THOR Scan Report

- Filter Out
- Count Occurrences
- Search on Google
- Search on VirusTotal
- Search on RiskIQ
- Lookup rule name in VALHALLA

No filters applied

# THOR Scan Report

Scan Information
Scanner | Thor
Version | 10.7.9
Run on System | WIN-LRTT94FA08M
Argument list | --path D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image --module Filescan
Signature Database | 2023/09/24-052825
Start Time | Fri Aug 30 08:27:13 2024
End Time | Fri Aug 30 08:35:02 2024
IP Addresses | 10.100.5.12
Run as user | WIN-LRTT94FA08M\Administrator
Admin rights | yes
Platform | Windows Server 2019 Standard
Log File Name | WIN-LRTT94FA08M_thor_2024-08-30_0826.txt
False Positive Filters Applied | 0
Scan ID | S-dM24AZNR1hE

Modules
239
13

Statistics
Alerts | 9
Warnings | 8
Notice | 237
Info | 121
Errors | 0

Help
Shortcuts | Use Ctrl+⬆ (Windows/Linux) or ⌘+⬆ (macOS) to return to the top of the page
Filters | You can provide a file (--filter file) with regular expressions to suppress false positives
Hint 1 | Select text and use the context menu to filter / select / lookup strings
Hint 2 | Click on a module to filter for all events from that module.

Errors

Alerts

Alert 1

Aug 30 08:27:26 WIN-LRTT94FA08M/10.100.5.12
MODULE:
LogScan
MESSAGE:
Malicious Log Entry found
ENTRY:
192.241.193.117 - - [05/May/2024:05:06:30 +0300] "GET /autodiscover/autodiscover.json?@zdi/Powershell HTTP/1.1" 403 199 "-" "Mozilla/5.0 zgrab/0.x"
SCORE:
90
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\it_sec\httpd\access_log
LOG_MODIFIED:
Tue May 7 07:55:38 2024
LOG_ACCESSED:
Tue May 14 16:22:15 2024
LOG_CREATED:
Thu Aug 29 15:34:29 2024
REASON_1:
YARA rule EXPL_Exchange_ProxyShell_Successful_Aug21_1 / Detects successful ProxyShell exploitation attempts in log files
SUBSCORE_1:
85
REF_1:
https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- /autodiscover/autodiscover.json?@zdi/Powershell

RULEDATE_1:
2021-08-08
TAGS_1:
EXPLOIT, SCRIPT
RULENAME_1:
EXPL_Exchange_ProxyShell_Successful_Aug21_1
AUTHOR_1:
Florian Roth
REASON_2:
YARA rule EXPL_Exchange_ProxyShell_Aug21_1 / Detects successful ProxyShell exploitation attempts in log files
SUBSCORE_2:
70
REF_2:
https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html
SIGTYPE_2:
internal
SIGCLASS_2:
YARA Rule
MATCHED_2

- /autodiscover/autodiscover.json?@zdi/Powershell

RULEDATE_2:
2021-08-08
TAGS_2:
EXPLOIT, SCRIPT
RULENAME_2:
EXPL_Exchange_ProxyShell_Aug21_1
AUTHOR_2:
Florian Roth
REASONS_COUNT:
2

Alert 2

Aug 30 08:27:26 WIN-LRTT94FA08M/10.100.5.12
MODULE:
LogScan
MESSAGE:
Malicious Log Entry found
ENTRY:
192.241.193.117 - - [05/May/2024:05:06:45 +0300] "GET /autodiscover/autodiscover.json?@zdi/Powershell HTTP/1.1" 403 199 "-" "Mozilla/5.0 zgrab/0.x"
SCORE:
90
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\it_sec\httpd\access_log
LOG_MODIFIED:
Tue May 7 07:55:38 2024
LOG_ACCESSED:
Tue May 14 16:22:15 2024
LOG_CREATED:
Thu Aug 29 15:34:29 2024
REASON_1:
YARA rule EXPL_Exchange_ProxyShell_Successful_Aug21_1 / Detects successful ProxyShell exploitation attempts in log files
SUBSCORE_1:
85
REF_1:
https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- /autodiscover/autodiscover.json?@zdi/Powershell

RULEDATE_1:
2021-08-08
TAGS_1:
EXPLOIT, SCRIPT
RULENAME_1:
EXPL_Exchange_ProxyShell_Successful_Aug21_1
AUTHOR_1:
Florian Roth
REASON_2:
YARA rule EXPL_Exchange_ProxyShell_Aug21_1 / Detects successful ProxyShell exploitation attempts in log files
SUBSCORE_2:
70
REF_2:
https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html
SIGTYPE_2:
internal
SIGCLASS_2:
YARA Rule
MATCHED_2

- /autodiscover/autodiscover.json?@zdi/Powershell

RULEDATE_2:
2021-08-08
TAGS_2:
EXPLOIT, SCRIPT
RULENAME_2:
EXPL_Exchange_ProxyShell_Aug21_1
AUTHOR_2:
Florian Roth
REASONS_COUNT:
2

Alert 3

Aug 30 08:27:27 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Malware file found
SCORE:
85
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\it_sec\httpd\access_log
EXT:
TYPE:
IP Log
SIZE:
703152
MD5:
857a3b06303b8c133060b62f06f817cd
SHA1:
4660e22431e4423208ffb7a2eeb65ae00efbfaