA256: 0ad47d17d5f21f350c26c4c94564bf41b6fd28ab55187166b4f46b1b35daed6d FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Thu Aug 29 15:37:24.274 2024 MODIFIED: Tue Mar  2 10:31:47.000 2021 ACCESSED: Tue May 14 16:10:40.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x6c\x77\x41\x41\x41\x41\x64\x7a\x63\x32\x67\x74\x63\x6e\x0a\x4e\x68\x41\x41\x41\x41\x41\x77\x45\x41" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:08 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.5p1\regress\unittests\sshsig\testdata\ecdsa EXT:  TYPE: Certificate PEM SIZE: 227 MD5: 53f2aa69e4e8d05ea1c0848c4a946b71 SHA1: 69a4f47fbbb55eb5dea9adea057509384a32bb69 SHA256: 585957bd0a19fcff2d22cd8af7ffb13b68cc30c9dc13dfefb57271b03f3a999f FIRSTBYTES: 2d2d2d2d2d424547494e20454320505249564154 / -----BEGIN EC PRIVAT CREATED: Thu Aug 29 15:37:24.281 2024 MODIFIED: Tue Mar  2 10:31:47.000 2021 ACCESSED: Tue May 14 16:11:16.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x48\x63\x43\x41\x51\x45\x45\x49\x46\x67\x30\x5a\x43\x53\x45\x42\x35\x4c\x4e\x65\x4c\x73\x58\x59\x4c\x32\x35\x67\x33\x6b\x71\x45\x57\x73\x71\x68\x35\x32\x44\x52\x2b\x79\x4e\x4f\x6a\x79\x51\x4a\x71\x79" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:08 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.5p1\regress\unittests\sshsig\testdata\ecdsa_sk EXT:  TYPE: Certificate PEM SIZE: 837 MD5: 36948c6f96600caa24052b4d8322cbd9 SHA1: b7bf9e701f8da5d50f61064849d052e04fb77c3f SHA256: f81b969ccd3e85f02b71465ba38fb51b5adf6f11b09f2e9e82ed6b2ab31f2356 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Thu Aug 29 15:37:24.283 2024 MODIFIED: Tue Mar  2 10:31:47.000 2021 ACCESSED: Tue May 14 16:11:29.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x66\x77\x41\x41\x41\x43\x4a\x7a\x61\x79\x31\x6c\x59\x32\x0a\x52\x7a\x59\x53\x31\x7a\x61\x47\x45\x79" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:08 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.5p1\regress\unittests\sshsig\testdata\ed25519 EXT:  TYPE: Certificate PEM SIZE: 411 MD5: 8bb197113a031c8f6d76de369316d0eb SHA1: 40847760b4f753f2b17156d3f6f9cdcc7c0b91d4 SHA256: c4683c666d6394fc5e8f3455b5379304979e0b41502560ddef20c824fa9fb66b FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Thu Aug 29 15:37:24.290 2024 MODIFIED: Tue Mar  2 10:31:47.000 2021 ACCESSED: Tue May 14 16:11:50.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:08 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.5p1\regress\unittests\sshsig\testdata\ed25519_sk EXT:  TYPE: Certificate PEM SIZE: 484 MD5: 85bc2e18e08c06aa85cf023e7a97a585 SHA1: 95ea85c4709baf47e7cc2573ceac480cc35bde67 SHA256: 0e2221a7c8e8cea4fb6e9d2666b1d05166a3b0f5876c54433f0c35b564f22025 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Thu Aug 29 15:37:24.292 2024 MODIFIED: Tue Mar  2 10:31:47.000 2021 ACCESSED: Tue May 14 16:12:02.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x53\x67\x41\x41\x41\x42\x70\x7a\x61\x79\x31\x7a\x63\x32\x0a\x67\x74\x5a\x57\x51\x79\x4e\x54\x55\x78" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:08 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.5p1\regress\unittests\sshsig\testdata\rsa EXT:  TYPE: Certificate PEM SIZE: 2455 MD5: efe804ccdc63abc29233f3a1e11e173b SHA1: 481c1773197aabc2d9d87336ad84f44410251ed4 SHA256: d7eb37f534b846bb582bcdcf78232bdb33932e34fb72d6bfa130a8fd699b10b6 FIRSTBYTES: 2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA CREATED: Thu Aug 29 15:37:24.294 2024 MODIFIED: Tue Mar  2 10:31:47.000 2021 ACCESSED: Tue May 14 16:12:19.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x47\x34\x77\x49\x42\x41\x41\x4b\x43\x41\x59\x45\x41\x33\x38\x36\x6c\x6d\x6a\x52\x48\x74\x4a\x70\x79\x6a\x38\x37\x42\x72\x53\x2b\x73\x73\x4d\x6d\x74\x76\x63\x2f\x31\x53\x50\x4e\x30\x67\x58\x54\x50\x73" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:12 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.8p1\regress\ed25519_openssh.prv EXT: .prv TYPE: Certificate PEM SIZE: 419 MD5: c1d6034878b590c80805ad1e66039091 SHA1: 9127798b0fadd4539c81ee4f294287e8262eddb0 SHA256: 11bab46497954bd367ea5c2541cb3bad4814515481aee687fcdddc5680ee642d FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Thu Aug 29 15:37:25.452 2024 MODIFIED: Sun Sep 26 14:03:19.000 2021 ACCESSED: Tue May 14 16:18:04.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:12 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.8p1\regress\rsa_openssh.prv EXT: .prv TYPE: Certificate PEM SIZE: 883 MD5: a6b110f820948e73bbde7b948744b3c5 SHA1: 614e6d353be614ded246a12ed6e14af20f063710 SHA256: 79b8783d0b10a3f65b9b3e349a1daa692cc27be08028131ff5a9a08799035f46 FIRSTBYTES: 2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA CREATED: Thu Aug 29 15:37:25.532 2024 MODIFIED: Sun Sep 26 14:03:19.000 2021 ACCESSED: Tue May 14 16:24:55.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x43\x57\x67\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x73\x69\x6c\x77\x4b\x63\x61\x4b\x4e\x36\x77\x53\x4d\x4e\x64\x31\x57\x67\x51\x39\x2b\x48\x52\x71\x51\x45\x6b\x44\x30\x6b\x43\x54\x56\x74\x74\x72\x61\x7a" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:13 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.8p1\regress\misc\fuzz-harness\testdata\id_dsa EXT:  TYPE: Certificate PEM SIZE: 1361 MD5: a9521c2825fbf778b6b82b1dcda95d72 SHA1: 29bc6d9b491473450487aad65a659675154b8fb8 SHA256: a6fa247970fe3fe15b9647e9ae301495d10ea278dbe9516abdf70e69b1849744 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Thu Aug 29 15:37:25.506 2024 MODIFIED: Sun Sep 26 14:03:19.000 2021 ACCESSED: Tue May 14 16:21:47.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x42\x73\x67\x41\x41\x41\x41\x64\x7a\x63\x32\x67\x74\x5a\x48\x0a\x4e\x7a\x41\x41\x41\x41\x67\x51\x43\x73" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:13 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.8p1\regress\misc\fuzz-harness\testdata\id_ecdsa EXT:  TYPE: Certificate PEM SIZE: 492 MD5: b14d14c4a2eb3a89c43be1d828fe2604 SHA1: 56c94a39972cc4c2ab982f6b206702cf3b558bde SHA256: 00120fd3e06a2c9a2debabe94c75cb9a8fb313d17b3a114dda6264874ae56c60 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Thu Aug 29 15:37:25.508 2024 MODIFIED: Sun Sep 26 14:03:19.000 2021 ACCESSED: Tue May 14 16:22:01.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x61\x41\x41\x41\x41\x42\x4e\x6c\x59\x32\x52\x7a\x59\x53\x0a\x31\x7a\x61\x47\x45\x79\x4c\x57\x35\x70" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:13 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.8p1\regress\misc\fuzz-harness\testdata\id_ecdsa_sk EXT:  TYPE: Certificate PEM SIZE: 858 MD5: c87bc24fa8b257e7af7374511f44d2c5 SHA1: 2c1d6e64ad0052837b53739841f6acfc60a191ed SHA256: 50e6649901ffdf7bc4d85dd0f45937b9d99bdd85e472c112f8586bd3e35beb58 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Thu Aug 29 15:37:25.512 2024 MODIFIED: Sun Sep 26 14:03:19.000 2021 ACCESSED: Tue May 14 16:22:14.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x66\x77\x41\x41\x41\x43\x4a\x7a\x61\x79\x31\x6c\x59\x32\x0a\x52\x7a\x59\x53\x31\x7a\x61\x47\x45\x79" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:13 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.8p1\regress\misc\fuzz-harness\testdata\id_ed25519 EXT:  TYPE: Certificate PEM SIZE: 387 MD5: 904e0a369a7fbe86bcb4e0bc1363c539 SHA1: 1074da4383390925d414ad562a0818a88e116208 SHA256: 6efecdbb70364afc9cf004e325a9a1d2673d86e85a6238e1126d6d105cea56c1 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Thu Aug 29 15:37:25.513 2024 MODIFIED: Sun Sep 26 14:03:19.000 2021 ACCESSED: Tue May 14 16:22:27.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:13 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.8p1\regress\misc\fuzz-harness\testdata\id_ed25519_sk EXT:  TYPE: Certificate PEM SIZE: 496 MD5: c3c7cad31e9edf76f806848501011568 SHA1: f936a6c0f3b1250ef7fd0cbf4ea5a5d3c9c63507 SHA256: 5fd315701b14a13467331e1d0819a8016abdf5888ab695f068fce488bd37169d FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Thu Aug 29 15:37:25.515 2024 MODIFIED: Sun Sep 26 14:03:19.000 2021 ACCESSED: Tue May 14 16:22:39.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x53\x67\x41\x41\x41\x42\x70\x7a\x61\x79\x31\x7a\x63\x32\x0a\x67\x74\x5a\x57\x51\x79\x4e\x54\x55\x78" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:13 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.8p1\regress\misc\fuzz-harness\testdata\id_rsa EXT:  TYPE: Certificate PEM SIZE: 1799 MD5: 0e4d9d0e310d6dc6a5c2d33660f70542 SHA1: 7bef427ad9067a465009d543787063fdaceef3e5 SHA256: 83822e39fb2ee059431a45c3c48cffcda3fb869273a364a45898ce9abad09e84 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Thu Aug 29 15:37:25.517 2024 MODIFIED: Sun Sep 26 14:03:19.000 2021 ACCESSED: Tue May 14 16:22:52.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x42\x46\x77\x41\x41\x41\x41\x64\x7a\x63\x32\x67\x74\x63\x6e\x0a\x4e\x68\x41\x41\x41\x41\x41\x77\x45\x41" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:13 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.8p1\regress\unittests\sshkey\testdata\dsa_1 EXT:  TYPE: Certificate PEM SIZE: 672 MD5: aebcad00ac7fb84f1a7de01322c99be3 SHA1: a9a0e1cf84bee8c27802295819b399833e5d4d08 SHA256: b7f7c2bb695b28e585951a2da4ad2d6c933c440afe118798c6e2363e17da2b93 FIRSTBYTES: 2d2d2d2d2d424547494e20445341205052495641 / -----BEGIN DSA PRIVA CREATED: Thu Aug 29 15:37:25.698 2024 MODIFIED: Sun Sep 26 14:03:19.000 2021 ACCESSED: Tue May 14 16:19:01.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x44\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x42\x76\x41\x49\x42\x41\x41\x4b\x42\x67\x51" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x44\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x42\x76\x41\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x36\x6b\x75\x74\x4e\x46\x52\x73\x48\x54\x77\x45\x41\x76\x36\x64\x33\x39\x4c\x68\x73\x71\x79\x31\x61\x70\x64\x48\x42\x5a\x39\x63\x32\x48\x66\x79\x52\x72\x37\x57\x6d\x79\x70\x79\x47\x49\x79\x32\x6d" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:14 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.8p1\regress\unittests\sshkey\testdata\dsa_n EXT:  TYPE: Certificate PEM SIZE: 1361 MD5: 6fcf088f9850b2f2213186cee4dc4811 SHA1: a04d604886c6a7c2217df9b7eea5c998da91d561 SHA256: db691de6aa454ec8aa45c84c58022a54611427f6f44c20d152ac05e0ea2284ba FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Thu Aug 29 15:37:25.708 2024 MODIFIED: Sun Sep 26 14:03:19.000 2021 ACCESSED: Tue May 14 16:20:07.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x42\x73\x77\x41\x41\x41\x41\x64\x7a\x63\x32\x67\x74\x5a\x48\x0a\x4e\x7a\x41\x41\x41\x41\x67\x51\x44\x36" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:14 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.8p1\regress\unittests\sshkey\testdata\ecdsa_1 EXT:  TYPE: Certificate PEM SIZE: 227 MD5: 610b43e1fd8e09f2794aba398c6950eb SHA1: c7e5b5ff84b30ff8880e4d75942a600d012516b6 SHA256: 42a90746ef5975c6ef98c6d56305dad0bc698a1b05c83518bc90584c83935d5c FIRSTBYTES: 2d2d2d2d2d424547494e20454320505249564154 / -----BEGIN EC PRIVAT CREATED: Thu Aug 29 15:37:25.709 2024 MODIFIED: Sun Sep 26 14:03:19.000 2021 ACCESSED: Tue May 14 16:20:17.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x48\x63\x43\x41\x51\x45\x45\x49\x50\x50\x4e\x79\x55\x41\x6e\x6a\x76\x46\x72\x2b\x65\x54\x2f\x37\x74\x2f\x49\x79\x6a\x75\x51\x51\x64\x2f\x61\x4c\x46\x69\x54\x59\x39\x32\x4c\x42\x39\x67\x49\x6a\x79\x72" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:14 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.8p1\regress\unittests\sshkey\testdata\ecdsa_2 EXT:  TYPE: Certificate PEM SIZE: 365 MD5: 0346ad9a21f23d98cb3abe4845df078d SHA1: 07091af93e22c676e03e6f96e9d0e53c9b53d775 SHA256: 320396e36bd5ecc12089f26849f8e7b6e0ab3c037f0492dee978cef6646d5826 FIRSTBYTES: 2d2d2d2d2d424547494e20454320505249564154 / -----BEGIN EC PRIVAT CREATED: Thu Aug 29 15:37:25.713 2024 MODIFIED: Sun Sep 26 14:03:19.000 2021 ACCESSED: Tue May 14 16:21:01.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x48\x63\x41\x67\x45\x42\x42\x45\x49\x42\x71\x42\x74\x4e\x37\x65\x36\x45\x73\x73\x64\x33\x64\x6c\x73\x67\x49\x53\x56\x69\x50\x43\x58\x58\x43\x30\x61\x74\x6c\x4e\x6b\x47\x74\x6f\x4d\x67\x53\x51\x64" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:14 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.8p1\regress\unittests\sshkey\testdata\ecdsa_n EXT:  TYPE: Certificate PEM SIZE: 492 MD5: 0ffc5b7197ecb4b69f503d4f3cc24c8c SHA1: c2c7fd9527d9cc84781346a3ac8e2100d4d20ad3 SHA256: 1cccaa23aca49238099494fc7b49b550311719c9ac6bb138797e1077f4d7973d FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Thu Aug 29 15:37:25.720 2024 MODIFIED: Sun Sep 26 14:03:19.000 2021 ACCESSED: Tue May 14 16:21:32.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x61\x41\x41\x41\x41\x42\x4e\x6c\x59\x32\x52\x7a\x59\x53\x0a\x31\x7a\x61\x47\x45\x79\x4c\x57\x35\x70" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:14 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.8p1\regress\unittests\sshkey\testdata\ecdsa_sk1 EXT:  TYPE: Certificate PEM SIZE: 849 MD5: 97206cfa158fdda5a45c6eb542f739c0 SHA1: e55ec614db8cea92d7269d5f903cf72baca36454 SHA256: e4df7ea4ca133a7457069be073203c556166c65635ed6fb6c12b9a84f027346e FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Thu Aug 29 15:37:25.721 2024 MODIFIED: Sun Sep 26 14:03:19.000 2021 ACCESSED: Tue May 14 16:21:40.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x66\x77\x41\x41\x41\x43\x4a\x7a\x61\x79\x31\x6c\x59\x32\x0a\x52\x7a\x59\x53\x31\x7a\x61\x47\x45\x79" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:14 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.8p1\regress\unittests\sshkey\testdata\ecdsa_sk2 EXT:  TYPE: Certificate PEM SIZE: 849 MD5: 14ecb7595ee296b15d413ae395454a4c SHA1: 909379299593aeebc79f44df0ec22578123acce7 SHA256: de6f60d862f799ca088bd4611865e24bb0635d81097bb9496f0178aefa4acbae FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Thu Aug 29 15:37:25.725 2024 MODIFIED: Sun Sep 26 14:03:19.000 2021 ACCESSED: Tue May 14 16:22:10.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x66\x77\x41\x41\x41\x43\x4a\x7a\x61\x79\x31\x6c\x59\x32\x0a\x52\x7a\x59\x53\x31\x7a\x61\x47\x45\x79" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:14 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.8p1\regress\unittests\sshkey\testdata\ed25519_1 EXT:  TYPE: Certificate PEM SIZE: 411 MD5: 514e8e39c48edb2b8934ef78a5030042 SHA1: a7a368a6f3d09bc2cfc1315f6e0899bde0574ffd SHA256: 74f95c1990e3512af471cf6fb58d08a8078bbab597e7ee86a7ccd233f6855fd1 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Thu Aug 29 15:37:25.727 2024 MODIFIED: Sun Sep 26 14:03:19.000 2021 ACCESSED: Tue May 14 16:22:27.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:14 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.8p1\regress\unittests\sshkey\testdata\ed25519_2 EXT:  TYPE: Certificate PEM SIZE: 411 MD5: bfc2ac8495dbc6070241303ec50a6dc2 SHA1: 53e388e7c836c6ba874e852d71a6e1e708611d25 SHA256: 31689f4706b3bdad29ee21b05af62e9f2257399d07092089944514ed5edb131d FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Thu Aug 29 15:37:25.732 2024 MODIFIED: Sun Sep 26 14:03:19.000 2021 ACCESSED: Tue May 14 16:22:58.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:14 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.8p1\regress\unittests\sshkey\testdata\ed25519_sk1 EXT:  TYPE: Certificate PEM SIZE: 484 MD5: ab9dcdbff00763217a3f85069a9c2f67 SHA1: 05396ad046c37370093f48c0bdb2510b8894aa76 SHA256: 45c058d08280c4ca36a9d020478504cd550e7c5752c207d182363c3edf669ce8 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Thu Aug 29 15:37:25.784 2024 MODIFIED: Sun Sep 26 14:03:19.000 2021 ACCESSED: Tue May 14 16:23:17.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x53\x67\x41\x41\x41\x42\x70\x7a\x61\x79\x31\x7a\x63\x32\x0a\x67\x74\x5a\x57\x51\x79\x4e\x54\x55\x78" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:14 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.8p1\regress\unittests\sshkey\testdata\ed25519_sk2 EXT:  TYPE: Certificate PEM SIZE: 484 MD5: 8a666562de41f71d57d47c5f6404293a SHA1: 069c9341d4b0cd94669ff23feab92853b6a42540 SHA256: b862e169114ee63ae5e8497110075a9e67c4e3f24bad01e7c06951d268a3ec0f FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Thu Aug 29 15:37:25.790 2024 MODIFIED: Sun Sep 26 14:03:19.000 2021 ACCESSED: Tue May 14 16:23:49.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x53\x67\x41\x41\x41\x42\x70\x7a\x61\x79\x31\x7a\x63\x32\x0a\x67\x74\x5a\x57\x51\x79\x4e\x54\x55\x78" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:14 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.8p1\regress\unittests\sshkey\testdata\rsa_1 EXT:  TYPE: Certificate PEM SIZE: 887 MD5: 197f14927e89c5c573213416bde709cb SHA1: 2f5cfafbddd00c351ce72e2f140458fb5ac7b60a SHA256: 07586a53bef4dd9daf59c473399fca5fcb39891bed0d2c2f8a88249e02392ac5 FIRSTBYTES: 2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA CREATED: Thu Aug 29 15:37:25.794 2024 MODIFIED: Sun Sep 26 14:03:19.000 2021 ACCESSED: Tue May 14 16:24:15.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x43\x58\x41\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x4c\x56\x35\x6c\x55\x54\x74\x37\x46\x72\x41\x44\x73\x65\x42\x2f\x43\x47\x68\x45\x5a\x7a\x70\x6f\x6f\x6a\x6a\x45\x57\x35\x79\x38\x2b\x65\x50\x76\x4c\x70" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:14 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.8p1\regress\unittests\sshkey\testdata\rsa_1_sha1 EXT:  TYPE: Certificate PEM SIZE: 887 MD5: 197f14927e89c5c573213416bde709cb SHA1: 2f5cfafbddd00c351ce72e2f140458fb5ac7b60a SHA256: 07586a53bef4dd9daf59c473399fca5fcb39891bed0d2c2f8a88249e02392ac5 FIRSTBYTES: 2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA CREATED: Thu Aug 29 15:37:25.801 2024 MODIFIED: Sun Sep 26 14:03:19.000 2021 ACCESSED: Tue May 14 16:25:04.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x43\x58\x41\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x4c\x56\x35\x6c\x55\x54\x74\x37\x46\x72\x41\x44\x73\x65\x42\x2f\x43\x47\x68\x45\x5a\x7a\x70\x6f\x6f\x6a\x6a\x45\x57\x35\x79\x38\x2b\x65\x50\x76\x4c\x70" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:14 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.8p1\regress\unittests\sshkey\testdata\rsa_1_sha512 EXT:  TYPE: Certificate PEM SIZE: 887 MD5: 197f14927e89c5c573213416bde709cb SHA1: 2f5cfafbddd00c351ce72e2f140458fb5ac7b60a SHA256: 07586a53bef4dd9daf59c473399fca5fcb39891bed0d2c2f8a88249e02392ac5 FIRSTBYTES: 2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA CREATED: Thu Aug 29 15:37:25.803 2024 MODIFIED: Sun Sep 26 14:03:19.000 2021 ACCESSED: Tue May 14 16:25:17.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x43\x58\x41\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x4c\x56\x35\x6c\x55\x54\x74\x37\x46\x72\x41\x44\x73\x65\x42\x2f\x43\x47\x68\x45\x5a\x7a\x70\x6f\x6f\x6a\x6a\x45\x57\x35\x79\x38\x2b\x65\x50\x76\x4c\x70" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:14 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.8p1\regress\unittests\sshkey\testdata\rsa_2 EXT:  TYPE: Certificate PEM SIZE: 1679 MD5: c8860a2d208d222eade1e9866449ccbc SHA1: 64133ddc79d593e467c864c429e3793c69e4dc22 SHA256: e42925e663a7215e19cdc89bd9fe018903eeb013f131b188d3c87f0ef01c5a24 FIRSTBYTES: 2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA CREATED: Thu Aug 29 15:37:25.806 2024 MODIFIED: Sun Sep 26 14:03:19.000 2021 ACCESSED: Tue May 14 16:25:31.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x45\x70\x41\x49\x42\x41\x41\x4b\x43\x41\x51\x45\x41\x39\x4e\x45\x55\x58\x70\x37\x38\x53\x41\x6b\x6d\x4c\x34\x2b\x65\x41\x6a\x34\x6d\x42\x7a\x50\x4f\x6a\x6b\x2b\x63\x63\x43\x50\x56\x7a\x6b\x54\x52\x2b" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:14 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.8p1\regress\unittests\sshkey\testdata\rsa_n EXT:  TYPE: Certificate PEM SIZE: 1020 MD5: d60f55c106077131ba136f02e9b9ba88 SHA1: d6a3a8961cb40e8a4ff03dbfd5983c9fc5dfeb39 SHA256: 0ad47d17d5f21f350c26c4c94564bf41b6fd28ab55187166b4f46b1b35daed6d FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Thu Aug 29 15:37:25.810 2024 MODIFIED: Sun Sep 26 14:03:19.000 2021 ACCESSED: Tue May 14 16:09:21.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x6c\x77\x41\x41\x41\x41\x64\x7a\x63\x32\x67\x74\x63\x6e\x0a\x4e\x68\x41\x41\x41\x41\x41\x77\x45\x41" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:14 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.8p1\regress\unittests\sshsig\testdata\ecdsa EXT:  TYPE: Certificate PEM SIZE: 227 MD5: 53f2aa69e4e8d05ea1c0848c4a946b71 SHA1: 69a4f47fbbb55eb5dea9adea057509384a32bb69 SHA256: 585957bd0a19fcff2d22cd8af7ffb13b68cc30c9dc13dfefb57271b03f3a999f FIRSTBYTES: 2d2d2d2d2d424547494e20454320505249564154 / -----BEGIN EC PRIVAT CREATED: Thu Aug 29 15:37:25.868 2024 MODIFIED: Sun Sep 26 14:03:19.000 2021 ACCESSED: Tue May 14 16:10:02.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x48\x63\x43\x41\x51\x45\x45\x49\x46\x67\x30\x5a\x43\x53\x45\x42\x35\x4c\x4e\x65\x4c\x73\x58\x59\x4c\x32\x35\x67\x33\x6b\x71\x45\x57\x73\x71\x68\x35\x32\x44\x52\x2b\x79\x4e\x4f\x6a\x79\x51\x4a\x71\x79" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:14 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.8p1\regress\unittests\sshsig\testdata\ecdsa_sk EXT:  TYPE: Certificate PEM SIZE: 837 MD5: 36948c6f96600caa24052b4d8322cbd9 SHA1: b7bf9e701f8da5d50f61064849d052e04fb77c3f SHA256: f81b969ccd3e85f02b71465ba38fb51b5adf6f11b09f2e9e82ed6b2ab31f2356 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Thu Aug 29 15:37:25.871 2024 MODIFIED: Sun Sep 26 14:03:19.000 2021 ACCESSED: Tue May 14 16:10:18.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x66\x77\x41\x41\x41\x43\x4a\x7a\x61\x79\x31\x6c\x59\x32\x0a\x52\x7a\x59\x53\x31\x7a\x61\x47\x45\x79" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:14 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.8p1\regress\unittests\sshsig\testdata\ed25519 EXT:  TYPE: Certificate PEM SIZE: 411 MD5: 8bb197113a031c8f6d76de369316d0eb SHA1: 40847760b4f753f2b17156d3f6f9cdcc7c0b91d4 SHA256: c4683c666d6394fc5e8f3455b5379304979e0b41502560ddef20c824fa9fb66b FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Thu Aug 29 15:37:25.875 2024 MODIFIED: Sun Sep 26 14:03:19.000 2021 ACCESSED: Tue May 14 16:10:40.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:14 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.8p1\regress\unittests\sshsig\testdata\ed25519_sk EXT:  TYPE: Certificate PEM SIZE: 484 MD5: 85bc2e18e08c06aa85cf023e7a97a585 SHA1: 95ea85c4709baf47e7cc2573ceac480cc35bde67 SHA256: 0e2221a7c8e8cea4fb6e9d2666b1d05166a3b0f5876c54433f0c35b564f22025 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Thu Aug 29 15:37:25.877 2024 MODIFIED: Sun Sep 26 14:03:19.000 2021 ACCESSED: Tue May 14 16:10:52.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x53\x67\x41\x41\x41\x42\x70\x7a\x61\x79\x31\x7a\x63\x32\x0a\x67\x74\x5a\x57\x51\x79\x4e\x54\x55\x78" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:14 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.8p1\regress\unittests\sshsig\testdata\rsa EXT:  TYPE: Certificate PEM SIZE: 2455 MD5: efe804ccdc63abc29233f3a1e11e173b SHA1: 481c1773197aabc2d9d87336ad84f44410251ed4 SHA256: d7eb37f534b846bb582bcdcf78232bdb33932e34fb72d6bfa130a8fd699b10b6 FIRSTBYTES: 2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA CREATED: Thu Aug 29 15:37:25.880 2024 MODIFIED: Sun Sep 26 14:03:19.000 2021 ACCESSED: Tue May 14 16:11:09.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x47\x34\x77\x49\x42\x41\x41\x4b\x43\x41\x59\x45\x41\x33\x38\x36\x6c\x6d\x6a\x52\x48\x74\x4a\x70\x79\x6a\x38\x37\x42\x72\x53\x2b\x73\x73\x4d\x6d\x74\x76\x63\x2f\x31\x53\x50\x4e\x30\x67\x58\x54\x50\x73" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:16 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\misc\fuzz-harness\testdata\id_dsa EXT:  TYPE: Certificate PEM SIZE: 1361 MD5: a9521c2825fbf778b6b82b1dcda95d72 SHA1: 29bc6d9b491473450487aad65a659675154b8fb8 SHA256: a6fa247970fe3fe15b9647e9ae301495d10ea278dbe9516abdf70e69b1849744 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Tue Mar  2 10:31:47.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1779733 ARCHIVE_MD5: 9eb9420cf587edc26f8998ab679ad390 ARCHIVE_SHA1: 72eadcbe313b07b1dd3b693e41d3cd56d354e24e ARCHIVE_SHA256: f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbde976db48962e5a7f / vH.Z ARCHIVE_CREATED: Thu Aug 29 15:37:22.848 2024 ARCHIVE_MODIFIED: Tue Oct 19 13:53:34.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:13:50.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x42\x73\x67\x41\x41\x41\x41\x64\x7a\x63\x32\x67\x74\x5a\x48\x0a\x4e\x7a\x41\x41\x41\x41\x67\x51\x43\x73" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:16 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\misc\fuzz-harness\testdata\id_ecdsa EXT:  TYPE: Certificate PEM SIZE: 492 MD5: b14d14c4a2eb3a89c43be1d828fe2604 SHA1: 56c94a39972cc4c2ab982f6b206702cf3b558bde SHA256: 00120fd3e06a2c9a2debabe94c75cb9a8fb313d17b3a114dda6264874ae56c60 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Tue Mar  2 10:31:47.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1779733 ARCHIVE_MD5: 9eb9420cf587edc26f8998ab679ad390 ARCHIVE_SHA1: 72eadcbe313b07b1dd3b693e41d3cd56d354e24e ARCHIVE_SHA256: f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbde976db48962e5a7f / vH.Z ARCHIVE_CREATED: Thu Aug 29 15:37:22.848 2024 ARCHIVE_MODIFIED: Tue Oct 19 13:53:34.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:13:50.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x61\x41\x41\x41\x41\x42\x4e\x6c\x59\x32\x52\x7a\x59\x53\x0a\x31\x7a\x61\x47\x45\x79\x4c\x57\x35\x70" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:16 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\misc\fuzz-harness\testdata\id_ecdsa_sk EXT:  TYPE: Certificate PEM SIZE: 858 MD5: c87bc24fa8b257e7af7374511f44d2c5 SHA1: 2c1d6e64ad0052837b53739841f6acfc60a191ed SHA256: 50e6649901ffdf7bc4d85dd0f45937b9d99bdd85e472c112f8586bd3e35beb58 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Tue Mar  2 10:31:47.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1779733 ARCHIVE_MD5: 9eb9420cf587edc26f8998ab679ad390 ARCHIVE_SHA1: 72eadcbe313b07b1dd3b693e41d3cd56d354e24e ARCHIVE_SHA256: f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbde976db48962e5a7f / vH.Z ARCHIVE_CREATED: Thu Aug 29 15:37:22.848 2024 ARCHIVE_MODIFIED: Tue Oct 19 13:53:34.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:13:50.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x66\x77\x41\x41\x41\x43\x4a\x7a\x61\x79\x31\x6c\x59\x32\x0a\x52\x7a\x59\x53\x31\x7a\x61\x47\x45\x79" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:16 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\misc\fuzz-harness\testdata\id_ed25519 EXT:  TYPE: Certificate PEM SIZE: 387 MD5: 904e0a369a7fbe86bcb4e0bc1363c539 SHA1: 1074da4383390925d414ad562a0818a88e116208 SHA256: 6efecdbb70364afc9cf004e325a9a1d2673d86e85a6238e1126d6d105cea56c1 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Tue Mar  2 10:31:47.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1779733 ARCHIVE_MD5: 9eb9420cf587edc26f8998ab679ad390 ARCHIVE_SHA1: 72eadcbe313b07b1dd3b693e41d3cd56d354e24e ARCHIVE_SHA256: f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbde976db48962e5a7f / vH.Z ARCHIVE_CREATED: Thu Aug 29 15:37:22.848 2024 ARCHIVE_MODIFIED: Tue Oct 19 13:53:34.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:13:50.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:16 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\misc\fuzz-harness\testdata\id_ed25519_sk EXT:  TYPE: Certificate PEM SIZE: 496 MD5: c3c7cad31e9edf76f806848501011568 SHA1: f936a6c0f3b1250ef7fd0cbf4ea5a5d3c9c63507 SHA256: 5fd315701b14a13467331e1d0819a8016abdf5888ab695f068fce488bd37169d FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Tue Mar  2 10:31:47.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1779733 ARCHIVE_MD5: 9eb9420cf587edc26f8998ab679ad390 ARCHIVE_SHA1: 72eadcbe313b07b1dd3b693e41d3cd56d354e24e ARCHIVE_SHA256: f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbde976db48962e5a7f / vH.Z ARCHIVE_CREATED: Thu Aug 29 15:37:22.848 2024 ARCHIVE_MODIFIED: Tue Oct 19 13:53:34.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:13:50.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x53\x67\x41\x41\x41\x42\x70\x7a\x61\x79\x31\x7a\x63\x32\x0a\x67\x74\x5a\x57\x51\x79\x4e\x54\x55\x78" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:16 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\misc\fuzz-harness\testdata\id_rsa EXT:  TYPE: Certificate PEM SIZE: 1799 MD5: 0e4d9d0e310d6dc6a5c2d33660f70542 SHA1: 7bef427ad9067a465009d543787063fdaceef3e5 SHA256: 83822e39fb2ee059431a45c3c48cffcda3fb869273a364a45898ce9abad09e84 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Tue Mar  2 10:31:47.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1779733 ARCHIVE_MD5: 9eb9420cf587edc26f8998ab679ad390 ARCHIVE_SHA1: 72eadcbe313b07b1dd3b693e41d3cd56d354e24e ARCHIVE_SHA256: f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbde976db48962e5a7f / vH.Z ARCHIVE_CREATED: Thu Aug 29 15:37:22.848 2024 ARCHIVE_MODIFIED: Tue Oct 19 13:53:34.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:13:50.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x42\x46\x77\x41\x41\x41\x41\x64\x7a\x63\x32\x67\x74\x63\x6e\x0a\x4e\x68\x41\x41\x41\x41\x41\x77\x45\x41" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:16 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\rsa_openssh.prv EXT: .prv TYPE: Certificate PEM SIZE: 883 MD5: a6b110f820948e73bbde7b948744b3c5 SHA1: 614e6d353be614ded246a12ed6e14af20f063710 SHA256: 79b8783d0b10a3f65b9b3e349a1daa692cc27be08028131ff5a9a08799035f46 FIRSTBYTES: 2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA MODIFIED: Tue Mar  2 10:31:47.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1779733 ARCHIVE_MD5: 9eb9420cf587edc26f8998ab679ad390 ARCHIVE_SHA1: 72eadcbe313b07b1dd3b693e41d3cd56d354e24e ARCHIVE_SHA256: f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbde976db48962e5a7f / vH.Z ARCHIVE_CREATED: Thu Aug 29 15:37:22.848 2024 ARCHIVE_MODIFIED: Tue Oct 19 13:53:34.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:13:50.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x43\x57\x67\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x73\x69\x6c\x77\x4b\x63\x61\x4b\x4e\x36\x77\x53\x4d\x4e\x64\x31\x57\x67\x51\x39\x2b\x48\x52\x71\x51\x45\x6b\x44\x30\x6b\x43\x54\x56\x74\x74\x72\x61\x7a" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:16 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshkey\testdata\dsa_1 EXT:  TYPE: Certificate PEM SIZE: 672 MD5: aebcad00ac7fb84f1a7de01322c99be3 SHA1: a9a0e1cf84bee8c27802295819b399833e5d4d08 SHA256: b7f7c2bb695b28e585951a2da4ad2d6c933c440afe118798c6e2363e17da2b93 FIRSTBYTES: 2d2d2d2d2d424547494e20445341205052495641 / -----BEGIN DSA PRIVA MODIFIED: Tue Mar  2 10:31:47.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1779733 ARCHIVE_MD5: 9eb9420cf587edc26f8998ab679ad390 ARCHIVE_SHA1: 72eadcbe313b07b1dd3b693e41d3cd56d354e24e ARCHIVE_SHA256: f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbde976db48962e5a7f / vH.Z ARCHIVE_CREATED: Thu Aug 29 15:37:22.848 2024 ARCHIVE_MODIFIED: Tue Oct 19 13:53:34.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:13:50.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x44\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x42\x76\x41\x49\x42\x41\x41\x4b\x42\x67\x51" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x44\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x42\x76\x41\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x36\x6b\x75\x74\x4e\x46\x52\x73\x48\x54\x77\x45\x41\x76\x36\x64\x33\x39\x4c\x68\x73\x71\x79\x31\x61\x70\x64\x48\x42\x5a\x39\x63\x32\x48\x66\x79\x52\x72\x37\x57\x6d\x79\x70\x79\x47\x49\x79\x32\x6d" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:16 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshkey\testdata\dsa_n EXT:  TYPE: Certificate PEM SIZE: 1361 MD5: 6fcf088f9850b2f2213186cee4dc4811 SHA1: a04d604886c6a7c2217df9b7eea5c998da91d561 SHA256: db691de6aa454ec8aa45c84c58022a54611427f6f44c20d152ac05e0ea2284ba FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Tue Mar  2 10:31:47.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1779733 ARCHIVE_MD5: 9eb9420cf587edc26f8998ab679ad390 ARCHIVE_SHA1: 72eadcbe313b07b1dd3b693e41d3cd56d354e24e ARCHIVE_SHA256: f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbde976db48962e5a7f / vH.Z ARCHIVE_CREATED: Thu Aug 29 15:37:22.848 2024 ARCHIVE_MODIFIED: Tue Oct 19 13:53:34.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:13:50.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x42\x73\x77\x41\x41\x41\x41\x64\x7a\x63\x32\x67\x74\x5a\x48\x0a\x4e\x7a\x41\x41\x41\x41\x67\x51\x44\x36" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:16 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshkey\testdata\ecdsa_1 EXT:  TYPE: Certificate PEM SIZE: 227 MD5: 610b43e1fd8e09f2794aba398c6950eb SHA1: c7e5b5ff84b30ff8880e4d75942a600d012516b6 SHA256: 42a90746ef5975c6ef98c6d56305dad0bc698a1b05c83518bc90584c83935d5c FIRSTBYTES: 2d2d2d2d2d424547494e20454320505249564154 / -----BEGIN EC PRIVAT MODIFIED: Tue Mar  2 10:31:47.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1779733 ARCHIVE_MD5: 9eb9420cf587edc26f8998ab679ad390 ARCHIVE_SHA1: 72eadcbe313b07b1dd3b693e41d3cd56d354e24e ARCHIVE_SHA256: f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbde976db48962e5a7f / vH.Z ARCHIVE_CREATED: Thu Aug 29 15:37:22.848 2024 ARCHIVE_MODIFIED: Tue Oct 19 13:53:34.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:13:50.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x48\x63\x43\x41\x51\x45\x45\x49\x50\x50\x4e\x79\x55\x41\x6e\x6a\x76\x46\x72\x2b\x65\x54\x2f\x37\x74\x2f\x49\x79\x6a\x75\x51\x51\x64\x2f\x61\x4c\x46\x69\x54\x59\x39\x32\x4c\x42\x39\x67\x49\x6a\x79\x72" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:16 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshkey\testdata\ecdsa_2 EXT:  TYPE: Certificate PEM SIZE: 365 MD5: 0346ad9a21f23d98cb3abe4845df078d SHA1: 07091af93e22c676e03e6f96e9d0e53c9b53d775 SHA256: 320396e36bd5ecc12089f26849f8e7b6e0ab3c037f0492dee978cef6646d5826 FIRSTBYTES: 2d2d2d2d2d424547494e20454320505249564154 / -----BEGIN EC PRIVAT MODIFIED: Tue Mar  2 10:31:47.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1779733 ARCHIVE_MD5: 9eb9420cf587edc26f8998ab679ad390 ARCHIVE_SHA1: 72eadcbe313b07b1dd3b693e41d3cd56d354e24e ARCHIVE_SHA256: f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbde976db48962e5a7f / vH.Z ARCHIVE_CREATED: Thu Aug 29 15:37:22.848 2024 ARCHIVE_MODIFIED: Tue Oct 19 13:53:34.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:13:50.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x48\x63\x41\x67\x45\x42\x42\x45\x49\x42\x71\x42\x74\x4e\x37\x65\x36\x45\x73\x73\x64\x33\x64\x6c\x73\x67\x49\x53\x56\x69\x50\x43\x58\x58\x43\x30\x61\x74\x6c\x4e\x6b\x47\x74\x6f\x4d\x67\x53\x51\x64" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:16 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshkey\testdata\ecdsa_n EXT:  TYPE: Certificate PEM SIZE: 492 MD5: 0ffc5b7197ecb4b69f503d4f3cc24c8c SHA1: c2c7fd9527d9cc84781346a3ac8e2100d4d20ad3 SHA256: 1cccaa23aca49238099494fc7b49b550311719c9ac6bb138797e1077f4d7973d FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Tue Mar  2 10:31:47.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1779733 ARCHIVE_MD5: 9eb9420cf587edc26f8998ab679ad390 ARCHIVE_SHA1: 72eadcbe313b07b1dd3b693e41d3cd56d354e24e ARCHIVE_SHA256: f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbde976db48962e5a7f / vH.Z ARCHIVE_CREATED: Thu Aug 29 15:37:22.848 2024 ARCHIVE_MODIFIED: Tue Oct 19 13:53:34.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:13:50.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x61\x41\x41\x41\x41\x42\x4e\x6c\x59\x32\x52\x7a\x59\x53\x0a\x31\x7a\x61\x47\x45\x79\x4c\x57\x35\x70" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:16 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshkey\testdata\ecdsa_sk1 EXT:  TYPE: Certificate PEM SIZE: 849 MD5: 97206cfa158fdda5a45c6eb542f739c0 SHA1: e55ec614db8cea92d7269d5f903cf72baca36454 SHA256: e4df7ea4ca133a7457069be073203c556166c65635ed6fb6c12b9a84f027346e FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Tue Mar  2 10:31:47.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1779733 ARCHIVE_MD5: 9eb9420cf587edc26f8998ab679ad390 ARCHIVE_SHA1: 72eadcbe313b07b1dd3b693e41d3cd56d354e24e ARCHIVE_SHA256: f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbde976db48962e5a7f / vH.Z ARCHIVE_CREATED: Thu Aug 29 15:37:22.848 2024 ARCHIVE_MODIFIED: Tue Oct 19 13:53:34.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:13:50.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x66\x77\x41\x41\x41\x43\x4a\x7a\x61\x79\x31\x6c\x59\x32\x0a\x52\x7a\x59\x53\x31\x7a\x61\x47\x45\x79" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:16 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshkey\testdata\ecdsa_sk2 EXT:  TYPE: Certificate PEM SIZE: 849 MD5: 14ecb7595ee296b15d413ae395454a4c SHA1: 909379299593aeebc79f44df0ec22578123acce7 SHA256: de6f60d862f799ca088bd4611865e24bb0635d81097bb9496f0178aefa4acbae FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Tue Mar  2 10:31:47.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1779733 ARCHIVE_MD5: 9eb9420cf587edc26f8998ab679ad390 ARCHIVE_SHA1: 72eadcbe313b07b1dd3b693e41d3cd56d354e24e ARCHIVE_SHA256: f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbde976db48962e5a7f / vH.Z ARCHIVE_CREATED: Thu Aug 29 15:37:22.848 2024 ARCHIVE_MODIFIED: Tue Oct 19 13:53:34.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:13:50.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x66\x77\x41\x41\x41\x43\x4a\x7a\x61\x79\x31\x6c\x59\x32\x0a\x52\x7a\x59\x53\x31\x7a\x61\x47\x45\x79" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:16 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshkey\testdata\ed25519_1 EXT:  TYPE: Certificate PEM SIZE: 411 MD5: 514e8e39c48edb2b8934ef78a5030042 SHA1: a7a368a6f3d09bc2cfc1315f6e0899bde0574ffd SHA256: 74f95c1990e3512af471cf6fb58d08a8078bbab597e7ee86a7ccd233f6855fd1 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Tue Mar  2 10:31:47.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1779733 ARCHIVE_MD5: 9eb9420cf587edc26f8998ab679ad390 ARCHIVE_SHA1: 72eadcbe313b07b1dd3b693e41d3cd56d354e24e ARCHIVE_SHA256: f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbde976db48962e5a7f / vH.Z ARCHIVE_CREATED: Thu Aug 29 15:37:22.848 2024 ARCHIVE_MODIFIED: Tue Oct 19 13:53:34.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:13:50.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:16 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshkey\testdata\ed25519_2 EXT:  TYPE: Certificate PEM SIZE: 411 MD5: bfc2ac8495dbc6070241303ec50a6dc2 SHA1: 53e388e7c836c6ba874e852d71a6e1e708611d25 SHA256: 31689f4706b3bdad29ee21b05af62e9f2257399d07092089944514ed5edb131d FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Tue Mar  2 10:31:47.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1779733 ARCHIVE_MD5: 9eb9420cf587edc26f8998ab679ad390 ARCHIVE_SHA1: 72eadcbe313b07b1dd3b693e41d3cd56d354e24e ARCHIVE_SHA256: f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbde976db48962e5a7f / vH.Z ARCHIVE_CREATED: Thu Aug 29 15:37:22.848 2024 ARCHIVE_MODIFIED: Tue Oct 19 13:53:34.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:13:50.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:17 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshkey\testdata\ed25519_sk1 EXT:  TYPE: Certificate PEM SIZE: 484 MD5: ab9dcdbff00763217a3f85069a9c2f67 SHA1: 05396ad046c37370093f48c0bdb2510b8894aa76 SHA256: 45c058d08280c4ca36a9d020478504cd550e7c5752c207d182363c3edf669ce8 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Tue Mar  2 10:31:47.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1779733 ARCHIVE_MD5: 9eb9420cf587edc26f8998ab679ad390 ARCHIVE_SHA1: 72eadcbe313b07b1dd3b693e41d3cd56d354e24e ARCHIVE_SHA256: f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbde976db48962e5a7f / vH.Z ARCHIVE_CREATED: Thu Aug 29 15:37:22.848 2024 ARCHIVE_MODIFIED: Tue Oct 19 13:53:34.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:13:50.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x53\x67\x41\x41\x41\x42\x70\x7a\x61\x79\x31\x7a\x63\x32\x0a\x67\x74\x5a\x57\x51\x79\x4e\x54\x55\x78" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:17 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshkey\testdata\ed25519_sk2 EXT:  TYPE: Certificate PEM SIZE: 484 MD5: 8a666562de41f71d57d47c5f6404293a SHA1: 069c9341d4b0cd94669ff23feab92853b6a42540 SHA256: b862e169114ee63ae5e8497110075a9e67c4e3f24bad01e7c06951d268a3ec0f FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Tue Mar  2 10:31:47.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1779733 ARCHIVE_MD5: 9eb9420cf587edc26f8998ab679ad390 ARCHIVE_SHA1: 72eadcbe313b07b1dd3b693e41d3cd56d354e24e ARCHIVE_SHA256: f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbde976db48962e5a7f / vH.Z ARCHIVE_CREATED: Thu Aug 29 15:37:22.848 2024 ARCHIVE_MODIFIED: Tue Oct 19 13:53:34.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:13:50.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x53\x67\x41\x41\x41\x42\x70\x7a\x61\x79\x31\x7a\x63\x32\x0a\x67\x74\x5a\x57\x51\x79\x4e\x54\x55\x78" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:17 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshkey\testdata\rsa_1 EXT:  TYPE: Certificate PEM SIZE: 887 MD5: 197f14927e89c5c573213416bde709cb SHA1: 2f5cfafbddd00c351ce72e2f140458fb5ac7b60a SHA256: 07586a53bef4dd9daf59c473399fca5fcb39891bed0d2c2f8a88249e02392ac5 FIRSTBYTES: 2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA MODIFIED: Tue Mar  2 10:31:47.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1779733 ARCHIVE_MD5: 9eb9420cf587edc26f8998ab679ad390 ARCHIVE_SHA1: 72eadcbe313b07b1dd3b693e41d3cd56d354e24e ARCHIVE_SHA256: f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbde976db48962e5a7f / vH.Z ARCHIVE_CREATED: Thu Aug 29 15:37:22.848 2024 ARCHIVE_MODIFIED: Tue Oct 19 13:53:34.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:13:50.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x43\x58\x41\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x4c\x56\x35\x6c\x55\x54\x74\x37\x46\x72\x41\x44\x73\x65\x42\x2f\x43\x47\x68\x45\x5a\x7a\x70\x6f\x6f\x6a\x6a\x45\x57\x35\x79\x38\x2b\x65\x50\x76\x4c\x70" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:17 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshkey\testdata\rsa_1_sha1 EXT:  TYPE: Certificate PEM SIZE: 887 MD5: 197f14927e89c5c573213416bde709cb SHA1: 2f5cfafbddd00c351ce72e2f140458fb5ac7b60a SHA256: 07586a53bef4dd9daf59c473399fca5fcb39891bed0d2c2f8a88249e02392ac5 FIRSTBYTES: 2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA MODIFIED: Tue Mar  2 10:31:47.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1779733 ARCHIVE_MD5: 9eb9420cf587edc26f8998ab679ad390 ARCHIVE_SHA1: 72eadcbe313b07b1dd3b693e41d3cd56d354e24e ARCHIVE_SHA256: f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbde976db48962e5a7f / vH.Z ARCHIVE_CREATED: Thu Aug 29 15:37:22.848 2024 ARCHIVE_MODIFIED: Tue Oct 19 13:53:34.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:13:50.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x43\x58\x41\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x4c\x56\x35\x6c\x55\x54\x74\x37\x46\x72\x41\x44\x73\x65\x42\x2f\x43\x47\x68\x45\x5a\x7a\x70\x6f\x6f\x6a\x6a\x45\x57\x35\x79\x38\x2b\x65\x50\x76\x4c\x70" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:17 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshkey\testdata\rsa_1_sha512 EXT:  TYPE: Certificate PEM SIZE: 887 MD5: 197f14927e89c5c573213416bde709cb SHA1: 2f5cfafbddd00c351ce72e2f140458fb5ac7b60a SHA256: 07586a53bef4dd9daf59c473399fca5fcb39891bed0d2c2f8a88249e02392ac5 FIRSTBYTES: 2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA MODIFIED: Tue Mar  2 10:31:47.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1779733 ARCHIVE_MD5: 9eb9420cf587edc26f8998ab679ad390 ARCHIVE_SHA1: 72eadcbe313b07b1dd3b693e41d3cd56d354e24e ARCHIVE_SHA256: f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbde976db48962e5a7f / vH.Z ARCHIVE_CREATED: Thu Aug 29 15:37:22.848 2024 ARCHIVE_MODIFIED: Tue Oct 19 13:53:34.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:13:50.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x43\x58\x41\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x4c\x56\x35\x6c\x55\x54\x74\x37\x46\x72\x41\x44\x73\x65\x42\x2f\x43\x47\x68\x45\x5a\x7a\x70\x6f\x6f\x6a\x6a\x45\x57\x35\x79\x38\x2b\x65\x50\x76\x4c\x70" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:17 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshkey\testdata\rsa_2 EXT:  TYPE: Certificate PEM SIZE: 1679 MD5: c8860a2d208d222eade1e9866449ccbc SHA1: 64133ddc79d593e467c864c429e3793c69e4dc22 SHA256: e42925e663a7215e19cdc89bd9fe018903eeb013f131b188d3c87f0ef01c5a24 FIRSTBYTES: 2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA MODIFIED: Tue Mar  2 10:31:47.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1779733 ARCHIVE_MD5: 9eb9420cf587edc26f8998ab679ad390 ARCHIVE_SHA1: 72eadcbe313b07b1dd3b693e41d3cd56d354e24e ARCHIVE_SHA256: f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbde976db48962e5a7f / vH.Z ARCHIVE_CREATED: Thu Aug 29 15:37:22.848 2024 ARCHIVE_MODIFIED: Tue Oct 19 13:53:34.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:13:50.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x45\x70\x41\x49\x42\x41\x41\x4b\x43\x41\x51\x45\x41\x39\x4e\x45\x55\x58\x70\x37\x38\x53\x41\x6b\x6d\x4c\x34\x2b\x65\x41\x6a\x34\x6d\x42\x7a\x50\x4f\x6a\x6b\x2b\x63\x63\x43\x50\x56\x7a\x6b\x54\x52\x2b" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:17 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshkey\testdata\rsa_n EXT:  TYPE: Certificate PEM SIZE: 1020 MD5: d60f55c106077131ba136f02e9b9ba88 SHA1: d6a3a8961cb40e8a4ff03dbfd5983c9fc5dfeb39 SHA256: 0ad47d17d5f21f350c26c4c94564bf41b6fd28ab55187166b4f46b1b35daed6d FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Tue Mar  2 10:31:47.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1779733 ARCHIVE_MD5: 9eb9420cf587edc26f8998ab679ad390 ARCHIVE_SHA1: 72eadcbe313b07b1dd3b693e41d3cd56d354e24e ARCHIVE_SHA256: f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbde976db48962e5a7f / vH.Z ARCHIVE_CREATED: Thu Aug 29 15:37:22.848 2024 ARCHIVE_MODIFIED: Tue Oct 19 13:53:34.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:13:50.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x6c\x77\x41\x41\x41\x41\x64\x7a\x63\x32\x67\x74\x63\x6e\x0a\x4e\x68\x41\x41\x41\x41\x41\x77\x45\x41" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:17 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshsig\testdata\ecdsa EXT:  TYPE: Certificate PEM SIZE: 227 MD5: 53f2aa69e4e8d05ea1c0848c4a946b71 SHA1: 69a4f47fbbb55eb5dea9adea057509384a32bb69 SHA256: 585957bd0a19fcff2d22cd8af7ffb13b68cc30c9dc13dfefb57271b03f3a999f FIRSTBYTES: 2d2d2d2d2d424547494e20454320505249564154 / -----BEGIN EC PRIVAT MODIFIED: Tue Mar  2 10:31:47.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1779733 ARCHIVE_MD5: 9eb9420cf587edc26f8998ab679ad390 ARCHIVE_SHA1: 72eadcbe313b07b1dd3b693e41d3cd56d354e24e ARCHIVE_SHA256: f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbde976db48962e5a7f / vH.Z ARCHIVE_CREATED: Thu Aug 29 15:37:22.848 2024 ARCHIVE_MODIFIED: Tue Oct 19 13:53:34.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:13:50.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x48\x63\x43\x41\x51\x45\x45\x49\x46\x67\x30\x5a\x43\x53\x45\x42\x35\x4c\x4e\x65\x4c\x73\x58\x59\x4c\x32\x35\x67\x33\x6b\x71\x45\x57\x73\x71\x68\x35\x32\x44\x52\x2b\x79\x4e\x4f\x6a\x79\x51\x4a\x71\x79" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:17 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshsig\testdata\ecdsa_sk EXT:  TYPE: Certificate PEM SIZE: 837 MD5: 36948c6f96600caa24052b4d8322cbd9 SHA1: b7bf9e701f8da5d50f61064849d052e04fb77c3f SHA256: f81b969ccd3e85f02b71465ba38fb51b5adf6f11b09f2e9e82ed6b2ab31f2356 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Tue Mar  2 10:31:47.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1779733 ARCHIVE_MD5: 9eb9420cf587edc26f8998ab679ad390 ARCHIVE_SHA1: 72eadcbe313b07b1dd3b693e41d3cd56d354e24e ARCHIVE_SHA256: f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbde976db48962e5a7f / vH.Z ARCHIVE_CREATED: Thu Aug 29 15:37:22.848 2024 ARCHIVE_MODIFIED: Tue Oct 19 13:53:34.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:13:50.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x66\x77\x41\x41\x41\x43\x4a\x7a\x61\x79\x31\x6c\x59\x32\x0a\x52\x7a\x59\x53\x31\x7a\x61\x47\x45\x79" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:17 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshsig\testdata\ed25519 EXT:  TYPE: Certificate PEM SIZE: 411 MD5: 8bb197113a031c8f6d76de369316d0eb SHA1: 40847760b4f753f2b17156d3f6f9cdcc7c0b91d4 SHA256: c4683c666d6394fc5e8f3455b5379304979e0b41502560ddef20c824fa9fb66b FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Tue Mar  2 10:31:47.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1779733 ARCHIVE_MD5: 9eb9420cf587edc26f8998ab679ad390 ARCHIVE_SHA1: 72eadcbe313b07b1dd3b693e41d3cd56d354e24e ARCHIVE_SHA256: f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbde976db48962e5a7f / vH.Z ARCHIVE_CREATED: Thu Aug 29 15:37:22.848 2024 ARCHIVE_MODIFIED: Tue Oct 19 13:53:34.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:13:50.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:17 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshsig\testdata\ed25519_sk EXT:  TYPE: Certificate PEM SIZE: 484 MD5: 85bc2e18e08c06aa85cf023e7a97a585 SHA1: 95ea85c4709baf47e7cc2573ceac480cc35bde67 SHA256: 0e2221a7c8e8cea4fb6e9d2666b1d05166a3b0f5876c54433f0c35b564f22025 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Tue Mar  2 10:31:47.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1779733 ARCHIVE_MD5: 9eb9420cf587edc26f8998ab679ad390 ARCHIVE_SHA1: 72eadcbe313b07b1dd3b693e41d3cd56d354e24e ARCHIVE_SHA256: f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbde976db48962e5a7f / vH.Z ARCHIVE_CREATED: Thu Aug 29 15:37:22.848 2024 ARCHIVE_MODIFIED: Tue Oct 19 13:53:34.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:13:50.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x53\x67\x41\x41\x41\x42\x70\x7a\x61\x79\x31\x7a\x63\x32\x0a\x67\x74\x5a\x57\x51\x79\x4e\x54\x55\x78" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:17 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshsig\testdata\rsa EXT:  TYPE: Certificate PEM SIZE: 2455 MD5: efe804ccdc63abc29233f3a1e11e173b SHA1: 481c1773197aabc2d9d87336ad84f44410251ed4 SHA256: d7eb37f534b846bb582bcdcf78232bdb33932e34fb72d6bfa130a8fd699b10b6 FIRSTBYTES: 2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA MODIFIED: Tue Mar  2 10:31:47.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1779733 ARCHIVE_MD5: 9eb9420cf587edc26f8998ab679ad390 ARCHIVE_SHA1: 72eadcbe313b07b1dd3b693e41d3cd56d354e24e ARCHIVE_SHA256: f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbde976db48962e5a7f / vH.Z ARCHIVE_CREATED: Thu Aug 29 15:37:22.848 2024 ARCHIVE_MODIFIED: Tue Oct 19 13:53:34.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:13:50.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x47\x34\x77\x49\x42\x41\x41\x4b\x43\x41\x59\x45\x41\x33\x38\x36\x6c\x6d\x6a\x52\x48\x74\x4a\x70\x79\x6a\x38\x37\x42\x72\x53\x2b\x73\x73\x4d\x6d\x74\x76\x63\x2f\x31\x53\x50\x4e\x30\x67\x58\x54\x50\x73" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:18 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\ed25519_openssh.prv EXT: .prv TYPE: Certificate PEM SIZE: 419 MD5: c1d6034878b590c80805ad1e66039091 SHA1: 9127798b0fadd4539c81ee4f294287e8262eddb0 SHA256: 11bab46497954bd367ea5c2541cb3bad4814515481aee687fcdddc5680ee642d FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Sun Sep 26 14:03:19.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1815060 ARCHIVE_MD5: 8ce5f390958baeeab635aafd0ef41453 ARCHIVE_SHA1: 1eb964897a4372f6fb96c7effeb509ec71c379c9 ARCHIVE_SHA256: 4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbdeb76db46b62eda7f / vF. ARCHIVE_CREATED: Thu Aug 29 15:37:22.890 2024 ARCHIVE_MODIFIED: Tue Oct 19 14:06:19.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:25:11.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:18 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\misc\fuzz-harness\testdata\id_dsa EXT:  TYPE: Certificate PEM SIZE: 1361 MD5: a9521c2825fbf778b6b82b1dcda95d72 SHA1: 29bc6d9b491473450487aad65a659675154b8fb8 SHA256: a6fa247970fe3fe15b9647e9ae301495d10ea278dbe9516abdf70e69b1849744 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Sun Sep 26 14:03:19.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1815060 ARCHIVE_MD5: 8ce5f390958baeeab635aafd0ef41453 ARCHIVE_SHA1: 1eb964897a4372f6fb96c7effeb509ec71c379c9 ARCHIVE_SHA256: 4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbdeb76db46b62eda7f / vF. ARCHIVE_CREATED: Thu Aug 29 15:37:22.890 2024 ARCHIVE_MODIFIED: Tue Oct 19 14:06:19.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:25:11.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x42\x73\x67\x41\x41\x41\x41\x64\x7a\x63\x32\x67\x74\x5a\x48\x0a\x4e\x7a\x41\x41\x41\x41\x67\x51\x43\x73" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:18 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\misc\fuzz-harness\testdata\id_ecdsa EXT:  TYPE: Certificate PEM SIZE: 492 MD5: b14d14c4a2eb3a89c43be1d828fe2604 SHA1: 56c94a39972cc4c2ab982f6b206702cf3b558bde SHA256: 00120fd3e06a2c9a2debabe94c75cb9a8fb313d17b3a114dda6264874ae56c60 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Sun Sep 26 14:03:19.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1815060 ARCHIVE_MD5: 8ce5f390958baeeab635aafd0ef41453 ARCHIVE_SHA1: 1eb964897a4372f6fb96c7effeb509ec71c379c9 ARCHIVE_SHA256: 4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbdeb76db46b62eda7f / vF. ARCHIVE_CREATED: Thu Aug 29 15:37:22.890 2024 ARCHIVE_MODIFIED: Tue Oct 19 14:06:19.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:25:11.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x61\x41\x41\x41\x41\x42\x4e\x6c\x59\x32\x52\x7a\x59\x53\x0a\x31\x7a\x61\x47\x45\x79\x4c\x57\x35\x70" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:18 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\misc\fuzz-harness\testdata\id_ecdsa_sk EXT:  TYPE: Certificate PEM SIZE: 858 MD5: c87bc24fa8b257e7af7374511f44d2c5 SHA1: 2c1d6e64ad0052837b53739841f6acfc60a191ed SHA256: 50e6649901ffdf7bc4d85dd0f45937b9d99bdd85e472c112f8586bd3e35beb58 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Sun Sep 26 14:03:19.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1815060 ARCHIVE_MD5: 8ce5f390958baeeab635aafd0ef41453 ARCHIVE_SHA1: 1eb964897a4372f6fb96c7effeb509ec71c379c9 ARCHIVE_SHA256: 4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbdeb76db46b62eda7f / vF. ARCHIVE_CREATED: Thu Aug 29 15:37:22.890 2024 ARCHIVE_MODIFIED: Tue Oct 19 14:06:19.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:25:11.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x66\x77\x41\x41\x41\x43\x4a\x7a\x61\x79\x31\x6c\x59\x32\x0a\x52\x7a\x59\x53\x31\x7a\x61\x47\x45\x79" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:18 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\misc\fuzz-harness\testdata\id_ed25519 EXT:  TYPE: Certificate PEM SIZE: 387 MD5: 904e0a369a7fbe86bcb4e0bc1363c539 SHA1: 1074da4383390925d414ad562a0818a88e116208 SHA256: 6efecdbb70364afc9cf004e325a9a1d2673d86e85a6238e1126d6d105cea56c1 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Sun Sep 26 14:03:19.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1815060 ARCHIVE_MD5: 8ce5f390958baeeab635aafd0ef41453 ARCHIVE_SHA1: 1eb964897a4372f6fb96c7effeb509ec71c379c9 ARCHIVE_SHA256: 4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbdeb76db46b62eda7f / vF. ARCHIVE_CREATED: Thu Aug 29 15:37:22.890 2024 ARCHIVE_MODIFIED: Tue Oct 19 14:06:19.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:25:11.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:18 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\misc\fuzz-harness\testdata\id_ed25519_sk EXT:  TYPE: Certificate PEM SIZE: 496 MD5: c3c7cad31e9edf76f806848501011568 SHA1: f936a6c0f3b1250ef7fd0cbf4ea5a5d3c9c63507 SHA256: 5fd315701b14a13467331e1d0819a8016abdf5888ab695f068fce488bd37169d FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Sun Sep 26 14:03:19.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1815060 ARCHIVE_MD5: 8ce5f390958baeeab635aafd0ef41453 ARCHIVE_SHA1: 1eb964897a4372f6fb96c7effeb509ec71c379c9 ARCHIVE_SHA256: 4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbdeb76db46b62eda7f / vF. ARCHIVE_CREATED: Thu Aug 29 15:37:22.890 2024 ARCHIVE_MODIFIED: Tue Oct 19 14:06:19.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:25:11.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x53\x67\x41\x41\x41\x42\x70\x7a\x61\x79\x31\x7a\x63\x32\x0a\x67\x74\x5a\x57\x51\x79\x4e\x54\x55\x78" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:18 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\misc\fuzz-harness\testdata\id_rsa EXT:  TYPE: Certificate PEM SIZE: 1799 MD5: 0e4d9d0e310d6dc6a5c2d33660f70542 SHA1: 7bef427ad9067a465009d543787063fdaceef3e5 SHA256: 83822e39fb2ee059431a45c3c48cffcda3fb869273a364a45898ce9abad09e84 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Sun Sep 26 14:03:19.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1815060 ARCHIVE_MD5: 8ce5f390958baeeab635aafd0ef41453 ARCHIVE_SHA1: 1eb964897a4372f6fb96c7effeb509ec71c379c9 ARCHIVE_SHA256: 4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbdeb76db46b62eda7f / vF. ARCHIVE_CREATED: Thu Aug 29 15:37:22.890 2024 ARCHIVE_MODIFIED: Tue Oct 19 14:06:19.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:25:11.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x42\x46\x77\x41\x41\x41\x41\x64\x7a\x63\x32\x67\x74\x63\x6e\x0a\x4e\x68\x41\x41\x41\x41\x41\x77\x45\x41" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:19 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\rsa_openssh.prv EXT: .prv TYPE: Certificate PEM SIZE: 883 MD5: a6b110f820948e73bbde7b948744b3c5 SHA1: 614e6d353be614ded246a12ed6e14af20f063710 SHA256: 79b8783d0b10a3f65b9b3e349a1daa692cc27be08028131ff5a9a08799035f46 FIRSTBYTES: 2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA MODIFIED: Sun Sep 26 14:03:19.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1815060 ARCHIVE_MD5: 8ce5f390958baeeab635aafd0ef41453 ARCHIVE_SHA1: 1eb964897a4372f6fb96c7effeb509ec71c379c9 ARCHIVE_SHA256: 4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbdeb76db46b62eda7f / vF. ARCHIVE_CREATED: Thu Aug 29 15:37:22.890 2024 ARCHIVE_MODIFIED: Tue Oct 19 14:06:19.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:25:11.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x43\x57\x67\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x73\x69\x6c\x77\x4b\x63\x61\x4b\x4e\x36\x77\x53\x4d\x4e\x64\x31\x57\x67\x51\x39\x2b\x48\x52\x71\x51\x45\x6b\x44\x30\x6b\x43\x54\x56\x74\x74\x72\x61\x7a" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:19 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshkey\testdata\dsa_1 EXT:  TYPE: Certificate PEM SIZE: 672 MD5: aebcad00ac7fb84f1a7de01322c99be3 SHA1: a9a0e1cf84bee8c27802295819b399833e5d4d08 SHA256: b7f7c2bb695b28e585951a2da4ad2d6c933c440afe118798c6e2363e17da2b93 FIRSTBYTES: 2d2d2d2d2d424547494e20445341205052495641 / -----BEGIN DSA PRIVA MODIFIED: Sun Sep 26 14:03:19.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1815060 ARCHIVE_MD5: 8ce5f390958baeeab635aafd0ef41453 ARCHIVE_SHA1: 1eb964897a4372f6fb96c7effeb509ec71c379c9 ARCHIVE_SHA256: 4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbdeb76db46b62eda7f / vF. ARCHIVE_CREATED: Thu Aug 29 15:37:22.890 2024 ARCHIVE_MODIFIED: Tue Oct 19 14:06:19.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:25:11.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x44\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x42\x76\x41\x49\x42\x41\x41\x4b\x42\x67\x51" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x44\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x42\x76\x41\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x36\x6b\x75\x74\x4e\x46\x52\x73\x48\x54\x77\x45\x41\x76\x36\x64\x33\x39\x4c\x68\x73\x71\x79\x31\x61\x70\x64\x48\x42\x5a\x39\x63\x32\x48\x66\x79\x52\x72\x37\x57\x6d\x79\x70\x79\x47\x49\x79\x32\x6d" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:19 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshkey\testdata\dsa_n EXT:  TYPE: Certificate PEM SIZE: 1361 MD5: 6fcf088f9850b2f2213186cee4dc4811 SHA1: a04d604886c6a7c2217df9b7eea5c998da91d561 SHA256: db691de6aa454ec8aa45c84c58022a54611427f6f44c20d152ac05e0ea2284ba FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Sun Sep 26 14:03:19.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1815060 ARCHIVE_MD5: 8ce5f390958baeeab635aafd0ef41453 ARCHIVE_SHA1: 1eb964897a4372f6fb96c7effeb509ec71c379c9 ARCHIVE_SHA256: 4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbdeb76db46b62eda7f / vF. ARCHIVE_CREATED: Thu Aug 29 15:37:22.890 2024 ARCHIVE_MODIFIED: Tue Oct 19 14:06:19.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:25:11.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x42\x73\x77\x41\x41\x41\x41\x64\x7a\x63\x32\x67\x74\x5a\x48\x0a\x4e\x7a\x41\x41\x41\x41\x67\x51\x44\x36" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:19 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshkey\testdata\ecdsa_1 EXT:  TYPE: Certificate PEM SIZE: 227 MD5: 610b43e1fd8e09f2794aba398c6950eb SHA1: c7e5b5ff84b30ff8880e4d75942a600d012516b6 SHA256: 42a90746ef5975c6ef98c6d56305dad0bc698a1b05c83518bc90584c83935d5c FIRSTBYTES: 2d2d2d2d2d424547494e20454320505249564154 / -----BEGIN EC PRIVAT MODIFIED: Sun Sep 26 14:03:19.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1815060 ARCHIVE_MD5: 8ce5f390958baeeab635aafd0ef41453 ARCHIVE_SHA1: 1eb964897a4372f6fb96c7effeb509ec71c379c9 ARCHIVE_SHA256: 4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbdeb76db46b62eda7f / vF. ARCHIVE_CREATED: Thu Aug 29 15:37:22.890 2024 ARCHIVE_MODIFIED: Tue Oct 19 14:06:19.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:25:11.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x48\x63\x43\x41\x51\x45\x45\x49\x50\x50\x4e\x79\x55\x41\x6e\x6a\x76\x46\x72\x2b\x65\x54\x2f\x37\x74\x2f\x49\x79\x6a\x75\x51\x51\x64\x2f\x61\x4c\x46\x69\x54\x59\x39\x32\x4c\x42\x39\x67\x49\x6a\x79\x72" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:19 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshkey\testdata\ecdsa_2 EXT:  TYPE: Certificate PEM SIZE: 365 MD5: 0346ad9a21f23d98cb3abe4845df078d SHA1: 07091af93e22c676e03e6f96e9d0e53c9b53d775 SHA256: 320396e36bd5ecc12089f26849f8e7b6e0ab3c037f0492dee978cef6646d5826 FIRSTBYTES: 2d2d2d2d2d424547494e20454320505249564154 / -----BEGIN EC PRIVAT MODIFIED: Sun Sep 26 14:03:19.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1815060 ARCHIVE_MD5: 8ce5f390958baeeab635aafd0ef41453 ARCHIVE_SHA1: 1eb964897a4372f6fb96c7effeb509ec71c379c9 ARCHIVE_SHA256: 4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbdeb76db46b62eda7f / vF. ARCHIVE_CREATED: Thu Aug 29 15:37:22.890 2024 ARCHIVE_MODIFIED: Tue Oct 19 14:06:19.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:25:11.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x48\x63\x41\x67\x45\x42\x42\x45\x49\x42\x71\x42\x74\x4e\x37\x65\x36\x45\x73\x73\x64\x33\x64\x6c\x73\x67\x49\x53\x56\x69\x50\x43\x58\x58\x43\x30\x61\x74\x6c\x4e\x6b\x47\x74\x6f\x4d\x67\x53\x51\x64" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:19 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshkey\testdata\ecdsa_n EXT:  TYPE: Certificate PEM SIZE: 492 MD5: 0ffc5b7197ecb4b69f503d4f3cc24c8c SHA1: c2c7fd9527d9cc84781346a3ac8e2100d4d20ad3 SHA256: 1cccaa23aca49238099494fc7b49b550311719c9ac6bb138797e1077f4d7973d FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Sun Sep 26 14:03:19.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1815060 ARCHIVE_MD5: 8ce5f390958baeeab635aafd0ef41453 ARCHIVE_SHA1: 1eb964897a4372f6fb96c7effeb509ec71c379c9 ARCHIVE_SHA256: 4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbdeb76db46b62eda7f / vF. ARCHIVE_CREATED: Thu Aug 29 15:37:22.890 2024 ARCHIVE_MODIFIED: Tue Oct 19 14:06:19.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:25:11.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x61\x41\x41\x41\x41\x42\x4e\x6c\x59\x32\x52\x7a\x59\x53\x0a\x31\x7a\x61\x47\x45\x79\x4c\x57\x35\x70" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:19 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshkey\testdata\ecdsa_sk1 EXT:  TYPE: Certificate PEM SIZE: 849 MD5: 97206cfa158fdda5a45c6eb542f739c0 SHA1: e55ec614db8cea92d7269d5f903cf72baca36454 SHA256: e4df7ea4ca133a7457069be073203c556166c65635ed6fb6c12b9a84f027346e FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Sun Sep 26 14:03:19.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1815060 ARCHIVE_MD5: 8ce5f390958baeeab635aafd0ef41453 ARCHIVE_SHA1: 1eb964897a4372f6fb96c7effeb509ec71c379c9 ARCHIVE_SHA256: 4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbdeb76db46b62eda7f / vF. ARCHIVE_CREATED: Thu Aug 29 15:37:22.890 2024 ARCHIVE_MODIFIED: Tue Oct 19 14:06:19.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:25:11.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x66\x77\x41\x41\x41\x43\x4a\x7a\x61\x79\x31\x6c\x59\x32\x0a\x52\x7a\x59\x53\x31\x7a\x61\x47\x45\x79" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:19 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshkey\testdata\ecdsa_sk2 EXT:  TYPE: Certificate PEM SIZE: 849 MD5: 14ecb7595ee296b15d413ae395454a4c SHA1: 909379299593aeebc79f44df0ec22578123acce7 SHA256: de6f60d862f799ca088bd4611865e24bb0635d81097bb9496f0178aefa4acbae FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Sun Sep 26 14:03:19.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1815060 ARCHIVE_MD5: 8ce5f390958baeeab635aafd0ef41453 ARCHIVE_SHA1: 1eb964897a4372f6fb96c7effeb509ec71c379c9 ARCHIVE_SHA256: 4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbdeb76db46b62eda7f / vF. ARCHIVE_CREATED: Thu Aug 29 15:37:22.890 2024 ARCHIVE_MODIFIED: Tue Oct 19 14:06:19.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:25:11.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x66\x77\x41\x41\x41\x43\x4a\x7a\x61\x79\x31\x6c\x59\x32\x0a\x52\x7a\x59\x53\x31\x7a\x61\x47\x45\x79" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:19 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshkey\testdata\ed25519_1 EXT:  TYPE: Certificate PEM SIZE: 411 MD5: 514e8e39c48edb2b8934ef78a5030042 SHA1: a7a368a6f3d09bc2cfc1315f6e0899bde0574ffd SHA256: 74f95c1990e3512af471cf6fb58d08a8078bbab597e7ee86a7ccd233f6855fd1 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Sun Sep 26 14:03:19.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1815060 ARCHIVE_MD5: 8ce5f390958baeeab635aafd0ef41453 ARCHIVE_SHA1: 1eb964897a4372f6fb96c7effeb509ec71c379c9 ARCHIVE_SHA256: 4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbdeb76db46b62eda7f / vF. ARCHIVE_CREATED: Thu Aug 29 15:37:22.890 2024 ARCHIVE_MODIFIED: Tue Oct 19 14:06:19.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:25:11.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:19 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshkey\testdata\ed25519_2 EXT:  TYPE: Certificate PEM SIZE: 411 MD5: bfc2ac8495dbc6070241303ec50a6dc2 SHA1: 53e388e7c836c6ba874e852d71a6e1e708611d25 SHA256: 31689f4706b3bdad29ee21b05af62e9f2257399d07092089944514ed5edb131d FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Sun Sep 26 14:03:19.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1815060 ARCHIVE_MD5: 8ce5f390958baeeab635aafd0ef41453 ARCHIVE_SHA1: 1eb964897a4372f6fb96c7effeb509ec71c379c9 ARCHIVE_SHA256: 4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbdeb76db46b62eda7f / vF. ARCHIVE_CREATED: Thu Aug 29 15:37:22.890 2024 ARCHIVE_MODIFIED: Tue Oct 19 14:06:19.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:25:11.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:19 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshkey\testdata\ed25519_sk1 EXT:  TYPE: Certificate PEM SIZE: 484 MD5: ab9dcdbff00763217a3f85069a9c2f67 SHA1: 05396ad046c37370093f48c0bdb2510b8894aa76 SHA256: 45c058d08280c4ca36a9d020478504cd550e7c5752c207d182363c3edf669ce8 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Sun Sep 26 14:03:19.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1815060 ARCHIVE_MD5: 8ce5f390958baeeab635aafd0ef41453 ARCHIVE_SHA1: 1eb964897a4372f6fb96c7effeb509ec71c379c9 ARCHIVE_SHA256: 4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbdeb76db46b62eda7f / vF. ARCHIVE_CREATED: Thu Aug 29 15:37:22.890 2024 ARCHIVE_MODIFIED: Tue Oct 19 14:06:19.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:25:11.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x53\x67\x41\x41\x41\x42\x70\x7a\x61\x79\x31\x7a\x63\x32\x0a\x67\x74\x5a\x57\x51\x79\x4e\x54\x55\x78" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:19 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshkey\testdata\ed25519_sk2 EXT:  TYPE: Certificate PEM SIZE: 484 MD5: 8a666562de41f71d57d47c5f6404293a SHA1: 069c9341d4b0cd94669ff23feab92853b6a42540 SHA256: b862e169114ee63ae5e8497110075a9e67c4e3f24bad01e7c06951d268a3ec0f FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Sun Sep 26 14:03:19.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1815060 ARCHIVE_MD5: 8ce5f390958baeeab635aafd0ef41453 ARCHIVE_SHA1: 1eb964897a4372f6fb96c7effeb509ec71c379c9 ARCHIVE_SHA256: 4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbdeb76db46b62eda7f / vF. ARCHIVE_CREATED: Thu Aug 29 15:37:22.890 2024 ARCHIVE_MODIFIED: Tue Oct 19 14:06:19.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:25:11.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x53\x67\x41\x41\x41\x42\x70\x7a\x61\x79\x31\x7a\x63\x32\x0a\x67\x74\x5a\x57\x51\x79\x4e\x54\x55\x78" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:19 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshkey\testdata\rsa_1 EXT:  TYPE: Certificate PEM SIZE: 887 MD5: 197f14927e89c5c573213416bde709cb SHA1: 2f5cfafbddd00c351ce72e2f140458fb5ac7b60a SHA256: 07586a53bef4dd9daf59c473399fca5fcb39891bed0d2c2f8a88249e02392ac5 FIRSTBYTES: 2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA MODIFIED: Sun Sep 26 14:03:19.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1815060 ARCHIVE_MD5: 8ce5f390958baeeab635aafd0ef41453 ARCHIVE_SHA1: 1eb964897a4372f6fb96c7effeb509ec71c379c9 ARCHIVE_SHA256: 4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbdeb76db46b62eda7f / vF. ARCHIVE_CREATED: Thu Aug 29 15:37:22.890 2024 ARCHIVE_MODIFIED: Tue Oct 19 14:06:19.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:25:11.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x43\x58\x41\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x4c\x56\x35\x6c\x55\x54\x74\x37\x46\x72\x41\x44\x73\x65\x42\x2f\x43\x47\x68\x45\x5a\x7a\x70\x6f\x6f\x6a\x6a\x45\x57\x35\x79\x38\x2b\x65\x50\x76\x4c\x70" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:19 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshkey\testdata\rsa_1_sha1 EXT:  TYPE: Certificate PEM SIZE: 887 MD5: 197f14927e89c5c573213416bde709cb SHA1: 2f5cfafbddd00c351ce72e2f140458fb5ac7b60a SHA256: 07586a53bef4dd9daf59c473399fca5fcb39891bed0d2c2f8a88249e02392ac5 FIRSTBYTES: 2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA MODIFIED: Sun Sep 26 14:03:19.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1815060 ARCHIVE_MD5: 8ce5f390958baeeab635aafd0ef41453 ARCHIVE_SHA1: 1eb964897a4372f6fb96c7effeb509ec71c379c9 ARCHIVE_SHA256: 4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbdeb76db46b62eda7f / vF. ARCHIVE_CREATED: Thu Aug 29 15:37:22.890 2024 ARCHIVE_MODIFIED: Tue Oct 19 14:06:19.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:25:11.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x43\x58\x41\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x4c\x56\x35\x6c\x55\x54\x74\x37\x46\x72\x41\x44\x73\x65\x42\x2f\x43\x47\x68\x45\x5a\x7a\x70\x6f\x6f\x6a\x6a\x45\x57\x35\x79\x38\x2b\x65\x50\x76\x4c\x70" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:19 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshkey\testdata\rsa_1_sha512 EXT:  TYPE: Certificate PEM SIZE: 887 MD5: 197f14927e89c5c573213416bde709cb SHA1: 2f5cfafbddd00c351ce72e2f140458fb5ac7b60a SHA256: 07586a53bef4dd9daf59c473399fca5fcb39891bed0d2c2f8a88249e02392ac5 FIRSTBYTES: 2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA MODIFIED: Sun Sep 26 14:03:19.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1815060 ARCHIVE_MD5: 8ce5f390958baeeab635aafd0ef41453 ARCHIVE_SHA1: 1eb964897a4372f6fb96c7effeb509ec71c379c9 ARCHIVE_SHA256: 4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbdeb76db46b62eda7f / vF. ARCHIVE_CREATED: Thu Aug 29 15:37:22.890 2024 ARCHIVE_MODIFIED: Tue Oct 19 14:06:19.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:25:11.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x43\x58\x41\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x4c\x56\x35\x6c\x55\x54\x74\x37\x46\x72\x41\x44\x73\x65\x42\x2f\x43\x47\x68\x45\x5a\x7a\x70\x6f\x6f\x6a\x6a\x45\x57\x35\x79\x38\x2b\x65\x50\x76\x4c\x70" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:19 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshkey\testdata\rsa_2 EXT:  TYPE: Certificate PEM SIZE: 1679 MD5: c8860a2d208d222eade1e9866449ccbc SHA1: 64133ddc79d593e467c864c429e3793c69e4dc22 SHA256: e42925e663a7215e19cdc89bd9fe018903eeb013f131b188d3c87f0ef01c5a24 FIRSTBYTES: 2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA MODIFIED: Sun Sep 26 14:03:19.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1815060 ARCHIVE_MD5: 8ce5f390958baeeab635aafd0ef41453 ARCHIVE_SHA1: 1eb964897a4372f6fb96c7effeb509ec71c379c9 ARCHIVE_SHA256: 4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbdeb76db46b62eda7f / vF. ARCHIVE_CREATED: Thu Aug 29 15:37:22.890 2024 ARCHIVE_MODIFIED: Tue Oct 19 14:06:19.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:25:11.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x45\x70\x41\x49\x42\x41\x41\x4b\x43\x41\x51\x45\x41\x39\x4e\x45\x55\x58\x70\x37\x38\x53\x41\x6b\x6d\x4c\x34\x2b\x65\x41\x6a\x34\x6d\x42\x7a\x50\x4f\x6a\x6b\x2b\x63\x63\x43\x50\x56\x7a\x6b\x54\x52\x2b" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:19 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshkey\testdata\rsa_n EXT:  TYPE: Certificate PEM SIZE: 1020 MD5: d60f55c106077131ba136f02e9b9ba88 SHA1: d6a3a8961cb40e8a4ff03dbfd5983c9fc5dfeb39 SHA256: 0ad47d17d5f21f350c26c4c94564bf41b6fd28ab55187166b4f46b1b35daed6d FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Sun Sep 26 14:03:19.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1815060 ARCHIVE_MD5: 8ce5f390958baeeab635aafd0ef41453 ARCHIVE_SHA1: 1eb964897a4372f6fb96c7effeb509ec71c379c9 ARCHIVE_SHA256: 4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbdeb76db46b62eda7f / vF. ARCHIVE_CREATED: Thu Aug 29 15:37:22.890 2024 ARCHIVE_MODIFIED: Tue Oct 19 14:06:19.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:25:11.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x6c\x77\x41\x41\x41\x41\x64\x7a\x63\x32\x67\x74\x63\x6e\x0a\x4e\x68\x41\x41\x41\x41\x41\x77\x45\x41" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:19 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshsig\testdata\ecdsa EXT:  TYPE: Certificate PEM SIZE: 227 MD5: 53f2aa69e4e8d05ea1c0848c4a946b71 SHA1: 69a4f47fbbb55eb5dea9adea057509384a32bb69 SHA256: 585957bd0a19fcff2d22cd8af7ffb13b68cc30c9dc13dfefb57271b03f3a999f FIRSTBYTES: 2d2d2d2d2d424547494e20454320505249564154 / -----BEGIN EC PRIVAT MODIFIED: Sun Sep 26 14:03:19.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1815060 ARCHIVE_MD5: 8ce5f390958baeeab635aafd0ef41453 ARCHIVE_SHA1: 1eb964897a4372f6fb96c7effeb509ec71c379c9 ARCHIVE_SHA256: 4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbdeb76db46b62eda7f / vF. ARCHIVE_CREATED: Thu Aug 29 15:37:22.890 2024 ARCHIVE_MODIFIED: Tue Oct 19 14:06:19.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:25:11.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x48\x63\x43\x41\x51\x45\x45\x49\x46\x67\x30\x5a\x43\x53\x45\x42\x35\x4c\x4e\x65\x4c\x73\x58\x59\x4c\x32\x35\x67\x33\x6b\x71\x45\x57\x73\x71\x68\x35\x32\x44\x52\x2b\x79\x4e\x4f\x6a\x79\x51\x4a\x71\x79" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:19 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshsig\testdata\ecdsa_sk EXT:  TYPE: Certificate PEM SIZE: 837 MD5: 36948c6f96600caa24052b4d8322cbd9 SHA1: b7bf9e701f8da5d50f61064849d052e04fb77c3f SHA256: f81b969ccd3e85f02b71465ba38fb51b5adf6f11b09f2e9e82ed6b2ab31f2356 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Sun Sep 26 14:03:19.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1815060 ARCHIVE_MD5: 8ce5f390958baeeab635aafd0ef41453 ARCHIVE_SHA1: 1eb964897a4372f6fb96c7effeb509ec71c379c9 ARCHIVE_SHA256: 4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbdeb76db46b62eda7f / vF. ARCHIVE_CREATED: Thu Aug 29 15:37:22.890 2024 ARCHIVE_MODIFIED: Tue Oct 19 14:06:19.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:25:11.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x66\x77\x41\x41\x41\x43\x4a\x7a\x61\x79\x31\x6c\x59\x32\x0a\x52\x7a\x59\x53\x31\x7a\x61\x47\x45\x79" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:19 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshsig\testdata\ed25519 EXT:  TYPE: Certificate PEM SIZE: 411 MD5: 8bb197113a031c8f6d76de369316d0eb SHA1: 40847760b4f753f2b17156d3f6f9cdcc7c0b91d4 SHA256: c4683c666d6394fc5e8f3455b5379304979e0b41502560ddef20c824fa9fb66b FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Sun Sep 26 14:03:19.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1815060 ARCHIVE_MD5: 8ce5f390958baeeab635aafd0ef41453 ARCHIVE_SHA1: 1eb964897a4372f6fb96c7effeb509ec71c379c9 ARCHIVE_SHA256: 4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbdeb76db46b62eda7f / vF. ARCHIVE_CREATED: Thu Aug 29 15:37:22.890 2024 ARCHIVE_MODIFIED: Tue Oct 19 14:06:19.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:25:11.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:19 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshsig\testdata\ed25519_sk EXT:  TYPE: Certificate PEM SIZE: 484 MD5: 85bc2e18e08c06aa85cf023e7a97a585 SHA1: 95ea85c4709baf47e7cc2573ceac480cc35bde67 SHA256: 0e2221a7c8e8cea4fb6e9d2666b1d05166a3b0f5876c54433f0c35b564f22025 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Sun Sep 26 14:03:19.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1815060 ARCHIVE_MD5: 8ce5f390958baeeab635aafd0ef41453 ARCHIVE_SHA1: 1eb964897a4372f6fb96c7effeb509ec71c379c9 ARCHIVE_SHA256: 4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbdeb76db46b62eda7f / vF. ARCHIVE_CREATED: Thu Aug 29 15:37:22.890 2024 ARCHIVE_MODIFIED: Tue Oct 19 14:06:19.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:25:11.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x53\x67\x41\x41\x41\x42\x70\x7a\x61\x79\x31\x7a\x63\x32\x0a\x67\x74\x5a\x57\x51\x79\x4e\x54\x55\x78" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:20 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshsig\testdata\rsa EXT:  TYPE: Certificate PEM SIZE: 2455 MD5: efe804ccdc63abc29233f3a1e11e173b SHA1: 481c1773197aabc2d9d87336ad84f44410251ed4 SHA256: d7eb37f534b846bb582bcdcf78232bdb33932e34fb72d6bfa130a8fd699b10b6 FIRSTBYTES: 2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA MODIFIED: Sun Sep 26 14:03:19.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1815060 ARCHIVE_MD5: 8ce5f390958baeeab635aafd0ef41453 ARCHIVE_SHA1: 1eb964897a4372f6fb96c7effeb509ec71c379c9 ARCHIVE_SHA256: 4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbdeb76db46b62eda7f / vF. ARCHIVE_CREATED: Thu Aug 29 15:37:22.890 2024 ARCHIVE_MODIFIED: Tue Oct 19 14:06:19.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:25:11.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x47\x34\x77\x49\x42\x41\x41\x4b\x43\x41\x59\x45\x41\x33\x38\x36\x6c\x6d\x6a\x52\x48\x74\x4a\x70\x79\x6a\x38\x37\x42\x72\x53\x2b\x73\x73\x4d\x6d\x74\x76\x63\x2f\x31\x53\x50\x4e\x30\x67\x58\x54\x50\x73" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:21 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\misc\fuzz-harness\testdata\id_dsa EXT:  TYPE: Certificate PEM SIZE: 1361 MD5: a9521c2825fbf778b6b82b1dcda95d72 SHA1: 29bc6d9b491473450487aad65a659675154b8fb8 SHA256: a6fa247970fe3fe15b9647e9ae301495d10ea278dbe9516abdf70e69b1849744 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Tue Mar  2 10:31:47.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1779733 ARCHIVE_MD5: 9eb9420cf587edc26f8998ab679ad390 ARCHIVE_SHA1: 72eadcbe313b07b1dd3b693e41d3cd56d354e24e ARCHIVE_SHA256: f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbde976db48962e5a7f / vH.Z ARCHIVE_CREATED: Fri Aug 30 07:32:13.477 2024 ARCHIVE_MODIFIED: Wed Mar  3 00:46:27.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:27:15.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x42\x73\x67\x41\x41\x41\x41\x64\x7a\x63\x32\x67\x74\x5a\x48\x0a\x4e\x7a\x41\x41\x41\x41\x67\x51\x43\x73" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:21 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\misc\fuzz-harness\testdata\id_ecdsa EXT:  TYPE: Certificate PEM SIZE: 492 MD5: b14d14c4a2eb3a89c43be1d828fe2604 SHA1: 56c94a39972cc4c2ab982f6b206702cf3b558bde SHA256: 00120fd3e06a2c9a2debabe94c75cb9a8fb313d17b3a114dda6264874ae56c60 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Tue Mar  2 10:31:47.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1779733 ARCHIVE_MD5: 9eb9420cf587edc26f8998ab679ad390 ARCHIVE_SHA1: 72eadcbe313b07b1dd3b693e41d3cd56d354e24e ARCHIVE_SHA256: f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbde976db48962e5a7f / vH.Z ARCHIVE_CREATED: Fri Aug 30 07:32:13.477 2024 ARCHIVE_MODIFIED: Wed Mar  3 00:46:27.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:27:15.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x61\x41\x41\x41\x41\x42\x4e\x6c\x59\x32\x52\x7a\x59\x53\x0a\x31\x7a\x61\x47\x45\x79\x4c\x57\x35\x70" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:21 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\misc\fuzz-harness\testdata\id_ecdsa_sk EXT:  TYPE: Certificate PEM SIZE: 858 MD5: c87bc24fa8b257e7af7374511f44d2c5 SHA1: 2c1d6e64ad0052837b53739841f6acfc60a191ed SHA256: 50e6649901ffdf7bc4d85dd0f45937b9d99bdd85e472c112f8586bd3e35beb58 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Tue Mar  2 10:31:47.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1779733 ARCHIVE_MD5: 9eb9420cf587edc26f8998ab679ad390 ARCHIVE_SHA1: 72eadcbe313b07b1dd3b693e41d3cd56d354e24e ARCHIVE_SHA256: f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbde976db48962e5a7f / vH.Z ARCHIVE_CREATED: Fri Aug 30 07:32:13.477 2024 ARCHIVE_MODIFIED: Wed Mar  3 00:46:27.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:27:15.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x66\x77\x41\x41\x41\x43\x4a\x7a\x61\x79\x31\x6c\x59\x32\x0a\x52\x7a\x59\x53\x31\x7a\x61\x47\x45\x79" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:21 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\misc\fuzz-harness\testdata\id_ed25519 EXT:  TYPE: Certificate PEM SIZE: 387 MD5: 904e0a369a7fbe86bcb4e0bc1363c539 SHA1: 1074da4383390925d414ad562a0818a88e116208 SHA256: 6efecdbb70364afc9cf004e325a9a1d2673d86e85a6238e1126d6d105cea56c1 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Tue Mar  2 10:31:47.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1779733 ARCHIVE_MD5: 9eb9420cf587edc26f8998ab679ad390 ARCHIVE_SHA1: 72eadcbe313b07b1dd3b693e41d3cd56d354e24e ARCHIVE_SHA256: f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbde976db48962e5a7f / vH.Z ARCHIVE_CREATED: Fri Aug 30 07:32:13.477 2024 ARCHIVE_MODIFIED: Wed Mar  3 00:46:27.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:27:15.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:21 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\misc\fuzz-harness\testdata\id_ed25519_sk EXT:  TYPE: Certificate PEM SIZE: 496 MD5: c3c7cad31e9edf76f806848501011568 SHA1: f936a6c0f3b1250ef7fd0cbf4ea5a5d3c9c63507 SHA256: 5fd315701b14a13467331e1d0819a8016abdf5888ab695f068fce488bd37169d FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Tue Mar  2 10:31:47.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1779733 ARCHIVE_MD5: 9eb9420cf587edc26f8998ab679ad390 ARCHIVE_SHA1: 72eadcbe313b07b1dd3b693e41d3cd56d354e24e ARCHIVE_SHA256: f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbde976db48962e5a7f / vH.Z ARCHIVE_CREATED: Fri Aug 30 07:32:13.477 2024 ARCHIVE_MODIFIED: Wed Mar  3 00:46:27.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:27:15.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x53\x67\x41\x41\x41\x42\x70\x7a\x61\x79\x31\x7a\x63\x32\x0a\x67\x74\x5a\x57\x51\x79\x4e\x54\x55\x78" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:21 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\misc\fuzz-harness\testdata\id_rsa EXT:  TYPE: Certificate PEM SIZE: 1799 MD5: 0e4d9d0e310d6dc6a5c2d33660f70542 SHA1: 7bef427ad9067a465009d543787063fdaceef3e5 SHA256: 83822e39fb2ee059431a45c3c48cffcda3fb869273a364a45898ce9abad09e84 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Tue Mar  2 10:31:47.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1779733 ARCHIVE_MD5: 9eb9420cf587edc26f8998ab679ad390 ARCHIVE_SHA1: 72eadcbe313b07b1dd3b693e41d3cd56d354e24e ARCHIVE_SHA256: f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbde976db48962e5a7f / vH.Z ARCHIVE_CREATED: Fri Aug 30 07:32:13.477 2024 ARCHIVE_MODIFIED: Wed Mar  3 00:46:27.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:27:15.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x42\x46\x77\x41\x41\x41\x41\x64\x7a\x63\x32\x67\x74\x63\x6e\x0a\x4e\x68\x41\x41\x41\x41\x41\x77\x45\x41" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:22 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\rsa_openssh.prv EXT: .prv TYPE: Certificate PEM SIZE: 883 MD5: a6b110f820948e73bbde7b948744b3c5 SHA1: 614e6d353be614ded246a12ed6e14af20f063710 SHA256: 79b8783d0b10a3f65b9b3e349a1daa692cc27be08028131ff5a9a08799035f46 FIRSTBYTES: 2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA MODIFIED: Tue Mar  2 10:31:47.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1779733 ARCHIVE_MD5: 9eb9420cf587edc26f8998ab679ad390 ARCHIVE_SHA1: 72eadcbe313b07b1dd3b693e41d3cd56d354e24e ARCHIVE_SHA256: f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbde976db48962e5a7f / vH.Z ARCHIVE_CREATED: Fri Aug 30 07:32:13.477 2024 ARCHIVE_MODIFIED: Wed Mar  3 00:46:27.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:27:15.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x43\x57\x67\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x73\x69\x6c\x77\x4b\x63\x61\x4b\x4e\x36\x77\x53\x4d\x4e\x64\x31\x57\x67\x51\x39\x2b\x48\x52\x71\x51\x45\x6b\x44\x30\x6b\x43\x54\x56\x74\x74\x72\x61\x7a" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:22 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshkey\testdata\dsa_1 EXT:  TYPE: Certificate PEM SIZE: 672 MD5: aebcad00ac7fb84f1a7de01322c99be3 SHA1: a9a0e1cf84bee8c27802295819b399833e5d4d08 SHA256: b7f7c2bb695b28e585951a2da4ad2d6c933c440afe118798c6e2363e17da2b93 FIRSTBYTES: 2d2d2d2d2d424547494e20445341205052495641 / -----BEGIN DSA PRIVA MODIFIED: Tue Mar  2 10:31:47.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1779733 ARCHIVE_MD5: 9eb9420cf587edc26f8998ab679ad390 ARCHIVE_SHA1: 72eadcbe313b07b1dd3b693e41d3cd56d354e24e ARCHIVE_SHA256: f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbde976db48962e5a7f / vH.Z ARCHIVE_CREATED: Fri Aug 30 07:32:13.477 2024 ARCHIVE_MODIFIED: Wed Mar  3 00:46:27.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:27:15.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x44\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x42\x76\x41\x49\x42\x41\x41\x4b\x42\x67\x51" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x44\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x42\x76\x41\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x36\x6b\x75\x74\x4e\x46\x52\x73\x48\x54\x77\x45\x41\x76\x36\x64\x33\x39\x4c\x68\x73\x71\x79\x31\x61\x70\x64\x48\x42\x5a\x39\x63\x32\x48\x66\x79\x52\x72\x37\x57\x6d\x79\x70\x79\x47\x49\x79\x32\x6d" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:22 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshkey\testdata\dsa_n EXT:  TYPE: Certificate PEM SIZE: 1361 MD5: 6fcf088f9850b2f2213186cee4dc4811 SHA1: a04d604886c6a7c2217df9b7eea5c998da91d561 SHA256: db691de6aa454ec8aa45c84c58022a54611427f6f44c20d152ac05e0ea2284ba FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Tue Mar  2 10:31:47.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1779733 ARCHIVE_MD5: 9eb9420cf587edc26f8998ab679ad390 ARCHIVE_SHA1: 72eadcbe313b07b1dd3b693e41d3cd56d354e24e ARCHIVE_SHA256: f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbde976db48962e5a7f / vH.Z ARCHIVE_CREATED: Fri Aug 30 07:32:13.477 2024 ARCHIVE_MODIFIED: Wed Mar  3 00:46:27.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:27:15.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x42\x73\x77\x41\x41\x41\x41\x64\x7a\x63\x32\x67\x74\x5a\x48\x0a\x4e\x7a\x41\x41\x41\x41\x67\x51\x44\x36" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:22 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshkey\testdata\ecdsa_1 EXT:  TYPE: Certificate PEM SIZE: 227 MD5: 610b43e1fd8e09f2794aba398c6950eb SHA1: c7e5b5ff84b30ff8880e4d75942a600d012516b6 SHA256: 42a90746ef5975c6ef98c6d56305dad0bc698a1b05c83518bc90584c83935d5c FIRSTBYTES: 2d2d2d2d2d424547494e20454320505249564154 / -----BEGIN EC PRIVAT MODIFIED: Tue Mar  2 10:31:47.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1779733 ARCHIVE_MD5: 9eb9420cf587edc26f8998ab679ad390 ARCHIVE_SHA1: 72eadcbe313b07b1dd3b693e41d3cd56d354e24e ARCHIVE_SHA256: f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbde976db48962e5a7f / vH.Z ARCHIVE_CREATED: Fri Aug 30 07:32:13.477 2024 ARCHIVE_MODIFIED: Wed Mar  3 00:46:27.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:27:15.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x48\x63\x43\x41\x51\x45\x45\x49\x50\x50\x4e\x79\x55\x41\x6e\x6a\x76\x46\x72\x2b\x65\x54\x2f\x37\x74\x2f\x49\x79\x6a\x75\x51\x51\x64\x2f\x61\x4c\x46\x69\x54\x59\x39\x32\x4c\x42\x39\x67\x49\x6a\x79\x72" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:22 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshkey\testdata\ecdsa_2 EXT:  TYPE: Certificate PEM SIZE: 365 MD5: 0346ad9a21f23d98cb3abe4845df078d SHA1: 07091af93e22c676e03e6f96e9d0e53c9b53d775 SHA256: 320396e36bd5ecc12089f26849f8e7b6e0ab3c037f0492dee978cef6646d5826 FIRSTBYTES: 2d2d2d2d2d424547494e20454320505249564154 / -----BEGIN EC PRIVAT MODIFIED: Tue Mar  2 10:31:47.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1779733 ARCHIVE_MD5: 9eb9420cf587edc26f8998ab679ad390 ARCHIVE_SHA1: 72eadcbe313b07b1dd3b693e41d3cd56d354e24e ARCHIVE_SHA256: f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbde976db48962e5a7f / vH.Z ARCHIVE_CREATED: Fri Aug 30 07:32:13.477 2024 ARCHIVE_MODIFIED: Wed Mar  3 00:46:27.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:27:15.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x48\x63\x41\x67\x45\x42\x42\x45\x49\x42\x71\x42\x74\x4e\x37\x65\x36\x45\x73\x73\x64\x33\x64\x6c\x73\x67\x49\x53\x56\x69\x50\x43\x58\x58\x43\x30\x61\x74\x6c\x4e\x6b\x47\x74\x6f\x4d\x67\x53\x51\x64" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:22 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshkey\testdata\ecdsa_n EXT:  TYPE: Certificate PEM SIZE: 492 MD5: 0ffc5b7197ecb4b69f503d4f3cc24c8c SHA1: c2c7fd9527d9cc84781346a3ac8e2100d4d20ad3 SHA256: 1cccaa23aca49238099494fc7b49b550311719c9ac6bb138797e1077f4d7973d FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Tue Mar  2 10:31:47.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1779733 ARCHIVE_MD5: 9eb9420cf587edc26f8998ab679ad390 ARCHIVE_SHA1: 72eadcbe313b07b1dd3b693e41d3cd56d354e24e ARCHIVE_SHA256: f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbde976db48962e5a7f / vH.Z ARCHIVE_CREATED: Fri Aug 30 07:32:13.477 2024 ARCHIVE_MODIFIED: Wed Mar  3 00:46:27.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:27:15.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x61\x41\x41\x41\x41\x42\x4e\x6c\x59\x32\x52\x7a\x59\x53\x0a\x31\x7a\x61\x47\x45\x79\x4c\x57\x35\x70" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:22 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshkey\testdata\ecdsa_sk1 EXT:  TYPE: Certificate PEM SIZE: 849 MD5: 97206cfa158fdda5a45c6eb542f739c0 SHA1: e55ec614db8cea92d7269d5f903cf72baca36454 SHA256: e4df7ea4ca133a7457069be073203c556166c65635ed6fb6c12b9a84f027346e FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Tue Mar  2 10:31:47.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1779733 ARCHIVE_MD5: 9eb9420cf587edc26f8998ab679ad390 ARCHIVE_SHA1: 72eadcbe313b07b1dd3b693e41d3cd56d354e24e ARCHIVE_SHA256: f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbde976db48962e5a7f / vH.Z ARCHIVE_CREATED: Fri Aug 30 07:32:13.477 2024 ARCHIVE_MODIFIED: Wed Mar  3 00:46:27.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:27:15.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x66\x77\x41\x41\x41\x43\x4a\x7a\x61\x79\x31\x6c\x59\x32\x0a\x52\x7a\x59\x53\x31\x7a\x61\x47\x45\x79" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:22 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshkey\testdata\ecdsa_sk2 EXT:  TYPE: Certificate PEM SIZE: 849 MD5: 14ecb7595ee296b15d413ae395454a4c SHA1: 909379299593aeebc79f44df0ec22578123acce7 SHA256: de6f60d862f799ca088bd4611865e24bb0635d81097bb9496f0178aefa4acbae FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Tue Mar  2 10:31:47.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1779733 ARCHIVE_MD5: 9eb9420cf587edc26f8998ab679ad390 ARCHIVE_SHA1: 72eadcbe313b07b1dd3b693e41d3cd56d354e24e ARCHIVE_SHA256: f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbde976db48962e5a7f / vH.Z ARCHIVE_CREATED: Fri Aug 30 07:32:13.477 2024 ARCHIVE_MODIFIED: Wed Mar  3 00:46:27.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:27:15.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x66\x77\x41\x41\x41\x43\x4a\x7a\x61\x79\x31\x6c\x59\x32\x0a\x52\x7a\x59\x53\x31\x7a\x61\x47\x45\x79" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:22 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshkey\testdata\ed25519_1 EXT:  TYPE: Certificate PEM SIZE: 411 MD5: 514e8e39c48edb2b8934ef78a5030042 SHA1: a7a368a6f3d09bc2cfc1315f6e0899bde0574ffd SHA256: 74f95c1990e3512af471cf6fb58d08a8078bbab597e7ee86a7ccd233f6855fd1 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Tue Mar  2 10:31:47.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1779733 ARCHIVE_MD5: 9eb9420cf587edc26f8998ab679ad390 ARCHIVE_SHA1: 72eadcbe313b07b1dd3b693e41d3cd56d354e24e ARCHIVE_SHA256: f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbde976db48962e5a7f / vH.Z ARCHIVE_CREATED: Fri Aug 30 07:32:13.477 2024 ARCHIVE_MODIFIED: Wed Mar  3 00:46:27.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:27:15.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:22 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshkey\testdata\ed25519_2 EXT:  TYPE: Certificate PEM SIZE: 411 MD5: bfc2ac8495dbc6070241303ec50a6dc2 SHA1: 53e388e7c836c6ba874e852d71a6e1e708611d25 SHA256: 31689f4706b3bdad29ee21b05af62e9f2257399d07092089944514ed5edb131d FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Tue Mar  2 10:31:47.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1779733 ARCHIVE_MD5: 9eb9420cf587edc26f8998ab679ad390 ARCHIVE_SHA1: 72eadcbe313b07b1dd3b693e41d3cd56d354e24e ARCHIVE_SHA256: f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbde976db48962e5a7f / vH.Z ARCHIVE_CREATED: Fri Aug 30 07:32:13.477 2024 ARCHIVE_MODIFIED: Wed Mar  3 00:46:27.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:27:15.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:22 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshkey\testdata\ed25519_sk1 EXT:  TYPE: Certificate PEM SIZE: 484 MD5: ab9dcdbff00763217a3f85069a9c2f67 SHA1: 05396ad046c37370093f48c0bdb2510b8894aa76 SHA256: 45c058d08280c4ca36a9d020478504cd550e7c5752c207d182363c3edf669ce8 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Tue Mar  2 10:31:47.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1779733 ARCHIVE_MD5: 9eb9420cf587edc26f8998ab679ad390 ARCHIVE_SHA1: 72eadcbe313b07b1dd3b693e41d3cd56d354e24e ARCHIVE_SHA256: f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbde976db48962e5a7f / vH.Z ARCHIVE_CREATED: Fri Aug 30 07:32:13.477 2024 ARCHIVE_MODIFIED: Wed Mar  3 00:46:27.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:27:15.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x53\x67\x41\x41\x41\x42\x70\x7a\x61\x79\x31\x7a\x63\x32\x0a\x67\x74\x5a\x57\x51\x79\x4e\x54\x55\x78" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:22 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshkey\testdata\ed25519_sk2 EXT:  TYPE: Certificate PEM SIZE: 484 MD5: 8a666562de41f71d57d47c5f6404293a SHA1: 069c9341d4b0cd94669ff23feab92853b6a42540 SHA256: b862e169114ee63ae5e8497110075a9e67c4e3f24bad01e7c06951d268a3ec0f FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Tue Mar  2 10:31:47.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1779733 ARCHIVE_MD5: 9eb9420cf587edc26f8998ab679ad390 ARCHIVE_SHA1: 72eadcbe313b07b1dd3b693e41d3cd56d354e24e ARCHIVE_SHA256: f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbde976db48962e5a7f / vH.Z ARCHIVE_CREATED: Fri Aug 30 07:32:13.477 2024 ARCHIVE_MODIFIED: Wed Mar  3 00:46:27.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:27:15.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x53\x67\x41\x41\x41\x42\x70\x7a\x61\x79\x31\x7a\x63\x32\x0a\x67\x74\x5a\x57\x51\x79\x4e\x54\x55\x78" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:22 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshkey\testdata\rsa_1 EXT:  TYPE: Certificate PEM SIZE: 887 MD5: 197f14927e89c5c573213416bde709cb SHA1: 2f5cfafbddd00c351ce72e2f140458fb5ac7b60a SHA256: 07586a53bef4dd9daf59c473399fca5fcb39891bed0d2c2f8a88249e02392ac5 FIRSTBYTES: 2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA MODIFIED: Tue Mar  2 10:31:47.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1779733 ARCHIVE_MD5: 9eb9420cf587edc26f8998ab679ad390 ARCHIVE_SHA1: 72eadcbe313b07b1dd3b693e41d3cd56d354e24e ARCHIVE_SHA256: f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbde976db48962e5a7f / vH.Z ARCHIVE_CREATED: Fri Aug 30 07:32:13.477 2024 ARCHIVE_MODIFIED: Wed Mar  3 00:46:27.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:27:15.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x43\x58\x41\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x4c\x56\x35\x6c\x55\x54\x74\x37\x46\x72\x41\x44\x73\x65\x42\x2f\x43\x47\x68\x45\x5a\x7a\x70\x6f\x6f\x6a\x6a\x45\x57\x35\x79\x38\x2b\x65\x50\x76\x4c\x70" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:22 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshkey\testdata\rsa_1_sha1 EXT:  TYPE: Certificate PEM SIZE: 887 MD5: 197f14927e89c5c573213416bde709cb SHA1: 2f5cfafbddd00c351ce72e2f140458fb5ac7b60a SHA256: 07586a53bef4dd9daf59c473399fca5fcb39891bed0d2c2f8a88249e02392ac5 FIRSTBYTES: 2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA MODIFIED: Tue Mar  2 10:31:47.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1779733 ARCHIVE_MD5: 9eb9420cf587edc26f8998ab679ad390 ARCHIVE_SHA1: 72eadcbe313b07b1dd3b693e41d3cd56d354e24e ARCHIVE_SHA256: f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbde976db48962e5a7f / vH.Z ARCHIVE_CREATED: Fri Aug 30 07:32:13.477 2024 ARCHIVE_MODIFIED: Wed Mar  3 00:46:27.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:27:15.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x43\x58\x41\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x4c\x56\x35\x6c\x55\x54\x74\x37\x46\x72\x41\x44\x73\x65\x42\x2f\x43\x47\x68\x45\x5a\x7a\x70\x6f\x6f\x6a\x6a\x45\x57\x35\x79\x38\x2b\x65\x50\x76\x4c\x70" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:22 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshkey\testdata\rsa_1_sha512 EXT:  TYPE: Certificate PEM SIZE: 887 MD5: 197f14927e89c5c573213416bde709cb SHA1: 2f5cfafbddd00c351ce72e2f140458fb5ac7b60a SHA256: 07586a53bef4dd9daf59c473399fca5fcb39891bed0d2c2f8a88249e02392ac5 FIRSTBYTES: 2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA MODIFIED: Tue Mar  2 10:31:47.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1779733 ARCHIVE_MD5: 9eb9420cf587edc26f8998ab679ad390 ARCHIVE_SHA1: 72eadcbe313b07b1dd3b693e41d3cd56d354e24e ARCHIVE_SHA256: f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbde976db48962e5a7f / vH.Z ARCHIVE_CREATED: Fri Aug 30 07:32:13.477 2024 ARCHIVE_MODIFIED: Wed Mar  3 00:46:27.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:27:15.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x43\x58\x41\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x4c\x56\x35\x6c\x55\x54\x74\x37\x46\x72\x41\x44\x73\x65\x42\x2f\x43\x47\x68\x45\x5a\x7a\x70\x6f\x6f\x6a\x6a\x45\x57\x35\x79\x38\x2b\x65\x50\x76\x4c\x70" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:22 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshkey\testdata\rsa_2 EXT:  TYPE: Certificate PEM SIZE: 1679 MD5: c8860a2d208d222eade1e9866449ccbc SHA1: 64133ddc79d593e467c864c429e3793c69e4dc22 SHA256: e42925e663a7215e19cdc89bd9fe018903eeb013f131b188d3c87f0ef01c5a24 FIRSTBYTES: 2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA MODIFIED: Tue Mar  2 10:31:47.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1779733 ARCHIVE_MD5: 9eb9420cf587edc26f8998ab679ad390 ARCHIVE_SHA1: 72eadcbe313b07b1dd3b693e41d3cd56d354e24e ARCHIVE_SHA256: f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbde976db48962e5a7f / vH.Z ARCHIVE_CREATED: Fri Aug 30 07:32:13.477 2024 ARCHIVE_MODIFIED: Wed Mar  3 00:46:27.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:27:15.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x45\x70\x41\x49\x42\x41\x41\x4b\x43\x41\x51\x45\x41\x39\x4e\x45\x55\x58\x70\x37\x38\x53\x41\x6b\x6d\x4c\x34\x2b\x65\x41\x6a\x34\x6d\x42\x7a\x50\x4f\x6a\x6b\x2b\x63\x63\x43\x50\x56\x7a\x6b\x54\x52\x2b" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:22 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshkey\testdata\rsa_n EXT:  TYPE: Certificate PEM SIZE: 1020 MD5: d60f55c106077131ba136f02e9b9ba88 SHA1: d6a3a8961cb40e8a4ff03dbfd5983c9fc5dfeb39 SHA256: 0ad47d17d5f21f350c26c4c94564bf41b6fd28ab55187166b4f46b1b35daed6d FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Tue Mar  2 10:31:47.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1779733 ARCHIVE_MD5: 9eb9420cf587edc26f8998ab679ad390 ARCHIVE_SHA1: 72eadcbe313b07b1dd3b693e41d3cd56d354e24e ARCHIVE_SHA256: f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbde976db48962e5a7f / vH.Z ARCHIVE_CREATED: Fri Aug 30 07:32:13.477 2024 ARCHIVE_MODIFIED: Wed Mar  3 00:46:27.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:27:15.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x6c\x77\x41\x41\x41\x41\x64\x7a\x63\x32\x67\x74\x63\x6e\x0a\x4e\x68\x41\x41\x41\x41\x41\x77\x45\x41" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:22 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshsig\testdata\ecdsa EXT:  TYPE: Certificate PEM SIZE: 227 MD5: 53f2aa69e4e8d05ea1c0848c4a946b71 SHA1: 69a4f47fbbb55eb5dea9adea057509384a32bb69 SHA256: 585957bd0a19fcff2d22cd8af7ffb13b68cc30c9dc13dfefb57271b03f3a999f FIRSTBYTES: 2d2d2d2d2d424547494e20454320505249564154 / -----BEGIN EC PRIVAT MODIFIED: Tue Mar  2 10:31:47.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1779733 ARCHIVE_MD5: 9eb9420cf587edc26f8998ab679ad390 ARCHIVE_SHA1: 72eadcbe313b07b1dd3b693e41d3cd56d354e24e ARCHIVE_SHA256: f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbde976db48962e5a7f / vH.Z ARCHIVE_CREATED: Fri Aug 30 07:32:13.477 2024 ARCHIVE_MODIFIED: Wed Mar  3 00:46:27.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:27:15.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x48\x63\x43\x41\x51\x45\x45\x49\x46\x67\x30\x5a\x43\x53\x45\x42\x35\x4c\x4e\x65\x4c\x73\x58\x59\x4c\x32\x35\x67\x33\x6b\x71\x45\x57\x73\x71\x68\x35\x32\x44\x52\x2b\x79\x4e\x4f\x6a\x79\x51\x4a\x71\x79" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:22 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshsig\testdata\ecdsa_sk EXT:  TYPE: Certificate PEM SIZE: 837 MD5: 36948c6f96600caa24052b4d8322cbd9 SHA1: b7bf9e701f8da5d50f61064849d052e04fb77c3f SHA256: f81b969ccd3e85f02b71465ba38fb51b5adf6f11b09f2e9e82ed6b2ab31f2356 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Tue Mar  2 10:31:47.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1779733 ARCHIVE_MD5: 9eb9420cf587edc26f8998ab679ad390 ARCHIVE_SHA1: 72eadcbe313b07b1dd3b693e41d3cd56d354e24e ARCHIVE_SHA256: f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbde976db48962e5a7f / vH.Z ARCHIVE_CREATED: Fri Aug 30 07:32:13.477 2024 ARCHIVE_MODIFIED: Wed Mar  3 00:46:27.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:27:15.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x66\x77\x41\x41\x41\x43\x4a\x7a\x61\x79\x31\x6c\x59\x32\x0a\x52\x7a\x59\x53\x31\x7a\x61\x47\x45\x79" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:22 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshsig\testdata\ed25519 EXT:  TYPE: Certificate PEM SIZE: 411 MD5: 8bb197113a031c8f6d76de369316d0eb SHA1: 40847760b4f753f2b17156d3f6f9cdcc7c0b91d4 SHA256: c4683c666d6394fc5e8f3455b5379304979e0b41502560ddef20c824fa9fb66b FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Tue Mar  2 10:31:47.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1779733 ARCHIVE_MD5: 9eb9420cf587edc26f8998ab679ad390 ARCHIVE_SHA1: 72eadcbe313b07b1dd3b693e41d3cd56d354e24e ARCHIVE_SHA256: f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbde976db48962e5a7f / vH.Z ARCHIVE_CREATED: Fri Aug 30 07:32:13.477 2024 ARCHIVE_MODIFIED: Wed Mar  3 00:46:27.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:27:15.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:22 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshsig\testdata\ed25519_sk EXT:  TYPE: Certificate PEM SIZE: 484 MD5: 85bc2e18e08c06aa85cf023e7a97a585 SHA1: 95ea85c4709baf47e7cc2573ceac480cc35bde67 SHA256: 0e2221a7c8e8cea4fb6e9d2666b1d05166a3b0f5876c54433f0c35b564f22025 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Tue Mar  2 10:31:47.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1779733 ARCHIVE_MD5: 9eb9420cf587edc26f8998ab679ad390 ARCHIVE_SHA1: 72eadcbe313b07b1dd3b693e41d3cd56d354e24e ARCHIVE_SHA256: f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbde976db48962e5a7f / vH.Z ARCHIVE_CREATED: Fri Aug 30 07:32:13.477 2024 ARCHIVE_MODIFIED: Wed Mar  3 00:46:27.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:27:15.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x53\x67\x41\x41\x41\x42\x70\x7a\x61\x79\x31\x7a\x63\x32\x0a\x67\x74\x5a\x57\x51\x79\x4e\x54\x55\x78" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:22 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshsig\testdata\rsa EXT:  TYPE: Certificate PEM SIZE: 2455 MD5: efe804ccdc63abc29233f3a1e11e173b SHA1: 481c1773197aabc2d9d87336ad84f44410251ed4 SHA256: d7eb37f534b846bb582bcdcf78232bdb33932e34fb72d6bfa130a8fd699b10b6 FIRSTBYTES: 2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA MODIFIED: Tue Mar  2 10:31:47.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1779733 ARCHIVE_MD5: 9eb9420cf587edc26f8998ab679ad390 ARCHIVE_SHA1: 72eadcbe313b07b1dd3b693e41d3cd56d354e24e ARCHIVE_SHA256: f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbde976db48962e5a7f / vH.Z ARCHIVE_CREATED: Fri Aug 30 07:32:13.477 2024 ARCHIVE_MODIFIED: Wed Mar  3 00:46:27.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:27:15.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x47\x34\x77\x49\x42\x41\x41\x4b\x43\x41\x59\x45\x41\x33\x38\x36\x6c\x6d\x6a\x52\x48\x74\x4a\x70\x79\x6a\x38\x37\x42\x72\x53\x2b\x73\x73\x4d\x6d\x74\x76\x63\x2f\x31\x53\x50\x4e\x30\x67\x58\x54\x50\x73" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:24 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\ed25519_openssh.prv EXT: .prv TYPE: Certificate PEM SIZE: 419 MD5: c1d6034878b590c80805ad1e66039091 SHA1: 9127798b0fadd4539c81ee4f294287e8262eddb0 SHA256: 11bab46497954bd367ea5c2541cb3bad4814515481aee687fcdddc5680ee642d FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Sun Sep 26 14:03:19.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1815060 ARCHIVE_MD5: 8ce5f390958baeeab635aafd0ef41453 ARCHIVE_SHA1: 1eb964897a4372f6fb96c7effeb509ec71c379c9 ARCHIVE_SHA256: 4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbdeb76db46b62eda7f / vF. ARCHIVE_CREATED: Fri Aug 30 07:32:13.502 2024 ARCHIVE_MODIFIED: Sun Sep 26 14:39:51.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:26:04.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:24 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\misc\fuzz-harness\testdata\id_dsa EXT:  TYPE: Certificate PEM SIZE: 1361 MD5: a9521c2825fbf778b6b82b1dcda95d72 SHA1: 29bc6d9b491473450487aad65a659675154b8fb8 SHA256: a6fa247970fe3fe15b9647e9ae301495d10ea278dbe9516abdf70e69b1849744 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Sun Sep 26 14:03:19.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1815060 ARCHIVE_MD5: 8ce5f390958baeeab635aafd0ef41453 ARCHIVE_SHA1: 1eb964897a4372f6fb96c7effeb509ec71c379c9 ARCHIVE_SHA256: 4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbdeb76db46b62eda7f / vF. ARCHIVE_CREATED: Fri Aug 30 07:32:13.502 2024 ARCHIVE_MODIFIED: Sun Sep 26 14:39:51.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:26:04.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x42\x73\x67\x41\x41\x41\x41\x64\x7a\x63\x32\x67\x74\x5a\x48\x0a\x4e\x7a\x41\x41\x41\x41\x67\x51\x43\x73" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:24 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\misc\fuzz-harness\testdata\id_ecdsa EXT:  TYPE: Certificate PEM SIZE: 492 MD5: b14d14c4a2eb3a89c43be1d828fe2604 SHA1: 56c94a39972cc4c2ab982f6b206702cf3b558bde SHA256: 00120fd3e06a2c9a2debabe94c75cb9a8fb313d17b3a114dda6264874ae56c60 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Sun Sep 26 14:03:19.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1815060 ARCHIVE_MD5: 8ce5f390958baeeab635aafd0ef41453 ARCHIVE_SHA1: 1eb964897a4372f6fb96c7effeb509ec71c379c9 ARCHIVE_SHA256: 4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbdeb76db46b62eda7f / vF. ARCHIVE_CREATED: Fri Aug 30 07:32:13.502 2024 ARCHIVE_MODIFIED: Sun Sep 26 14:39:51.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:26:04.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x61\x41\x41\x41\x41\x42\x4e\x6c\x59\x32\x52\x7a\x59\x53\x0a\x31\x7a\x61\x47\x45\x79\x4c\x57\x35\x70" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:24 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\misc\fuzz-harness\testdata\id_ecdsa_sk EXT:  TYPE: Certificate PEM SIZE: 858 MD5: c87bc24fa8b257e7af7374511f44d2c5 SHA1: 2c1d6e64ad0052837b53739841f6acfc60a191ed SHA256: 50e6649901ffdf7bc4d85dd0f45937b9d99bdd85e472c112f8586bd3e35beb58 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Sun Sep 26 14:03:19.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1815060 ARCHIVE_MD5: 8ce5f390958baeeab635aafd0ef41453 ARCHIVE_SHA1: 1eb964897a4372f6fb96c7effeb509ec71c379c9 ARCHIVE_SHA256: 4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbdeb76db46b62eda7f / vF. ARCHIVE_CREATED: Fri Aug 30 07:32:13.502 2024 ARCHIVE_MODIFIED: Sun Sep 26 14:39:51.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:26:04.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x66\x77\x41\x41\x41\x43\x4a\x7a\x61\x79\x31\x6c\x59\x32\x0a\x52\x7a\x59\x53\x31\x7a\x61\x47\x45\x79" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:24 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\misc\fuzz-harness\testdata\id_ed25519 EXT:  TYPE: Certificate PEM SIZE: 387 MD5: 904e0a369a7fbe86bcb4e0bc1363c539 SHA1: 1074da4383390925d414ad562a0818a88e116208 SHA256: 6efecdbb70364afc9cf004e325a9a1d2673d86e85a6238e1126d6d105cea56c1 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Sun Sep 26 14:03:19.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1815060 ARCHIVE_MD5: 8ce5f390958baeeab635aafd0ef41453 ARCHIVE_SHA1: 1eb964897a4372f6fb96c7effeb509ec71c379c9 ARCHIVE_SHA256: 4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbdeb76db46b62eda7f / vF. ARCHIVE_CREATED: Fri Aug 30 07:32:13.502 2024 ARCHIVE_MODIFIED: Sun Sep 26 14:39:51.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:26:04.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:24 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\misc\fuzz-harness\testdata\id_ed25519_sk EXT:  TYPE: Certificate PEM SIZE: 496 MD5: c3c7cad31e9edf76f806848501011568 SHA1: f936a6c0f3b1250ef7fd0cbf4ea5a5d3c9c63507 SHA256: 5fd315701b14a13467331e1d0819a8016abdf5888ab695f068fce488bd37169d FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Sun Sep 26 14:03:19.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1815060 ARCHIVE_MD5: 8ce5f390958baeeab635aafd0ef41453 ARCHIVE_SHA1: 1eb964897a4372f6fb96c7effeb509ec71c379c9 ARCHIVE_SHA256: 4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbdeb76db46b62eda7f / vF. ARCHIVE_CREATED: Fri Aug 30 07:32:13.502 2024 ARCHIVE_MODIFIED: Sun Sep 26 14:39:51.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:26:04.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x53\x67\x41\x41\x41\x42\x70\x7a\x61\x79\x31\x7a\x63\x32\x0a\x67\x74\x5a\x57\x51\x79\x4e\x54\x55\x78" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:24 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\misc\fuzz-harness\testdata\id_rsa EXT:  TYPE: Certificate PEM SIZE: 1799 MD5: 0e4d9d0e310d6dc6a5c2d33660f70542 SHA1: 7bef427ad9067a465009d543787063fdaceef3e5 SHA256: 83822e39fb2ee059431a45c3c48cffcda3fb869273a364a45898ce9abad09e84 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Sun Sep 26 14:03:19.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1815060 ARCHIVE_MD5: 8ce5f390958baeeab635aafd0ef41453 ARCHIVE_SHA1: 1eb964897a4372f6fb96c7effeb509ec71c379c9 ARCHIVE_SHA256: 4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbdeb76db46b62eda7f / vF. ARCHIVE_CREATED: Fri Aug 30 07:32:13.502 2024 ARCHIVE_MODIFIED: Sun Sep 26 14:39:51.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:26:04.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x42\x46\x77\x41\x41\x41\x41\x64\x7a\x63\x32\x67\x74\x63\x6e\x0a\x4e\x68\x41\x41\x41\x41\x41\x77\x45\x41" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:24 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\rsa_openssh.prv EXT: .prv TYPE: Certificate PEM SIZE: 883 MD5: a6b110f820948e73bbde7b948744b3c5 SHA1: 614e6d353be614ded246a12ed6e14af20f063710 SHA256: 79b8783d0b10a3f65b9b3e349a1daa692cc27be08028131ff5a9a08799035f46 FIRSTBYTES: 2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA MODIFIED: Sun Sep 26 14:03:19.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1815060 ARCHIVE_MD5: 8ce5f390958baeeab635aafd0ef41453 ARCHIVE_SHA1: 1eb964897a4372f6fb96c7effeb509ec71c379c9 ARCHIVE_SHA256: 4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbdeb76db46b62eda7f / vF. ARCHIVE_CREATED: Fri Aug 30 07:32:13.502 2024 ARCHIVE_MODIFIED: Sun Sep 26 14:39:51.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:26:04.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x43\x57\x67\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x73\x69\x6c\x77\x4b\x63\x61\x4b\x4e\x36\x77\x53\x4d\x4e\x64\x31\x57\x67\x51\x39\x2b\x48\x52\x71\x51\x45\x6b\x44\x30\x6b\x43\x54\x56\x74\x74\x72\x61\x7a" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:25 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshkey\testdata\dsa_1 EXT:  TYPE: Certificate PEM SIZE: 672 MD5: aebcad00ac7fb84f1a7de01322c99be3 SHA1: a9a0e1cf84bee8c27802295819b399833e5d4d08 SHA256: b7f7c2bb695b28e585951a2da4ad2d6c933c440afe118798c6e2363e17da2b93 FIRSTBYTES: 2d2d2d2d2d424547494e20445341205052495641 / -----BEGIN DSA PRIVA MODIFIED: Sun Sep 26 14:03:19.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1815060 ARCHIVE_MD5: 8ce5f390958baeeab635aafd0ef41453 ARCHIVE_SHA1: 1eb964897a4372f6fb96c7effeb509ec71c379c9 ARCHIVE_SHA256: 4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbdeb76db46b62eda7f / vF. ARCHIVE_CREATED: Fri Aug 30 07:32:13.502 2024 ARCHIVE_MODIFIED: Sun Sep 26 14:39:51.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:26:04.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x44\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x42\x76\x41\x49\x42\x41\x41\x4b\x42\x67\x51" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x44\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x42\x76\x41\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x36\x6b\x75\x74\x4e\x46\x52\x73\x48\x54\x77\x45\x41\x76\x36\x64\x33\x39\x4c\x68\x73\x71\x79\x31\x61\x70\x64\x48\x42\x5a\x39\x63\x32\x48\x66\x79\x52\x72\x37\x57\x6d\x79\x70\x79\x47\x49\x79\x32\x6d" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:25 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshkey\testdata\dsa_n EXT:  TYPE: Certificate PEM SIZE: 1361 MD5: 6fcf088f9850b2f2213186cee4dc4811 SHA1: a04d604886c6a7c2217df9b7eea5c998da91d561 SHA256: db691de6aa454ec8aa45c84c58022a54611427f6f44c20d152ac05e0ea2284ba FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Sun Sep 26 14:03:19.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1815060 ARCHIVE_MD5: 8ce5f390958baeeab635aafd0ef41453 ARCHIVE_SHA1: 1eb964897a4372f6fb96c7effeb509ec71c379c9 ARCHIVE_SHA256: 4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbdeb76db46b62eda7f / vF. ARCHIVE_CREATED: Fri Aug 30 07:32:13.502 2024 ARCHIVE_MODIFIED: Sun Sep 26 14:39:51.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:26:04.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x42\x73\x77\x41\x41\x41\x41\x64\x7a\x63\x32\x67\x74\x5a\x48\x0a\x4e\x7a\x41\x41\x41\x41\x67\x51\x44\x36" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:25 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshkey\testdata\ecdsa_1 EXT:  TYPE: Certificate PEM SIZE: 227 MD5: 610b43e1fd8e09f2794aba398c6950eb SHA1: c7e5b5ff84b30ff8880e4d75942a600d012516b6 SHA256: 42a90746ef5975c6ef98c6d56305dad0bc698a1b05c83518bc90584c83935d5c FIRSTBYTES: 2d2d2d2d2d424547494e20454320505249564154 / -----BEGIN EC PRIVAT MODIFIED: Sun Sep 26 14:03:19.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1815060 ARCHIVE_MD5: 8ce5f390958baeeab635aafd0ef41453 ARCHIVE_SHA1: 1eb964897a4372f6fb96c7effeb509ec71c379c9 ARCHIVE_SHA256: 4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbdeb76db46b62eda7f / vF. ARCHIVE_CREATED: Fri Aug 30 07:32:13.502 2024 ARCHIVE_MODIFIED: Sun Sep 26 14:39:51.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:26:04.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x48\x63\x43\x41\x51\x45\x45\x49\x50\x50\x4e\x79\x55\x41\x6e\x6a\x76\x46\x72\x2b\x65\x54\x2f\x37\x74\x2f\x49\x79\x6a\x75\x51\x51\x64\x2f\x61\x4c\x46\x69\x54\x59\x39\x32\x4c\x42\x39\x67\x49\x6a\x79\x72" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:25 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshkey\testdata\ecdsa_2 EXT:  TYPE: Certificate PEM SIZE: 365 MD5: 0346ad9a21f23d98cb3abe4845df078d SHA1: 07091af93e22c676e03e6f96e9d0e53c9b53d775 SHA256: 320396e36bd5ecc12089f26849f8e7b6e0ab3c037f0492dee978cef6646d5826 FIRSTBYTES: 2d2d2d2d2d424547494e20454320505249564154 / -----BEGIN EC PRIVAT MODIFIED: Sun Sep 26 14:03:19.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1815060 ARCHIVE_MD5: 8ce5f390958baeeab635aafd0ef41453 ARCHIVE_SHA1: 1eb964897a4372f6fb96c7effeb509ec71c379c9 ARCHIVE_SHA256: 4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbdeb76db46b62eda7f / vF. ARCHIVE_CREATED: Fri Aug 30 07:32:13.502 2024 ARCHIVE_MODIFIED: Sun Sep 26 14:39:51.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:26:04.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x48\x63\x41\x67\x45\x42\x42\x45\x49\x42\x71\x42\x74\x4e\x37\x65\x36\x45\x73\x73\x64\x33\x64\x6c\x73\x67\x49\x53\x56\x69\x50\x43\x58\x58\x43\x30\x61\x74\x6c\x4e\x6b\x47\x74\x6f\x4d\x67\x53\x51\x64" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:25 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshkey\testdata\ecdsa_n EXT:  TYPE: Certificate PEM SIZE: 492 MD5: 0ffc5b7197ecb4b69f503d4f3cc24c8c SHA1: c2c7fd9527d9cc84781346a3ac8e2100d4d20ad3 SHA256: 1cccaa23aca49238099494fc7b49b550311719c9ac6bb138797e1077f4d7973d FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Sun Sep 26 14:03:19.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1815060 ARCHIVE_MD5: 8ce5f390958baeeab635aafd0ef41453 ARCHIVE_SHA1: 1eb964897a4372f6fb96c7effeb509ec71c379c9 ARCHIVE_SHA256: 4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbdeb76db46b62eda7f / vF. ARCHIVE_CREATED: Fri Aug 30 07:32:13.502 2024 ARCHIVE_MODIFIED: Sun Sep 26 14:39:51.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:26:04.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x61\x41\x41\x41\x41\x42\x4e\x6c\x59\x32\x52\x7a\x59\x53\x0a\x31\x7a\x61\x47\x45\x79\x4c\x57\x35\x70" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:25 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshkey\testdata\ecdsa_sk1 EXT:  TYPE: Certificate PEM SIZE: 849 MD5: 97206cfa158fdda5a45c6eb542f739c0 SHA1: e55ec614db8cea92d7269d5f903cf72baca36454 SHA256: e4df7ea4ca133a7457069be073203c556166c65635ed6fb6c12b9a84f027346e FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Sun Sep 26 14:03:19.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1815060 ARCHIVE_MD5: 8ce5f390958baeeab635aafd0ef41453 ARCHIVE_SHA1: 1eb964897a4372f6fb96c7effeb509ec71c379c9 ARCHIVE_SHA256: 4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbdeb76db46b62eda7f / vF. ARCHIVE_CREATED: Fri Aug 30 07:32:13.502 2024 ARCHIVE_MODIFIED: Sun Sep 26 14:39:51.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:26:04.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x66\x77\x41\x41\x41\x43\x4a\x7a\x61\x79\x31\x6c\x59\x32\x0a\x52\x7a\x59\x53\x31\x7a\x61\x47\x45\x79" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:25 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshkey\testdata\ecdsa_sk2 EXT:  TYPE: Certificate PEM SIZE: 849 MD5: 14ecb7595ee296b15d413ae395454a4c SHA1: 909379299593aeebc79f44df0ec22578123acce7 SHA256: de6f60d862f799ca088bd4611865e24bb0635d81097bb9496f0178aefa4acbae FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Sun Sep 26 14:03:19.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1815060 ARCHIVE_MD5: 8ce5f390958baeeab635aafd0ef41453 ARCHIVE_SHA1: 1eb964897a4372f6fb96c7effeb509ec71c379c9 ARCHIVE_SHA256: 4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbdeb76db46b62eda7f / vF. ARCHIVE_CREATED: Fri Aug 30 07:32:13.502 2024 ARCHIVE_MODIFIED: Sun Sep 26 14:39:51.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:26:04.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x66\x77\x41\x41\x41\x43\x4a\x7a\x61\x79\x31\x6c\x59\x32\x0a\x52\x7a\x59\x53\x31\x7a\x61\x47\x45\x79" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:25 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshkey\testdata\ed25519_1 EXT:  TYPE: Certificate PEM SIZE: 411 MD5: 514e8e39c48edb2b8934ef78a5030042 SHA1: a7a368a6f3d09bc2cfc1315f6e0899bde0574ffd SHA256: 74f95c1990e3512af471cf6fb58d08a8078bbab597e7ee86a7ccd233f6855fd1 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Sun Sep 26 14:03:19.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1815060 ARCHIVE_MD5: 8ce5f390958baeeab635aafd0ef41453 ARCHIVE_SHA1: 1eb964897a4372f6fb96c7effeb509ec71c379c9 ARCHIVE_SHA256: 4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbdeb76db46b62eda7f / vF. ARCHIVE_CREATED: Fri Aug 30 07:32:13.502 2024 ARCHIVE_MODIFIED: Sun Sep 26 14:39:51.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:26:04.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:25 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshkey\testdata\ed25519_2 EXT:  TYPE: Certificate PEM SIZE: 411 MD5: bfc2ac8495dbc6070241303ec50a6dc2 SHA1: 53e388e7c836c6ba874e852d71a6e1e708611d25 SHA256: 31689f4706b3bdad29ee21b05af62e9f2257399d07092089944514ed5edb131d FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Sun Sep 26 14:03:19.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1815060 ARCHIVE_MD5: 8ce5f390958baeeab635aafd0ef41453 ARCHIVE_SHA1: 1eb964897a4372f6fb96c7effeb509ec71c379c9 ARCHIVE_SHA256: 4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbdeb76db46b62eda7f / vF. ARCHIVE_CREATED: Fri Aug 30 07:32:13.502 2024 ARCHIVE_MODIFIED: Sun Sep 26 14:39:51.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:26:04.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:25 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshkey\testdata\ed25519_sk1 EXT:  TYPE: Certificate PEM SIZE: 484 MD5: ab9dcdbff00763217a3f85069a9c2f67 SHA1: 05396ad046c37370093f48c0bdb2510b8894aa76 SHA256: 45c058d08280c4ca36a9d020478504cd550e7c5752c207d182363c3edf669ce8 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Sun Sep 26 14:03:19.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1815060 ARCHIVE_MD5: 8ce5f390958baeeab635aafd0ef41453 ARCHIVE_SHA1: 1eb964897a4372f6fb96c7effeb509ec71c379c9 ARCHIVE_SHA256: 4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbdeb76db46b62eda7f / vF. ARCHIVE_CREATED: Fri Aug 30 07:32:13.502 2024 ARCHIVE_MODIFIED: Sun Sep 26 14:39:51.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:26:04.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x53\x67\x41\x41\x41\x42\x70\x7a\x61\x79\x31\x7a\x63\x32\x0a\x67\x74\x5a\x57\x51\x79\x4e\x54\x55\x78" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:25 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshkey\testdata\ed25519_sk2 EXT:  TYPE: Certificate PEM SIZE: 484 MD5: 8a666562de41f71d57d47c5f6404293a SHA1: 069c9341d4b0cd94669ff23feab92853b6a42540 SHA256: b862e169114ee63ae5e8497110075a9e67c4e3f24bad01e7c06951d268a3ec0f FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Sun Sep 26 14:03:19.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1815060 ARCHIVE_MD5: 8ce5f390958baeeab635aafd0ef41453 ARCHIVE_SHA1: 1eb964897a4372f6fb96c7effeb509ec71c379c9 ARCHIVE_SHA256: 4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbdeb76db46b62eda7f / vF. ARCHIVE_CREATED: Fri Aug 30 07:32:13.502 2024 ARCHIVE_MODIFIED: Sun Sep 26 14:39:51.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:26:04.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x53\x67\x41\x41\x41\x42\x70\x7a\x61\x79\x31\x7a\x63\x32\x0a\x67\x74\x5a\x57\x51\x79\x4e\x54\x55\x78" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:25 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshkey\testdata\rsa_1 EXT:  TYPE: Certificate PEM SIZE: 887 MD5: 197f14927e89c5c573213416bde709cb SHA1: 2f5cfafbddd00c351ce72e2f140458fb5ac7b60a SHA256: 07586a53bef4dd9daf59c473399fca5fcb39891bed0d2c2f8a88249e02392ac5 FIRSTBYTES: 2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA MODIFIED: Sun Sep 26 14:03:19.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1815060 ARCHIVE_MD5: 8ce5f390958baeeab635aafd0ef41453 ARCHIVE_SHA1: 1eb964897a4372f6fb96c7effeb509ec71c379c9 ARCHIVE_SHA256: 4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbdeb76db46b62eda7f / vF. ARCHIVE_CREATED: Fri Aug 30 07:32:13.502 2024 ARCHIVE_MODIFIED: Sun Sep 26 14:39:51.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:26:04.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x43\x58\x41\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x4c\x56\x35\x6c\x55\x54\x74\x37\x46\x72\x41\x44\x73\x65\x42\x2f\x43\x47\x68\x45\x5a\x7a\x70\x6f\x6f\x6a\x6a\x45\x57\x35\x79\x38\x2b\x65\x50\x76\x4c\x70" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:25 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshkey\testdata\rsa_1_sha1 EXT:  TYPE: Certificate PEM SIZE: 887 MD5: 197f14927e89c5c573213416bde709cb SHA1: 2f5cfafbddd00c351ce72e2f140458fb5ac7b60a SHA256: 07586a53bef4dd9daf59c473399fca5fcb39891bed0d2c2f8a88249e02392ac5 FIRSTBYTES: 2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA MODIFIED: Sun Sep 26 14:03:19.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1815060 ARCHIVE_MD5: 8ce5f390958baeeab635aafd0ef41453 ARCHIVE_SHA1: 1eb964897a4372f6fb96c7effeb509ec71c379c9 ARCHIVE_SHA256: 4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbdeb76db46b62eda7f / vF. ARCHIVE_CREATED: Fri Aug 30 07:32:13.502 2024 ARCHIVE_MODIFIED: Sun Sep 26 14:39:51.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:26:04.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x43\x58\x41\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x4c\x56\x35\x6c\x55\x54\x74\x37\x46\x72\x41\x44\x73\x65\x42\x2f\x43\x47\x68\x45\x5a\x7a\x70\x6f\x6f\x6a\x6a\x45\x57\x35\x79\x38\x2b\x65\x50\x76\x4c\x70" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:25 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshkey\testdata\rsa_1_sha512 EXT:  TYPE: Certificate PEM SIZE: 887 MD5: 197f14927e89c5c573213416bde709cb SHA1: 2f5cfafbddd00c351ce72e2f140458fb5ac7b60a SHA256: 07586a53bef4dd9daf59c473399fca5fcb39891bed0d2c2f8a88249e02392ac5 FIRSTBYTES: 2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA MODIFIED: Sun Sep 26 14:03:19.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1815060 ARCHIVE_MD5: 8ce5f390958baeeab635aafd0ef41453 ARCHIVE_SHA1: 1eb964897a4372f6fb96c7effeb509ec71c379c9 ARCHIVE_SHA256: 4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbdeb76db46b62eda7f / vF. ARCHIVE_CREATED: Fri Aug 30 07:32:13.502 2024 ARCHIVE_MODIFIED: Sun Sep 26 14:39:51.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:26:04.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x43\x58\x41\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x4c\x56\x35\x6c\x55\x54\x74\x37\x46\x72\x41\x44\x73\x65\x42\x2f\x43\x47\x68\x45\x5a\x7a\x70\x6f\x6f\x6a\x6a\x45\x57\x35\x79\x38\x2b\x65\x50\x76\x4c\x70" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:25 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshkey\testdata\rsa_2 EXT:  TYPE: Certificate PEM SIZE: 1679 MD5: c8860a2d208d222eade1e9866449ccbc SHA1: 64133ddc79d593e467c864c429e3793c69e4dc22 SHA256: e42925e663a7215e19cdc89bd9fe018903eeb013f131b188d3c87f0ef01c5a24 FIRSTBYTES: 2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA MODIFIED: Sun Sep 26 14:03:19.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1815060 ARCHIVE_MD5: 8ce5f390958baeeab635aafd0ef41453 ARCHIVE_SHA1: 1eb964897a4372f6fb96c7effeb509ec71c379c9 ARCHIVE_SHA256: 4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbdeb76db46b62eda7f / vF. ARCHIVE_CREATED: Fri Aug 30 07:32:13.502 2024 ARCHIVE_MODIFIED: Sun Sep 26 14:39:51.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:26:04.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x45\x70\x41\x49\x42\x41\x41\x4b\x43\x41\x51\x45\x41\x39\x4e\x45\x55\x58\x70\x37\x38\x53\x41\x6b\x6d\x4c\x34\x2b\x65\x41\x6a\x34\x6d\x42\x7a\x50\x4f\x6a\x6b\x2b\x63\x63\x43\x50\x56\x7a\x6b\x54\x52\x2b" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:25 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshkey\testdata\rsa_n EXT:  TYPE: Certificate PEM SIZE: 1020 MD5: d60f55c106077131ba136f02e9b9ba88 SHA1: d6a3a8961cb40e8a4ff03dbfd5983c9fc5dfeb39 SHA256: 0ad47d17d5f21f350c26c4c94564bf41b6fd28ab55187166b4f46b1b35daed6d FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Sun Sep 26 14:03:19.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1815060 ARCHIVE_MD5: 8ce5f390958baeeab635aafd0ef41453 ARCHIVE_SHA1: 1eb964897a4372f6fb96c7effeb509ec71c379c9 ARCHIVE_SHA256: 4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbdeb76db46b62eda7f / vF. ARCHIVE_CREATED: Fri Aug 30 07:32:13.502 2024 ARCHIVE_MODIFIED: Sun Sep 26 14:39:51.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:26:04.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x6c\x77\x41\x41\x41\x41\x64\x7a\x63\x32\x67\x74\x63\x6e\x0a\x4e\x68\x41\x41\x41\x41\x41\x77\x45\x41" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:25 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshsig\testdata\ecdsa EXT:  TYPE: Certificate PEM SIZE: 227 MD5: 53f2aa69e4e8d05ea1c0848c4a946b71 SHA1: 69a4f47fbbb55eb5dea9adea057509384a32bb69 SHA256: 585957bd0a19fcff2d22cd8af7ffb13b68cc30c9dc13dfefb57271b03f3a999f FIRSTBYTES: 2d2d2d2d2d424547494e20454320505249564154 / -----BEGIN EC PRIVAT MODIFIED: Sun Sep 26 14:03:19.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1815060 ARCHIVE_MD5: 8ce5f390958baeeab635aafd0ef41453 ARCHIVE_SHA1: 1eb964897a4372f6fb96c7effeb509ec71c379c9 ARCHIVE_SHA256: 4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbdeb76db46b62eda7f / vF. ARCHIVE_CREATED: Fri Aug 30 07:32:13.502 2024 ARCHIVE_MODIFIED: Sun Sep 26 14:39:51.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:26:04.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x48\x63\x43\x41\x51\x45\x45\x49\x46\x67\x30\x5a\x43\x53\x45\x42\x35\x4c\x4e\x65\x4c\x73\x58\x59\x4c\x32\x35\x67\x33\x6b\x71\x45\x57\x73\x71\x68\x35\x32\x44\x52\x2b\x79\x4e\x4f\x6a\x79\x51\x4a\x71\x79" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:25 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshsig\testdata\ecdsa_sk EXT:  TYPE: Certificate PEM SIZE: 837 MD5: 36948c6f96600caa24052b4d8322cbd9 SHA1: b7bf9e701f8da5d50f61064849d052e04fb77c3f SHA256: f81b969ccd3e85f02b71465ba38fb51b5adf6f11b09f2e9e82ed6b2ab31f2356 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Sun Sep 26 14:03:19.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1815060 ARCHIVE_MD5: 8ce5f390958baeeab635aafd0ef41453 ARCHIVE_SHA1: 1eb964897a4372f6fb96c7effeb509ec71c379c9 ARCHIVE_SHA256: 4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbdeb76db46b62eda7f / vF. ARCHIVE_CREATED: Fri Aug 30 07:32:13.502 2024 ARCHIVE_MODIFIED: Sun Sep 26 14:39:51.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:26:04.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x66\x77\x41\x41\x41\x43\x4a\x7a\x61\x79\x31\x6c\x59\x32\x0a\x52\x7a\x59\x53\x31\x7a\x61\x47\x45\x79" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:25 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshsig\testdata\ed25519 EXT:  TYPE: Certificate PEM SIZE: 411 MD5: 8bb197113a031c8f6d76de369316d0eb SHA1: 40847760b4f753f2b17156d3f6f9cdcc7c0b91d4 SHA256: c4683c666d6394fc5e8f3455b5379304979e0b41502560ddef20c824fa9fb66b FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Sun Sep 26 14:03:19.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1815060 ARCHIVE_MD5: 8ce5f390958baeeab635aafd0ef41453 ARCHIVE_SHA1: 1eb964897a4372f6fb96c7effeb509ec71c379c9 ARCHIVE_SHA256: 4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbdeb76db46b62eda7f / vF. ARCHIVE_CREATED: Fri Aug 30 07:32:13.502 2024 ARCHIVE_MODIFIED: Sun Sep 26 14:39:51.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:26:04.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:25 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshsig\testdata\ed25519_sk EXT:  TYPE: Certificate PEM SIZE: 484 MD5: 85bc2e18e08c06aa85cf023e7a97a585 SHA1: 95ea85c4709baf47e7cc2573ceac480cc35bde67 SHA256: 0e2221a7c8e8cea4fb6e9d2666b1d05166a3b0f5876c54433f0c35b564f22025 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P MODIFIED: Sun Sep 26 14:03:19.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1815060 ARCHIVE_MD5: 8ce5f390958baeeab635aafd0ef41453 ARCHIVE_SHA1: 1eb964897a4372f6fb96c7effeb509ec71c379c9 ARCHIVE_SHA256: 4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbdeb76db46b62eda7f / vF. ARCHIVE_CREATED: Fri Aug 30 07:32:13.502 2024 ARCHIVE_MODIFIED: Sun Sep 26 14:39:51.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:26:04.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x53\x67\x41\x41\x41\x42\x70\x7a\x61\x79\x31\x7a\x63\x32\x0a\x67\x74\x5a\x57\x51\x79\x4e\x54\x55\x78" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:25 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshsig\testdata\rsa EXT:  TYPE: Certificate PEM SIZE: 2455 MD5: efe804ccdc63abc29233f3a1e11e173b SHA1: 481c1773197aabc2d9d87336ad84f44410251ed4 SHA256: d7eb37f534b846bb582bcdcf78232bdb33932e34fb72d6bfa130a8fd699b10b6 FIRSTBYTES: 2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA MODIFIED: Sun Sep 26 14:03:19.000 2021 PERMISSIONS:  ARCHIVE_FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz ARCHIVE_TYPE: GZIP ARCHIVE_SIZE: 1815060 ARCHIVE_MD5: 8ce5f390958baeeab635aafd0ef41453 ARCHIVE_SHA1: 1eb964897a4372f6fb96c7effeb509ec71c379c9 ARCHIVE_SHA256: 4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9 ARCHIVE_FIRSTBYTES: 1f8b0800000000000003ecbdeb76db46b62eda7f / vF. ARCHIVE_CREATED: Fri Aug 30 07:32:13.502 2024 ARCHIVE_MODIFIED: Sun Sep 26 14:39:51.000 2021 ARCHIVE_ACCESSED: Tue May 14 16:26:04.000 2024 ARCHIVE_PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F ARCHIVE_OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x47\x34\x77\x49\x42\x41\x41\x4b\x43\x41\x59\x45\x41\x33\x38\x36\x6c\x6d\x6a\x52\x48\x74\x4a\x70\x79\x6a\x38\x37\x42\x72\x53\x2b\x73\x73\x4d\x6d\x74\x76\x63\x2f\x31\x53\x50\x4e\x30\x67\x58\x54\x50\x73" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:32:26 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 40 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\smtp.pcap EXT: .pcap TYPE: WINPCAP SIZE: 28256 MD5: 8e435e4a69aa549f04f2d04073ab3061 SHA1: 874b25c64a8fdb78a2ece4be8b0520299e74122d SHA256: 50852b1041256763e9233e88c18d1ec3505820bc3df4d3045f87ee2ef7a89fe2 FIRSTBYTES: d4c3b2a102000400000000000000000000000400 / ò CREATED: Fri Aug 30 07:32:13.607 2024 MODIFIED: Thu Feb 11 15:04:38.000 2021 ACCESSED: Tue May 14 16:15:54.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule SUSP_WinPCap_Nov21 / WinPCap file found SUBSCORE_1: 40 REF_1: Internal Research SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: (none) RULEDATE_1: 2021-11-12 TAGS_1: EXTVAR, FILE, METARULE, SUSP RULENAME_1: SUSP_WinPCap_Nov21 AUTHOR_1: Max Altgelt REASONS_COUNT: 1
Aug 30 08:33:11 WIN-LRTT94FA08M/10.100.5.12 THOR: Warning: MODULE: Filescan MESSAGE: Possibly Dangerous file found SCANID: S-dM24AZNR1hE SCORE: 70 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\.cache\composer\repo\https---repo.packagist.org\p-provider-2019-07.json EXT: .json TYPE: UNKNOWN SIZE: 2216307 MD5: 8e950fa473ea314a8fcf3632b27fd48d SHA1: 4b77fdf2be0cec8ec91090c7138603ca990cbfa5 SHA256: 9e16e658955dcc7c4f8c7808f5492b84f43c10784b87557024fb0ede0913c2c8 FIRSTBYTES: 7b2270726f766964657273223a7b22302e302e30 / {"providers":{"0.0.0 CREATED: Fri Aug 30 07:30:27.859 2024 MODIFIED: Mon Feb  3 14:17:02.000 2020 ACCESSED: Tue May 14 16:13:09.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule SUSP_JS_Dropping_Exe_Aug23 / Detects JavaScript file that drops executables SUBSCORE_1: 70 REF_1: https://twitter.com/James_inthe_box/status/1674105216575373312 SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\"4d5a" in "c88af246862def815\"},\"carno-php/serving\":{\"sha256\":\"4d5abf1f8ae6ebf1fa75860d47845d9a8c944ee01d8529c95c571d" at 0x433cd Str2: "powershell" in "0eca93a8c250536ecb27819edf\"},\"alissonpelizaro/ssh_powershell\":{\"sha256\":\"d542da6654214697055931a1024fc2ffc2862" at 0x11454 RULEDATE_1: 2023-08-03 TAGS_1: EXE, FILE, SUSP RULENAME_1: SUSP_JS_Dropping_Exe_Aug23 AUTHOR_1: X__Junior REASONS_COUNT: 1
Aug 30 08:34:23 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1\regress\rsa_openssh.prv EXT: .prv TYPE: Certificate PEM SIZE: 883 MD5: a6b110f820948e73bbde7b948744b3c5 SHA1: 614e6d353be614ded246a12ed6e14af20f063710 SHA256: 79b8783d0b10a3f65b9b3e349a1daa692cc27be08028131ff5a9a08799035f46 FIRSTBYTES: 2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA CREATED: Fri Aug 30 07:33:06.031 2024 MODIFIED: Tue Mar  2 10:31:47.000 2021 ACCESSED: Tue May 14 16:23:57.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x43\x57\x67\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x73\x69\x6c\x77\x4b\x63\x61\x4b\x4e\x36\x77\x53\x4d\x4e\x64\x31\x57\x67\x51\x39\x2b\x48\x52\x71\x51\x45\x6b\x44\x30\x6b\x43\x54\x56\x74\x74\x72\x61\x7a" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:34:23 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1\regress\misc\fuzz-harness\testdata\id_dsa EXT:  TYPE: Certificate PEM SIZE: 1361 MD5: a9521c2825fbf778b6b82b1dcda95d72 SHA1: 29bc6d9b491473450487aad65a659675154b8fb8 SHA256: a6fa247970fe3fe15b9647e9ae301495d10ea278dbe9516abdf70e69b1849744 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Fri Aug 30 07:33:06.014 2024 MODIFIED: Tue Mar  2 10:31:47.000 2021 ACCESSED: Tue May 14 16:19:37.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x42\x73\x67\x41\x41\x41\x41\x64\x7a\x63\x32\x67\x74\x5a\x48\x0a\x4e\x7a\x41\x41\x41\x41\x67\x51\x43\x73" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:34:23 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1\regress\misc\fuzz-harness\testdata\id_ecdsa EXT:  TYPE: Certificate PEM SIZE: 492 MD5: b14d14c4a2eb3a89c43be1d828fe2604 SHA1: 56c94a39972cc4c2ab982f6b206702cf3b558bde SHA256: 00120fd3e06a2c9a2debabe94c75cb9a8fb313d17b3a114dda6264874ae56c60 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Fri Aug 30 07:33:06.015 2024 MODIFIED: Tue Mar  2 10:31:47.000 2021 ACCESSED: Tue May 14 16:19:54.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x61\x41\x41\x41\x41\x42\x4e\x6c\x59\x32\x52\x7a\x59\x53\x0a\x31\x7a\x61\x47\x45\x79\x4c\x57\x35\x70" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:34:23 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1\regress\misc\fuzz-harness\testdata\id_ecdsa_sk EXT:  TYPE: Certificate PEM SIZE: 858 MD5: c87bc24fa8b257e7af7374511f44d2c5 SHA1: 2c1d6e64ad0052837b53739841f6acfc60a191ed SHA256: 50e6649901ffdf7bc4d85dd0f45937b9d99bdd85e472c112f8586bd3e35beb58 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Fri Aug 30 07:33:06.016 2024 MODIFIED: Tue Mar  2 10:31:47.000 2021 ACCESSED: Tue May 14 16:20:12.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x66\x77\x41\x41\x41\x43\x4a\x7a\x61\x79\x31\x6c\x59\x32\x0a\x52\x7a\x59\x53\x31\x7a\x61\x47\x45\x79" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:34:23 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1\regress\misc\fuzz-harness\testdata\id_ed25519 EXT:  TYPE: Certificate PEM SIZE: 387 MD5: 904e0a369a7fbe86bcb4e0bc1363c539 SHA1: 1074da4383390925d414ad562a0818a88e116208 SHA256: 6efecdbb70364afc9cf004e325a9a1d2673d86e85a6238e1126d6d105cea56c1 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Fri Aug 30 07:33:06.018 2024 MODIFIED: Tue Mar  2 10:31:47.000 2021 ACCESSED: Tue May 14 16:20:29.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:34:23 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1\regress\misc\fuzz-harness\testdata\id_ed25519_sk EXT:  TYPE: Certificate PEM SIZE: 496 MD5: c3c7cad31e9edf76f806848501011568 SHA1: f936a6c0f3b1250ef7fd0cbf4ea5a5d3c9c63507 SHA256: 5fd315701b14a13467331e1d0819a8016abdf5888ab695f068fce488bd37169d FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Fri Aug 30 07:33:06.019 2024 MODIFIED: Tue Mar  2 10:31:47.000 2021 ACCESSED: Tue May 14 16:20:45.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x53\x67\x41\x41\x41\x42\x70\x7a\x61\x79\x31\x7a\x63\x32\x0a\x67\x74\x5a\x57\x51\x79\x4e\x54\x55\x78" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:34:23 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1\regress\misc\fuzz-harness\testdata\id_rsa EXT:  TYPE: Certificate PEM SIZE: 1799 MD5: 0e4d9d0e310d6dc6a5c2d33660f70542 SHA1: 7bef427ad9067a465009d543787063fdaceef3e5 SHA256: 83822e39fb2ee059431a45c3c48cffcda3fb869273a364a45898ce9abad09e84 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Fri Aug 30 07:33:06.021 2024 MODIFIED: Tue Mar  2 10:31:47.000 2021 ACCESSED: Tue May 14 16:21:03.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x42\x46\x77\x41\x41\x41\x41\x64\x7a\x63\x32\x67\x74\x63\x6e\x0a\x4e\x68\x41\x41\x41\x41\x41\x77\x45\x41" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:34:24 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1\regress\unittests\sshkey\testdata\dsa_1 EXT:  TYPE: Certificate PEM SIZE: 672 MD5: aebcad00ac7fb84f1a7de01322c99be3 SHA1: a9a0e1cf84bee8c27802295819b399833e5d4d08 SHA256: b7f7c2bb695b28e585951a2da4ad2d6c933c440afe118798c6e2363e17da2b93 FIRSTBYTES: 2d2d2d2d2d424547494e20445341205052495641 / -----BEGIN DSA PRIVA CREATED: Fri Aug 30 07:33:06.106 2024 MODIFIED: Tue Mar  2 10:31:47.000 2021 ACCESSED: Tue May 14 16:23:16.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x44\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x42\x76\x41\x49\x42\x41\x41\x4b\x42\x67\x51" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x44\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x42\x76\x41\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x36\x6b\x75\x74\x4e\x46\x52\x73\x48\x54\x77\x45\x41\x76\x36\x64\x33\x39\x4c\x68\x73\x71\x79\x31\x61\x70\x64\x48\x42\x5a\x39\x63\x32\x48\x66\x79\x52\x72\x37\x57\x6d\x79\x70\x79\x47\x49\x79\x32\x6d" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:34:24 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1\regress\unittests\sshkey\testdata\dsa_n EXT:  TYPE: Certificate PEM SIZE: 1361 MD5: 6fcf088f9850b2f2213186cee4dc4811 SHA1: a04d604886c6a7c2217df9b7eea5c998da91d561 SHA256: db691de6aa454ec8aa45c84c58022a54611427f6f44c20d152ac05e0ea2284ba FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Fri Aug 30 07:33:06.123 2024 MODIFIED: Tue Mar  2 10:31:47.000 2021 ACCESSED: Tue May 14 16:25:22.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x42\x73\x77\x41\x41\x41\x41\x64\x7a\x63\x32\x67\x74\x5a\x48\x0a\x4e\x7a\x41\x41\x41\x41\x67\x51\x44\x36" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:34:24 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1\regress\unittests\sshkey\testdata\ecdsa_1 EXT:  TYPE: Certificate PEM SIZE: 227 MD5: 610b43e1fd8e09f2794aba398c6950eb SHA1: c7e5b5ff84b30ff8880e4d75942a600d012516b6 SHA256: 42a90746ef5975c6ef98c6d56305dad0bc698a1b05c83518bc90584c83935d5c FIRSTBYTES: 2d2d2d2d2d424547494e20454320505249564154 / -----BEGIN EC PRIVAT CREATED: Fri Aug 30 07:33:06.124 2024 MODIFIED: Tue Mar  2 10:31:47.000 2021 ACCESSED: Tue May 14 16:25:39.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x48\x63\x43\x41\x51\x45\x45\x49\x50\x50\x4e\x79\x55\x41\x6e\x6a\x76\x46\x72\x2b\x65\x54\x2f\x37\x74\x2f\x49\x79\x6a\x75\x51\x51\x64\x2f\x61\x4c\x46\x69\x54\x59\x39\x32\x4c\x42\x39\x67\x49\x6a\x79\x72" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:34:24 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1\regress\unittests\sshkey\testdata\ecdsa_2 EXT:  TYPE: Certificate PEM SIZE: 365 MD5: 0346ad9a21f23d98cb3abe4845df078d SHA1: 07091af93e22c676e03e6f96e9d0e53c9b53d775 SHA256: 320396e36bd5ecc12089f26849f8e7b6e0ab3c037f0492dee978cef6646d5826 FIRSTBYTES: 2d2d2d2d2d424547494e20454320505249564154 / -----BEGIN EC PRIVAT CREATED: Fri Aug 30 07:33:06.126 2024 MODIFIED: Tue Mar  2 10:31:47.000 2021 ACCESSED: Tue May 14 16:27:24.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x48\x63\x41\x67\x45\x42\x42\x45\x49\x42\x71\x42\x74\x4e\x37\x65\x36\x45\x73\x73\x64\x33\x64\x6c\x73\x67\x49\x53\x56\x69\x50\x43\x58\x58\x43\x30\x61\x74\x6c\x4e\x6b\x47\x74\x6f\x4d\x67\x53\x51\x64" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:34:24 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1\regress\unittests\sshkey\testdata\ecdsa_n EXT:  TYPE: Certificate PEM SIZE: 492 MD5: 0ffc5b7197ecb4b69f503d4f3cc24c8c SHA1: c2c7fd9527d9cc84781346a3ac8e2100d4d20ad3 SHA256: 1cccaa23aca49238099494fc7b49b550311719c9ac6bb138797e1077f4d7973d FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Fri Aug 30 07:33:06.130 2024 MODIFIED: Tue Mar  2 10:31:47.000 2021 ACCESSED: Tue May 14 16:11:55.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x61\x41\x41\x41\x41\x42\x4e\x6c\x59\x32\x52\x7a\x59\x53\x0a\x31\x7a\x61\x47\x45\x79\x4c\x57\x35\x70" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:34:24 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1\regress\unittests\sshkey\testdata\ecdsa_sk1 EXT:  TYPE: Certificate PEM SIZE: 849 MD5: 97206cfa158fdda5a45c6eb542f739c0 SHA1: e55ec614db8cea92d7269d5f903cf72baca36454 SHA256: e4df7ea4ca133a7457069be073203c556166c65635ed6fb6c12b9a84f027346e FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Fri Aug 30 07:33:06.131 2024 MODIFIED: Tue Mar  2 10:31:47.000 2021 ACCESSED: Tue May 14 16:12:16.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x66\x77\x41\x41\x41\x43\x4a\x7a\x61\x79\x31\x6c\x59\x32\x0a\x52\x7a\x59\x53\x31\x7a\x61\x47\x45\x79" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:34:24 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1\regress\unittests\sshkey\testdata\ecdsa_sk2 EXT:  TYPE: Certificate PEM SIZE: 849 MD5: 14ecb7595ee296b15d413ae395454a4c SHA1: 909379299593aeebc79f44df0ec22578123acce7 SHA256: de6f60d862f799ca088bd4611865e24bb0635d81097bb9496f0178aefa4acbae FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Fri Aug 30 07:33:06.133 2024 MODIFIED: Tue Mar  2 10:31:47.000 2021 ACCESSED: Tue May 14 16:13:14.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x66\x77\x41\x41\x41\x43\x4a\x7a\x61\x79\x31\x6c\x59\x32\x0a\x52\x7a\x59\x53\x31\x7a\x61\x47\x45\x79" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:34:24 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1\regress\unittests\sshkey\testdata\ed25519_1 EXT:  TYPE: Certificate PEM SIZE: 411 MD5: 514e8e39c48edb2b8934ef78a5030042 SHA1: a7a368a6f3d09bc2cfc1315f6e0899bde0574ffd SHA256: 74f95c1990e3512af471cf6fb58d08a8078bbab597e7ee86a7ccd233f6855fd1 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Fri Aug 30 07:33:06.134 2024 MODIFIED: Tue Mar  2 10:31:47.000 2021 ACCESSED: Tue May 14 16:13:47.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:34:24 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1\regress\unittests\sshkey\testdata\ed25519_2 EXT:  TYPE: Certificate PEM SIZE: 411 MD5: bfc2ac8495dbc6070241303ec50a6dc2 SHA1: 53e388e7c836c6ba874e852d71a6e1e708611d25 SHA256: 31689f4706b3bdad29ee21b05af62e9f2257399d07092089944514ed5edb131d FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Fri Aug 30 07:33:06.137 2024 MODIFIED: Tue Mar  2 10:31:47.000 2021 ACCESSED: Tue May 14 16:14:42.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:34:24 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1\regress\unittests\sshkey\testdata\ed25519_sk1 EXT:  TYPE: Certificate PEM SIZE: 484 MD5: ab9dcdbff00763217a3f85069a9c2f67 SHA1: 05396ad046c37370093f48c0bdb2510b8894aa76 SHA256: 45c058d08280c4ca36a9d020478504cd550e7c5752c207d182363c3edf669ce8 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Fri Aug 30 07:33:06.146 2024 MODIFIED: Tue Mar  2 10:31:47.000 2021 ACCESSED: Tue May 14 16:15:14.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x53\x67\x41\x41\x41\x42\x70\x7a\x61\x79\x31\x7a\x63\x32\x0a\x67\x74\x5a\x57\x51\x79\x4e\x54\x55\x78" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:34:24 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1\regress\unittests\sshkey\testdata\ed25519_sk2 EXT:  TYPE: Certificate PEM SIZE: 484 MD5: 8a666562de41f71d57d47c5f6404293a SHA1: 069c9341d4b0cd94669ff23feab92853b6a42540 SHA256: b862e169114ee63ae5e8497110075a9e67c4e3f24bad01e7c06951d268a3ec0f FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Fri Aug 30 07:33:06.149 2024 MODIFIED: Tue Mar  2 10:31:47.000 2021 ACCESSED: Tue May 14 16:16:20.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x53\x67\x41\x41\x41\x42\x70\x7a\x61\x79\x31\x7a\x63\x32\x0a\x67\x74\x5a\x57\x51\x79\x4e\x54\x55\x78" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:34:24 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1\regress\unittests\sshkey\testdata\rsa_1 EXT:  TYPE: Certificate PEM SIZE: 887 MD5: 197f14927e89c5c573213416bde709cb SHA1: 2f5cfafbddd00c351ce72e2f140458fb5ac7b60a SHA256: 07586a53bef4dd9daf59c473399fca5fcb39891bed0d2c2f8a88249e02392ac5 FIRSTBYTES: 2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA CREATED: Fri Aug 30 07:33:06.150 2024 MODIFIED: Tue Mar  2 10:31:47.000 2021 ACCESSED: Tue May 14 16:17:05.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x43\x58\x41\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x4c\x56\x35\x6c\x55\x54\x74\x37\x46\x72\x41\x44\x73\x65\x42\x2f\x43\x47\x68\x45\x5a\x7a\x70\x6f\x6f\x6a\x6a\x45\x57\x35\x79\x38\x2b\x65\x50\x76\x4c\x70" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:34:24 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1\regress\unittests\sshkey\testdata\rsa_1_sha1 EXT:  TYPE: Certificate PEM SIZE: 887 MD5: 197f14927e89c5c573213416bde709cb SHA1: 2f5cfafbddd00c351ce72e2f140458fb5ac7b60a SHA256: 07586a53bef4dd9daf59c473399fca5fcb39891bed0d2c2f8a88249e02392ac5 FIRSTBYTES: 2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA CREATED: Fri Aug 30 07:33:06.153 2024 MODIFIED: Tue Mar  2 10:31:47.000 2021 ACCESSED: Tue May 14 16:18:14.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x43\x58\x41\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x4c\x56\x35\x6c\x55\x54\x74\x37\x46\x72\x41\x44\x73\x65\x42\x2f\x43\x47\x68\x45\x5a\x7a\x70\x6f\x6f\x6a\x6a\x45\x57\x35\x79\x38\x2b\x65\x50\x76\x4c\x70" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:34:24 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1\regress\unittests\sshkey\testdata\rsa_1_sha512 EXT:  TYPE: Certificate PEM SIZE: 887 MD5: 197f14927e89c5c573213416bde709cb SHA1: 2f5cfafbddd00c351ce72e2f140458fb5ac7b60a SHA256: 07586a53bef4dd9daf59c473399fca5fcb39891bed0d2c2f8a88249e02392ac5 FIRSTBYTES: 2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA CREATED: Fri Aug 30 07:33:06.154 2024 MODIFIED: Tue Mar  2 10:31:47.000 2021 ACCESSED: Tue May 14 16:18:40.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x43\x58\x41\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x4c\x56\x35\x6c\x55\x54\x74\x37\x46\x72\x41\x44\x73\x65\x42\x2f\x43\x47\x68\x45\x5a\x7a\x70\x6f\x6f\x6a\x6a\x45\x57\x35\x79\x38\x2b\x65\x50\x76\x4c\x70" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:34:24 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1\regress\unittests\sshkey\testdata\rsa_2 EXT:  TYPE: Certificate PEM SIZE: 1679 MD5: c8860a2d208d222eade1e9866449ccbc SHA1: 64133ddc79d593e467c864c429e3793c69e4dc22 SHA256: e42925e663a7215e19cdc89bd9fe018903eeb013f131b188d3c87f0ef01c5a24 FIRSTBYTES: 2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA CREATED: Fri Aug 30 07:33:06.156 2024 MODIFIED: Tue Mar  2 10:31:47.000 2021 ACCESSED: Tue May 14 16:19:10.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x45\x70\x41\x49\x42\x41\x41\x4b\x43\x41\x51\x45\x41\x39\x4e\x45\x55\x58\x70\x37\x38\x53\x41\x6b\x6d\x4c\x34\x2b\x65\x41\x6a\x34\x6d\x42\x7a\x50\x4f\x6a\x6b\x2b\x63\x63\x43\x50\x56\x7a\x6b\x54\x52\x2b" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:34:24 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1\regress\unittests\sshkey\testdata\rsa_n EXT:  TYPE: Certificate PEM SIZE: 1020 MD5: d60f55c106077131ba136f02e9b9ba88 SHA1: d6a3a8961cb40e8a4ff03dbfd5983c9fc5dfeb39 SHA256: 0ad47d17d5f21f350c26c4c94564bf41b6fd28ab55187166b4f46b1b35daed6d FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Fri Aug 30 07:33:06.158 2024 MODIFIED: Tue Mar  2 10:31:47.000 2021 ACCESSED: Tue May 14 16:20:03.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x6c\x77\x41\x41\x41\x41\x64\x7a\x63\x32\x67\x74\x63\x6e\x0a\x4e\x68\x41\x41\x41\x41\x41\x77\x45\x41" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:34:25 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1\regress\unittests\sshsig\testdata\ecdsa EXT:  TYPE: Certificate PEM SIZE: 227 MD5: 53f2aa69e4e8d05ea1c0848c4a946b71 SHA1: 69a4f47fbbb55eb5dea9adea057509384a32bb69 SHA256: 585957bd0a19fcff2d22cd8af7ffb13b68cc30c9dc13dfefb57271b03f3a999f FIRSTBYTES: 2d2d2d2d2d424547494e20454320505249564154 / -----BEGIN EC PRIVAT CREATED: Fri Aug 30 07:33:06.161 2024 MODIFIED: Tue Mar  2 10:31:47.000 2021 ACCESSED: Tue May 14 16:20:51.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x48\x63\x43\x41\x51\x45\x45\x49\x46\x67\x30\x5a\x43\x53\x45\x42\x35\x4c\x4e\x65\x4c\x73\x58\x59\x4c\x32\x35\x67\x33\x6b\x71\x45\x57\x73\x71\x68\x35\x32\x44\x52\x2b\x79\x4e\x4f\x6a\x79\x51\x4a\x71\x79" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:34:25 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1\regress\unittests\sshsig\testdata\ecdsa_sk EXT:  TYPE: Certificate PEM SIZE: 837 MD5: 36948c6f96600caa24052b4d8322cbd9 SHA1: b7bf9e701f8da5d50f61064849d052e04fb77c3f SHA256: f81b969ccd3e85f02b71465ba38fb51b5adf6f11b09f2e9e82ed6b2ab31f2356 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Fri Aug 30 07:33:06.162 2024 MODIFIED: Tue Mar  2 10:31:47.000 2021 ACCESSED: Tue May 14 16:21:09.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x66\x77\x41\x41\x41\x43\x4a\x7a\x61\x79\x31\x6c\x59\x32\x0a\x52\x7a\x59\x53\x31\x7a\x61\x47\x45\x79" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:34:25 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1\regress\unittests\sshsig\testdata\ed25519 EXT:  TYPE: Certificate PEM SIZE: 411 MD5: 8bb197113a031c8f6d76de369316d0eb SHA1: 40847760b4f753f2b17156d3f6f9cdcc7c0b91d4 SHA256: c4683c666d6394fc5e8f3455b5379304979e0b41502560ddef20c824fa9fb66b FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Fri Aug 30 07:33:06.166 2024 MODIFIED: Tue Mar  2 10:31:47.000 2021 ACCESSED: Tue May 14 16:21:45.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:34:25 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1\regress\unittests\sshsig\testdata\ed25519_sk EXT:  TYPE: Certificate PEM SIZE: 484 MD5: 85bc2e18e08c06aa85cf023e7a97a585 SHA1: 95ea85c4709baf47e7cc2573ceac480cc35bde67 SHA256: 0e2221a7c8e8cea4fb6e9d2666b1d05166a3b0f5876c54433f0c35b564f22025 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Fri Aug 30 07:33:06.167 2024 MODIFIED: Tue Mar  2 10:31:47.000 2021 ACCESSED: Tue May 14 16:22:04.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x53\x67\x41\x41\x41\x42\x70\x7a\x61\x79\x31\x7a\x63\x32\x0a\x67\x74\x5a\x57\x51\x79\x4e\x54\x55\x78" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:34:25 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1\regress\unittests\sshsig\testdata\rsa EXT:  TYPE: Certificate PEM SIZE: 2455 MD5: efe804ccdc63abc29233f3a1e11e173b SHA1: 481c1773197aabc2d9d87336ad84f44410251ed4 SHA256: d7eb37f534b846bb582bcdcf78232bdb33932e34fb72d6bfa130a8fd699b10b6 FIRSTBYTES: 2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA CREATED: Fri Aug 30 07:33:06.169 2024 MODIFIED: Tue Mar  2 10:31:47.000 2021 ACCESSED: Tue May 14 16:22:29.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x47\x34\x77\x49\x42\x41\x41\x4b\x43\x41\x59\x45\x41\x33\x38\x36\x6c\x6d\x6a\x52\x48\x74\x4a\x70\x79\x6a\x38\x37\x42\x72\x53\x2b\x73\x73\x4d\x6d\x74\x76\x63\x2f\x31\x53\x50\x4e\x30\x67\x58\x54\x50\x73" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:34:27 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1\regress\ed25519_openssh.prv EXT: .prv TYPE: Certificate PEM SIZE: 419 MD5: c1d6034878b590c80805ad1e66039091 SHA1: 9127798b0fadd4539c81ee4f294287e8262eddb0 SHA256: 11bab46497954bd367ea5c2541cb3bad4814515481aee687fcdddc5680ee642d FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Fri Aug 30 07:33:07.473 2024 MODIFIED: Sun Sep 26 14:03:19.000 2021 ACCESSED: Tue May 14 16:18:06.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:34:28 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1\regress\rsa_openssh.prv EXT: .prv TYPE: Certificate PEM SIZE: 883 MD5: a6b110f820948e73bbde7b948744b3c5 SHA1: 614e6d353be614ded246a12ed6e14af20f063710 SHA256: 79b8783d0b10a3f65b9b3e349a1daa692cc27be08028131ff5a9a08799035f46 FIRSTBYTES: 2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA CREATED: Fri Aug 30 07:33:07.565 2024 MODIFIED: Sun Sep 26 14:03:19.000 2021 ACCESSED: Tue May 14 16:13:26.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x43\x57\x67\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x73\x69\x6c\x77\x4b\x63\x61\x4b\x4e\x36\x77\x53\x4d\x4e\x64\x31\x57\x67\x51\x39\x2b\x48\x52\x71\x51\x45\x6b\x44\x30\x6b\x43\x54\x56\x74\x74\x72\x61\x7a" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:34:28 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1\regress\misc\fuzz-harness\testdata\id_dsa EXT:  TYPE: Certificate PEM SIZE: 1361 MD5: a9521c2825fbf778b6b82b1dcda95d72 SHA1: 29bc6d9b491473450487aad65a659675154b8fb8 SHA256: a6fa247970fe3fe15b9647e9ae301495d10ea278dbe9516abdf70e69b1849744 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Fri Aug 30 07:33:07.518 2024 MODIFIED: Sun Sep 26 14:03:19.000 2021 ACCESSED: Tue May 14 16:24:05.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x42\x73\x67\x41\x41\x41\x41\x64\x7a\x63\x32\x67\x74\x5a\x48\x0a\x4e\x7a\x41\x41\x41\x41\x67\x51\x43\x73" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:34:28 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1\regress\misc\fuzz-harness\testdata\id_ecdsa EXT:  TYPE: Certificate PEM SIZE: 492 MD5: b14d14c4a2eb3a89c43be1d828fe2604 SHA1: 56c94a39972cc4c2ab982f6b206702cf3b558bde SHA256: 00120fd3e06a2c9a2debabe94c75cb9a8fb313d17b3a114dda6264874ae56c60 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Fri Aug 30 07:33:07.520 2024 MODIFIED: Sun Sep 26 14:03:19.000 2021 ACCESSED: Tue May 14 16:24:25.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x61\x41\x41\x41\x41\x42\x4e\x6c\x59\x32\x52\x7a\x59\x53\x0a\x31\x7a\x61\x47\x45\x79\x4c\x57\x35\x70" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:34:28 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1\regress\misc\fuzz-harness\testdata\id_ecdsa_sk EXT:  TYPE: Certificate PEM SIZE: 858 MD5: c87bc24fa8b257e7af7374511f44d2c5 SHA1: 2c1d6e64ad0052837b53739841f6acfc60a191ed SHA256: 50e6649901ffdf7bc4d85dd0f45937b9d99bdd85e472c112f8586bd3e35beb58 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Fri Aug 30 07:33:07.522 2024 MODIFIED: Sun Sep 26 14:03:19.000 2021 ACCESSED: Tue May 14 16:24:49.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x66\x77\x41\x41\x41\x43\x4a\x7a\x61\x79\x31\x6c\x59\x32\x0a\x52\x7a\x59\x53\x31\x7a\x61\x47\x45\x79" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:34:28 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1\regress\misc\fuzz-harness\testdata\id_ed25519 EXT:  TYPE: Certificate PEM SIZE: 387 MD5: 904e0a369a7fbe86bcb4e0bc1363c539 SHA1: 1074da4383390925d414ad562a0818a88e116208 SHA256: 6efecdbb70364afc9cf004e325a9a1d2673d86e85a6238e1126d6d105cea56c1 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Fri Aug 30 07:33:07.524 2024 MODIFIED: Sun Sep 26 14:03:19.000 2021 ACCESSED: Tue May 14 16:25:23.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:34:28 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1\regress\misc\fuzz-harness\testdata\id_ed25519_sk EXT:  TYPE: Certificate PEM SIZE: 496 MD5: c3c7cad31e9edf76f806848501011568 SHA1: f936a6c0f3b1250ef7fd0cbf4ea5a5d3c9c63507 SHA256: 5fd315701b14a13467331e1d0819a8016abdf5888ab695f068fce488bd37169d FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Fri Aug 30 07:33:07.525 2024 MODIFIED: Sun Sep 26 14:03:19.000 2021 ACCESSED: Tue May 14 16:25:49.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x53\x67\x41\x41\x41\x42\x70\x7a\x61\x79\x31\x7a\x63\x32\x0a\x67\x74\x5a\x57\x51\x79\x4e\x54\x55\x78" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:34:28 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1\regress\misc\fuzz-harness\testdata\id_rsa EXT:  TYPE: Certificate PEM SIZE: 1799 MD5: 0e4d9d0e310d6dc6a5c2d33660f70542 SHA1: 7bef427ad9067a465009d543787063fdaceef3e5 SHA256: 83822e39fb2ee059431a45c3c48cffcda3fb869273a364a45898ce9abad09e84 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Fri Aug 30 07:33:07.527 2024 MODIFIED: Sun Sep 26 14:03:19.000 2021 ACCESSED: Tue May 14 16:26:10.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x42\x46\x77\x41\x41\x41\x41\x64\x7a\x63\x32\x67\x74\x63\x6e\x0a\x4e\x68\x41\x41\x41\x41\x41\x77\x45\x41" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:34:29 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1\regress\unittests\sshkey\testdata\dsa_1 EXT:  TYPE: Certificate PEM SIZE: 672 MD5: aebcad00ac7fb84f1a7de01322c99be3 SHA1: a9a0e1cf84bee8c27802295819b399833e5d4d08 SHA256: b7f7c2bb695b28e585951a2da4ad2d6c933c440afe118798c6e2363e17da2b93 FIRSTBYTES: 2d2d2d2d2d424547494e20445341205052495641 / -----BEGIN DSA PRIVA CREATED: Fri Aug 30 07:33:07.987 2024 MODIFIED: Sun Sep 26 14:03:19.000 2021 ACCESSED: Tue May 14 16:15:29.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x44\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x42\x76\x41\x49\x42\x41\x41\x4b\x42\x67\x51" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x44\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x42\x76\x41\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x36\x6b\x75\x74\x4e\x46\x52\x73\x48\x54\x77\x45\x41\x76\x36\x64\x33\x39\x4c\x68\x73\x71\x79\x31\x61\x70\x64\x48\x42\x5a\x39\x63\x32\x48\x66\x79\x52\x72\x37\x57\x6d\x79\x70\x79\x47\x49\x79\x32\x6d" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:34:29 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1\regress\unittests\sshkey\testdata\dsa_n EXT:  TYPE: Certificate PEM SIZE: 1361 MD5: 6fcf088f9850b2f2213186cee4dc4811 SHA1: a04d604886c6a7c2217df9b7eea5c998da91d561 SHA256: db691de6aa454ec8aa45c84c58022a54611427f6f44c20d152ac05e0ea2284ba FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Fri Aug 30 07:33:07.994 2024 MODIFIED: Sun Sep 26 14:03:19.000 2021 ACCESSED: Tue May 14 16:17:10.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x42\x73\x77\x41\x41\x41\x41\x64\x7a\x63\x32\x67\x74\x5a\x48\x0a\x4e\x7a\x41\x41\x41\x41\x67\x51\x44\x36" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:34:29 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1\regress\unittests\sshkey\testdata\ecdsa_1 EXT:  TYPE: Certificate PEM SIZE: 227 MD5: 610b43e1fd8e09f2794aba398c6950eb SHA1: c7e5b5ff84b30ff8880e4d75942a600d012516b6 SHA256: 42a90746ef5975c6ef98c6d56305dad0bc698a1b05c83518bc90584c83935d5c FIRSTBYTES: 2d2d2d2d2d424547494e20454320505249564154 / -----BEGIN EC PRIVAT CREATED: Fri Aug 30 07:33:07.995 2024 MODIFIED: Sun Sep 26 14:03:19.000 2021 ACCESSED: Tue May 14 16:17:25.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x48\x63\x43\x41\x51\x45\x45\x49\x50\x50\x4e\x79\x55\x41\x6e\x6a\x76\x46\x72\x2b\x65\x54\x2f\x37\x74\x2f\x49\x79\x6a\x75\x51\x51\x64\x2f\x61\x4c\x46\x69\x54\x59\x39\x32\x4c\x42\x39\x67\x49\x6a\x79\x72" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:34:29 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1\regress\unittests\sshkey\testdata\ecdsa_2 EXT:  TYPE: Certificate PEM SIZE: 365 MD5: 0346ad9a21f23d98cb3abe4845df078d SHA1: 07091af93e22c676e03e6f96e9d0e53c9b53d775 SHA256: 320396e36bd5ecc12089f26849f8e7b6e0ab3c037f0492dee978cef6646d5826 FIRSTBYTES: 2d2d2d2d2d424547494e20454320505249564154 / -----BEGIN EC PRIVAT CREATED: Fri Aug 30 07:33:07.902 2024 MODIFIED: Sun Sep 26 14:03:19.000 2021 ACCESSED: Tue May 14 16:18:58.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x48\x63\x41\x67\x45\x42\x42\x45\x49\x42\x71\x42\x74\x4e\x37\x65\x36\x45\x73\x73\x64\x33\x64\x6c\x73\x67\x49\x53\x56\x69\x50\x43\x58\x58\x43\x30\x61\x74\x6c\x4e\x6b\x47\x74\x6f\x4d\x67\x53\x51\x64" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:34:29 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1\regress\unittests\sshkey\testdata\ecdsa_n EXT:  TYPE: Certificate PEM SIZE: 492 MD5: 0ffc5b7197ecb4b69f503d4f3cc24c8c SHA1: c2c7fd9527d9cc84781346a3ac8e2100d4d20ad3 SHA256: 1cccaa23aca49238099494fc7b49b550311719c9ac6bb138797e1077f4d7973d FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Fri Aug 30 07:33:07.920 2024 MODIFIED: Sun Sep 26 14:03:19.000 2021 ACCESSED: Tue May 14 16:19:58.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x61\x41\x41\x41\x41\x42\x4e\x6c\x59\x32\x52\x7a\x59\x53\x0a\x31\x7a\x61\x47\x45\x79\x4c\x57\x35\x70" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:34:29 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1\regress\unittests\sshkey\testdata\ecdsa_sk1 EXT:  TYPE: Certificate PEM SIZE: 849 MD5: 97206cfa158fdda5a45c6eb542f739c0 SHA1: e55ec614db8cea92d7269d5f903cf72baca36454 SHA256: e4df7ea4ca133a7457069be073203c556166c65635ed6fb6c12b9a84f027346e FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Fri Aug 30 07:33:07.921 2024 MODIFIED: Sun Sep 26 14:03:19.000 2021 ACCESSED: Tue May 14 16:20:16.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x66\x77\x41\x41\x41\x43\x4a\x7a\x61\x79\x31\x6c\x59\x32\x0a\x52\x7a\x59\x53\x31\x7a\x61\x47\x45\x79" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:34:29 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1\regress\unittests\sshkey\testdata\ecdsa_sk2 EXT:  TYPE: Certificate PEM SIZE: 849 MD5: 14ecb7595ee296b15d413ae395454a4c SHA1: 909379299593aeebc79f44df0ec22578123acce7 SHA256: de6f60d862f799ca088bd4611865e24bb0635d81097bb9496f0178aefa4acbae FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Fri Aug 30 07:33:07.929 2024 MODIFIED: Sun Sep 26 14:03:19.000 2021 ACCESSED: Tue May 14 16:21:18.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x66\x77\x41\x41\x41\x43\x4a\x7a\x61\x79\x31\x6c\x59\x32\x0a\x52\x7a\x59\x53\x31\x7a\x61\x47\x45\x79" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:34:29 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1\regress\unittests\sshkey\testdata\ed25519_1 EXT:  TYPE: Certificate PEM SIZE: 411 MD5: 514e8e39c48edb2b8934ef78a5030042 SHA1: a7a368a6f3d09bc2cfc1315f6e0899bde0574ffd SHA256: 74f95c1990e3512af471cf6fb58d08a8078bbab597e7ee86a7ccd233f6855fd1 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Fri Aug 30 07:33:07.933 2024 MODIFIED: Sun Sep 26 14:03:19.000 2021 ACCESSED: Tue May 14 16:21:48.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:34:29 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1\regress\unittests\sshkey\testdata\ed25519_2 EXT:  TYPE: Certificate PEM SIZE: 411 MD5: bfc2ac8495dbc6070241303ec50a6dc2 SHA1: 53e388e7c836c6ba874e852d71a6e1e708611d25 SHA256: 31689f4706b3bdad29ee21b05af62e9f2257399d07092089944514ed5edb131d FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Fri Aug 30 07:33:07.939 2024 MODIFIED: Sun Sep 26 14:03:19.000 2021 ACCESSED: Tue May 14 16:22:36.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:34:29 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1\regress\unittests\sshkey\testdata\ed25519_sk1 EXT:  TYPE: Certificate PEM SIZE: 484 MD5: ab9dcdbff00763217a3f85069a9c2f67 SHA1: 05396ad046c37370093f48c0bdb2510b8894aa76 SHA256: 45c058d08280c4ca36a9d020478504cd550e7c5752c207d182363c3edf669ce8 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Fri Aug 30 07:33:07.942 2024 MODIFIED: Sun Sep 26 14:03:19.000 2021 ACCESSED: Tue May 14 16:23:06.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x53\x67\x41\x41\x41\x42\x70\x7a\x61\x79\x31\x7a\x63\x32\x0a\x67\x74\x5a\x57\x51\x79\x4e\x54\x55\x78" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:34:29 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1\regress\unittests\sshkey\testdata\ed25519_sk2 EXT:  TYPE: Certificate PEM SIZE: 484 MD5: 8a666562de41f71d57d47c5f6404293a SHA1: 069c9341d4b0cd94669ff23feab92853b6a42540 SHA256: b862e169114ee63ae5e8497110075a9e67c4e3f24bad01e7c06951d268a3ec0f FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Fri Aug 30 07:33:07.946 2024 MODIFIED: Sun Sep 26 14:03:19.000 2021 ACCESSED: Tue May 14 16:23:57.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x53\x67\x41\x41\x41\x42\x70\x7a\x61\x79\x31\x7a\x63\x32\x0a\x67\x74\x5a\x57\x51\x79\x4e\x54\x55\x78" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:34:29 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1\regress\unittests\sshkey\testdata\rsa_1 EXT:  TYPE: Certificate PEM SIZE: 887 MD5: 197f14927e89c5c573213416bde709cb SHA1: 2f5cfafbddd00c351ce72e2f140458fb5ac7b60a SHA256: 07586a53bef4dd9daf59c473399fca5fcb39891bed0d2c2f8a88249e02392ac5 FIRSTBYTES: 2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA CREATED: Fri Aug 30 07:33:07.948 2024 MODIFIED: Sun Sep 26 14:03:19.000 2021 ACCESSED: Tue May 14 16:24:26.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x43\x58\x41\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x4c\x56\x35\x6c\x55\x54\x74\x37\x46\x72\x41\x44\x73\x65\x42\x2f\x43\x47\x68\x45\x5a\x7a\x70\x6f\x6f\x6a\x6a\x45\x57\x35\x79\x38\x2b\x65\x50\x76\x4c\x70" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:34:30 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1\regress\unittests\sshkey\testdata\rsa_1_sha1 EXT:  TYPE: Certificate PEM SIZE: 887 MD5: 197f14927e89c5c573213416bde709cb SHA1: 2f5cfafbddd00c351ce72e2f140458fb5ac7b60a SHA256: 07586a53bef4dd9daf59c473399fca5fcb39891bed0d2c2f8a88249e02392ac5 FIRSTBYTES: 2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA CREATED: Fri Aug 30 07:33:07.976 2024 MODIFIED: Sun Sep 26 14:03:19.000 2021 ACCESSED: Tue May 14 16:25:48.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x43\x58\x41\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x4c\x56\x35\x6c\x55\x54\x74\x37\x46\x72\x41\x44\x73\x65\x42\x2f\x43\x47\x68\x45\x5a\x7a\x70\x6f\x6f\x6a\x6a\x45\x57\x35\x79\x38\x2b\x65\x50\x76\x4c\x70" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:34:30 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1\regress\unittests\sshkey\testdata\rsa_1_sha512 EXT:  TYPE: Certificate PEM SIZE: 887 MD5: 197f14927e89c5c573213416bde709cb SHA1: 2f5cfafbddd00c351ce72e2f140458fb5ac7b60a SHA256: 07586a53bef4dd9daf59c473399fca5fcb39891bed0d2c2f8a88249e02392ac5 FIRSTBYTES: 2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA CREATED: Fri Aug 30 07:33:07.979 2024 MODIFIED: Sun Sep 26 14:03:19.000 2021 ACCESSED: Tue May 14 16:26:23.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x43\x58\x41\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x4c\x56\x35\x6c\x55\x54\x74\x37\x46\x72\x41\x44\x73\x65\x42\x2f\x43\x47\x68\x45\x5a\x7a\x70\x6f\x6f\x6a\x6a\x45\x57\x35\x79\x38\x2b\x65\x50\x76\x4c\x70" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:34:30 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1\regress\unittests\sshkey\testdata\rsa_2 EXT:  TYPE: Certificate PEM SIZE: 1679 MD5: c8860a2d208d222eade1e9866449ccbc SHA1: 64133ddc79d593e467c864c429e3793c69e4dc22 SHA256: e42925e663a7215e19cdc89bd9fe018903eeb013f131b188d3c87f0ef01c5a24 FIRSTBYTES: 2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA CREATED: Fri Aug 30 07:33:07.981 2024 MODIFIED: Sun Sep 26 14:03:19.000 2021 ACCESSED: Tue May 14 16:26:50.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x45\x70\x41\x49\x42\x41\x41\x4b\x43\x41\x51\x45\x41\x39\x4e\x45\x55\x58\x70\x37\x38\x53\x41\x6b\x6d\x4c\x34\x2b\x65\x41\x6a\x34\x6d\x42\x7a\x50\x4f\x6a\x6b\x2b\x63\x63\x43\x50\x56\x7a\x6b\x54\x52\x2b" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:34:30 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1\regress\unittests\sshkey\testdata\rsa_n EXT:  TYPE: Certificate PEM SIZE: 1020 MD5: d60f55c106077131ba136f02e9b9ba88 SHA1: d6a3a8961cb40e8a4ff03dbfd5983c9fc5dfeb39 SHA256: 0ad47d17d5f21f350c26c4c94564bf41b6fd28ab55187166b4f46b1b35daed6d FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Fri Aug 30 07:33:07.986 2024 MODIFIED: Sun Sep 26 14:03:19.000 2021 ACCESSED: Tue May 14 16:11:10.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x6c\x77\x41\x41\x41\x41\x64\x7a\x63\x32\x67\x74\x63\x6e\x0a\x4e\x68\x41\x41\x41\x41\x41\x77\x45\x41" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:34:30 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1\regress\unittests\sshsig\testdata\ecdsa EXT:  TYPE: Certificate PEM SIZE: 227 MD5: 53f2aa69e4e8d05ea1c0848c4a946b71 SHA1: 69a4f47fbbb55eb5dea9adea057509384a32bb69 SHA256: 585957bd0a19fcff2d22cd8af7ffb13b68cc30c9dc13dfefb57271b03f3a999f FIRSTBYTES: 2d2d2d2d2d424547494e20454320505249564154 / -----BEGIN EC PRIVAT CREATED: Fri Aug 30 07:33:08.003 2024 MODIFIED: Sun Sep 26 14:03:19.000 2021 ACCESSED: Tue May 14 16:12:17.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x48\x63\x43\x41\x51\x45\x45\x49\x46\x67\x30\x5a\x43\x53\x45\x42\x35\x4c\x4e\x65\x4c\x73\x58\x59\x4c\x32\x35\x67\x33\x6b\x71\x45\x57\x73\x71\x68\x35\x32\x44\x52\x2b\x79\x4e\x4f\x6a\x79\x51\x4a\x71\x79" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:34:30 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1\regress\unittests\sshsig\testdata\ecdsa_sk EXT:  TYPE: Certificate PEM SIZE: 837 MD5: 36948c6f96600caa24052b4d8322cbd9 SHA1: b7bf9e701f8da5d50f61064849d052e04fb77c3f SHA256: f81b969ccd3e85f02b71465ba38fb51b5adf6f11b09f2e9e82ed6b2ab31f2356 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Fri Aug 30 07:33:08.013 2024 MODIFIED: Sun Sep 26 14:03:19.000 2021 ACCESSED: Tue May 14 16:12:39.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x66\x77\x41\x41\x41\x43\x4a\x7a\x61\x79\x31\x6c\x59\x32\x0a\x52\x7a\x59\x53\x31\x7a\x61\x47\x45\x79" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:34:30 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1\regress\unittests\sshsig\testdata\ed25519 EXT:  TYPE: Certificate PEM SIZE: 411 MD5: 8bb197113a031c8f6d76de369316d0eb SHA1: 40847760b4f753f2b17156d3f6f9cdcc7c0b91d4 SHA256: c4683c666d6394fc5e8f3455b5379304979e0b41502560ddef20c824fa9fb66b FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Fri Aug 30 07:33:08.033 2024 MODIFIED: Sun Sep 26 14:03:19.000 2021 ACCESSED: Tue May 14 16:13:13.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:34:30 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1\regress\unittests\sshsig\testdata\ed25519_sk EXT:  TYPE: Certificate PEM SIZE: 484 MD5: 85bc2e18e08c06aa85cf023e7a97a585 SHA1: 95ea85c4709baf47e7cc2573ceac480cc35bde67 SHA256: 0e2221a7c8e8cea4fb6e9d2666b1d05166a3b0f5876c54433f0c35b564f22025 FIRSTBYTES: 2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P CREATED: Fri Aug 30 07:33:08.035 2024 MODIFIED: Sun Sep 26 14:03:19.000 2021 ACCESSED: Tue May 14 16:13:41.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x53\x67\x41\x41\x41\x42\x70\x7a\x61\x79\x31\x7a\x63\x32\x0a\x67\x74\x5a\x57\x51\x79\x4e\x54\x55\x78" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:34:30 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Filescan MESSAGE: Suspicious file found SCANID: S-dM24AZNR1hE SCORE: 45 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1\regress\unittests\sshsig\testdata\rsa EXT:  TYPE: Certificate PEM SIZE: 2455 MD5: efe804ccdc63abc29233f3a1e11e173b SHA1: 481c1773197aabc2d9d87336ad84f44410251ed4 SHA256: d7eb37f534b846bb582bcdcf78232bdb33932e34fb72d6bfa130a8fd699b10b6 FIRSTBYTES: 2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA CREATED: Fri Aug 30 07:33:08.038 2024 MODIFIED: Sun Sep 26 14:03:19.000 2021 ACCESSED: Tue May 14 16:14:16.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty SUBSCORE_1: 45 REF_1: https://attack.mitre.org/techniques/T1552/004/ SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" in "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x47\x34\x77\x49\x42\x41\x41\x4b\x43\x41\x59\x45\x41\x33\x38\x36\x6c\x6d\x6a\x52\x48\x74\x4a\x70\x79\x6a\x38\x37\x42\x72\x53\x2b\x73\x73\x4d\x6d\x74\x76\x63\x2f\x31\x53\x50\x4e\x30\x67\x58\x54\x50\x73" at 0x0 RULEDATE_1: 2023-01-06 TAGS_1: EXTVAR, T1021_004, T1552_004, T1572, VENDOR RULENAME_1: EXT_VULN_Unencrypted_SSH_Private_Key AUTHOR_1: Arnim Rupp REASONS_COUNT: 1
Aug 30 08:34:58 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: LogScan MESSAGE: Notable Log Entry found SCANID: S-dM24AZNR1hE ENTRY: 2022.03.22 07:09:28.805 2253 INF CreateUrlMatcher: { applyToWholeDomainForEach: 0, masks: clients2.google.com, clients2.googleusercontent.com, ds.kaspersky.com, web.ucp.kaspersky.com, backend.ucp.kaspersky.com, rnd-infrastructure.ucp.kaspersky.com, management.azure.ucp.kaspersky.com, dis.azure.ucp.kaspersky.com, ns-dis.azure.ucp.kaspersky.com, test-activation.azure.ucp.kaspersky.com, activation.azure.ucp.kaspersky.com, uisucp.kaspersky.com, rdp.azure.ucp.kaspersky.com, svcuisucpit, monitoring.backend.it.ucp.kaspersky.com, backup.backend.it.ucp.kaspersky.com, logging.azure.ucp.kaspersky.com, services.ucp.kaspersky-labs.com, tpis.monitoring.azure.ucp.kaspersky.com, bis.monitoring.azure.ucp.kaspersky.com, korm.client.ucp.kaspersky-labs.com, pdc.client.ucp.kaspersky-labs.com, center.kaspersky-labs.com, *ucp-ntfy.kaspersky-labs.com, uis.kaspersky.com, register-account.kaspersky-labs.com, special.s.kaspersky-labs.com, ipm-klca.kaspersky.com, ksn-cp.kaspers[...]om, autoupdate.opera.com, kdc.uas.aol.com, secure.logmein.com, *.evernote.com, *.filezilla-project.org, gfe.nvi[...]ki.or.jp, upload*.mixcloud.com, certificado.sso.acesso.gov.br, sog-vault.avp.ru, vdi.kaspersky.com, *.tomtom.com, *.g*, *.googleapis.com, meetings.clients6.google.com, *, cloud.radar.imgsmail.ru, *.y*, *.y*, *, *, *mega*.nz, *.elster.de, *.de, *.starfinanz.de, *dropbox*.com, *dropbox*.com, *.surfeasy.*, *.opera-proxy.*, *.sec-tunnel.com, *, *, *, *.adobe.com, get.adobe.com, platformdl.adobe.com, fpdownload.adobe.com, *.branch.io, *.itau.com.br, gfwsl.geforce.com, gfwsl.geforce.com, www.autentapp.de, edge.activity.windows.com, activity.windows.com, enterprise.activity.windows.com, edge-enterprise.activity.windows.com, *.autodesk.com, mnsews.infocamere.it, webtelemaco.infocamere.it, r.manage.microsoft.com, *, *.*.*, *mail.ru, *.ya*, *.ya*, *.dropbox.com, *.de, gil.apple.com, *-keyvalueservice.icloud.com, *-setup.icloud.com, gateway.icloud.com, www.apple.com, *.mzstatic.com, api.apps.apple.com, bag.itunes.apple.com, *.push.apple.com, itunes.apple.com } SCORE: 50 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\var\log\kaspersky\kesl\kesl.1040.2022-03-22T100924.log LOG_MODIFIED: Tue Mar 22 07:12:53 2022 LOG_ACCESSED: Tue May 14 16:28:42 2024 LOG_CREATED: Thu Aug 29 15:29:28 2024 REASON_1: YARA rule yara_c2_logmein_com / Suspicious Domain Name / FQDN used by Remote Access Software 2023-09-16 https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md (SUSPICIOUS, REMOTE_CONTROL) SUBSCORE_1: 50 REF_1: not set SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "logmein.com" RULENAME_1: yara_c2_logmein_com AUTHOR_1: unknown REASONS_COUNT: 1 FILE_1: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\var\log\kaspersky\kesl\kesl.1040.2022-03-22T100924.log EXISTS_1: yes TYPE_1: UNKNOWN SIZE_1: 6955786 MD5_1: 846abf2603bae2df835da6602dee4e01 SHA1_1: 9bf1cdc90a48e35a646a47d0b50e82f8191980de SHA256_1: cd083d280d410353e87987543a81b6767aef69c560daf8a34948231c4074acee FIRSTBYTES_1: 4156502054524143452046494c45092020555443 / AVP TRACE FILE  UTC CREATED_1: Thu Aug 29 15:29:28.919 2024 OWNER_1: BUILTIN\Administrators
Aug 30 08:35:01 WIN-LRTT94FA08M/10.100.5.12 THOR: Alert: MODULE: LogScan MESSAGE: Malicious Log Entry found SCANID: S-dM24AZNR1hE ENTRY: 192.241.193.117 - - [05/May/2024:05:06:30 +0300] "GET /autodiscover/autodiscover.json?@zdi/Powershell HTTP/1.1" 403 199 "-" "Mozilla/5.0 zgrab/0.x" SCORE: 90 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\var\var\httpd\access_log LOG_MODIFIED: Tue May  7 07:55:38 2024 LOG_ACCESSED: Tue May 14 16:36:08 2024 LOG_CREATED: Fri Aug 30 07:36:47 2024 REASON_1: YARA rule EXPL_Exchange_ProxyShell_Successful_Aug21_1 / Detects successful ProxyShell exploitation attempts in log files SUBSCORE_1: 85 REF_1: https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: " /autodiscover/autodiscover.json?@zdi/Powershell" RULEDATE_1: 2021-08-08 TAGS_1: EXPLOIT, SCRIPT RULENAME_1: EXPL_Exchange_ProxyShell_Successful_Aug21_1 AUTHOR_1: Florian Roth REASON_2: YARA rule EXPL_Exchange_ProxyShell_Aug21_1 / Detects successful ProxyShell exploitation attempts in log files SUBSCORE_2: 70 REF_2: https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html SIGTYPE_2: internal SIGCLASS_2: YARA Rule MATCHED_2: Str1: " /autodiscover/autodiscover.json?@zdi/Powershell" RULEDATE_2: 2021-08-08 TAGS_2: EXPLOIT, SCRIPT RULENAME_2: EXPL_Exchange_ProxyShell_Aug21_1 AUTHOR_2: Florian Roth REASONS_COUNT: 2
Aug 30 08:35:01 WIN-LRTT94FA08M/10.100.5.12 THOR: Alert: MODULE: LogScan MESSAGE: Malicious Log Entry found SCANID: S-dM24AZNR1hE ENTRY: 192.241.193.117 - - [05/May/2024:05:06:45 +0300] "GET /autodiscover/autodiscover.json?@zdi/Powershell HTTP/1.1" 403 199 "-" "Mozilla/5.0 zgrab/0.x" SCORE: 90 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\var\var\httpd\access_log LOG_MODIFIED: Tue May  7 07:55:38 2024 LOG_ACCESSED: Tue May 14 16:36:08 2024 LOG_CREATED: Fri Aug 30 07:36:47 2024 REASON_1: YARA rule EXPL_Exchange_ProxyShell_Successful_Aug21_1 / Detects successful ProxyShell exploitation attempts in log files SUBSCORE_1: 85 REF_1: https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: " /autodiscover/autodiscover.json?@zdi/Powershell" RULEDATE_1: 2021-08-08 TAGS_1: EXPLOIT, SCRIPT RULENAME_1: EXPL_Exchange_ProxyShell_Successful_Aug21_1 AUTHOR_1: Florian Roth REASON_2: YARA rule EXPL_Exchange_ProxyShell_Aug21_1 / Detects successful ProxyShell exploitation attempts in log files SUBSCORE_2: 70 REF_2: https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html SIGTYPE_2: internal SIGCLASS_2: YARA Rule MATCHED_2: Str1: " /autodiscover/autodiscover.json?@zdi/Powershell" RULEDATE_2: 2021-08-08 TAGS_2: EXPLOIT, SCRIPT RULENAME_2: EXPL_Exchange_ProxyShell_Aug21_1 AUTHOR_2: Florian Roth REASONS_COUNT: 2
Aug 30 08:35:01 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: LogScan MESSAGE: Notable Log Entry found SCANID: S-dM24AZNR1hE ENTRY: 10.16.6.250 - - [06/May/2024:11:56:51 +0300] "GET /autodiscover/autodiscover.json?@test.com/owa/?&Email=autodiscover/autodiscover.json%3F@test.com HTTP/1.1" 403 199 "-" "-" SCORE: 50 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\var\var\httpd\access_log LOG_MODIFIED: Tue May  7 07:55:38 2024 LOG_ACCESSED: Tue May 14 16:36:08 2024 LOG_CREATED: Fri Aug 30 07:36:47 2024 REASON_1: YARA rule LOG_EXPL_Exchange_ProxyShell_Attempt_Aug21_1 / Detects ProxyShell exploitation attempts in log files SUBSCORE_1: 50 REF_1: https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "/autodiscover/autodiscover.json?@test.com/owa/?&Email=autodiscover/autodiscover.json%3F@" RULEDATE_1: 2021-08-09 TAGS_1: EXPLOIT, LOG RULENAME_1: LOG_EXPL_Exchange_ProxyShell_Attempt_Aug21_1 AUTHOR_1: Florian Roth REASONS_COUNT: 1
Aug 30 08:35:02 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: LogScan MESSAGE: Notable Log Entry found SCANID: S-dM24AZNR1hE ENTRY: 10.16.6.250 - - [07/May/2024:10:31:56 +0300] "GET /autodiscover/autodiscover.json?@test.com/owa/?&Email=autodiscover/autodiscover.json%3F@test.com HTTP/1.1" 403 199 "-" "-" SCORE: 50 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\var\var\httpd\access_log LOG_MODIFIED: Tue May  7 07:55:38 2024 LOG_ACCESSED: Tue May 14 16:36:08 2024 LOG_CREATED: Fri Aug 30 07:36:47 2024 REASON_1: YARA rule LOG_EXPL_Exchange_ProxyShell_Attempt_Aug21_1 / Detects ProxyShell exploitation attempts in log files SUBSCORE_1: 50 REF_1: https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: "/autodiscover/autodiscover.json?@test.com/owa/?&Email=autodiscover/autodiscover.json%3F@" RULEDATE_1: 2021-08-09 TAGS_1: EXPLOIT, LOG RULENAME_1: LOG_EXPL_Exchange_ProxyShell_Attempt_Aug21_1 AUTHOR_1: Florian Roth REASONS_COUNT: 1
Aug 30 08:35:02 WIN-LRTT94FA08M/10.100.5.12 THOR: Alert: MODULE: Filescan MESSAGE: Malware file found SCANID: S-dM24AZNR1hE SCORE: 85 FILE: D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\var\var\httpd\access_log EXT:  TYPE: IP Log SIZE: 703152 MD5: 857a3b06303b8c133060b62f06f817cd SHA1: 4660e22431e4423208ffb7a2eeb65ae00efbfaf9 SHA256: 04bb63cd98f63ba08f945ad5e91ddc8656eb7c55d809b13d99a9c71741306d50 FIRSTBYTES: 3139322e3234312e3233312e3531202d202d205b / 192.241.231.51 - - [ CREATED: Fri Aug 30 07:36:47.995 2024 MODIFIED: Tue May  7 07:55:38.000 2024 ACCESSED: Tue May 14 16:36:08.000 2024 PERMISSIONS: BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F OWNER: BUILTIN\Administrators REASON_1: YARA rule EXPL_Exchange_ProxyShell_Successful_Aug21_1 / Detects successful ProxyShell exploitation attempts in log files SUBSCORE_1: 85 REF_1: https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html SIGTYPE_1: internal SIGCLASS_1: YARA Rule MATCHED_1: Str1: " /autodiscover/autodiscover.json?@zdi/Powershell" in ".241.193.117 - - [05/May/2024:05:06:30 +0300] \"GET /autodiscover/autodiscover.json?@zdi/Powershell HTTP/1.1\" 403 199 \"-\" \"Mozilla/5.0 zgrab/0.x\"\x0a192" at 0x187f RULEDATE_1: 2021-08-08 TAGS_1: EXPLOIT, SCRIPT RULENAME_1: EXPL_Exchange_ProxyShell_Successful_Aug21_1 AUTHOR_1: Florian Roth REASONS_COUNT: 1
Aug 30 08:35:02 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Filescan MESSAGE: Finished module SCANID: S-dM24AZNR1hE DURATION: 0 hours 7 mins 41 secs SCANNED_ELEMENTS: 36040
Aug 30 08:35:02 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: ThorDB MESSAGE: Successfully closed ThorDB SCANID: S-dM24AZNR1hE
Aug 30 08:35:02 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Report MESSAGE: Results SCANID: S-dM24AZNR1hE ALERTS: 9 WARNINGS: 8 NOTICES: 236 ERRORS: 0
Aug 30 08:35:02 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Report MESSAGE: For details see the log files written to ["WIN-LRTT94FA08M_thor_2024-08-30_0826.txt" "WIN-LRTT94FA08M_thor_2024-08-30_0826.html"] SCANID: S-dM24AZNR1hE
Aug 30 08:35:02 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Report MESSAGE: Begin Time: Fri Aug 30 08:27:13 2024 SCANID: S-dM24AZNR1hE
Aug 30 08:35:02 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Report MESSAGE: End Time: Fri Aug 30 08:35:02 2024 SCANID: S-dM24AZNR1hE
Aug 30 08:35:02 WIN-LRTT94FA08M/10.100.5.12 THOR: Info: MODULE: Report MESSAGE: Scan took 0 hours 7 mins 49 secs SCANID: S-dM24AZNR1hE
Aug 30 08:35:02 WIN-LRTT94FA08M/10.100.5.12 THOR: Notice: MODULE: Report MESSAGE: Thor Scan finished SCANID: S-dM24AZNR1hE END_TIME: Fri Aug 30 08:35:02 2024 ALERTS: 9 WARNINGS: 8 NOTICES: 236 ERRORS: 0
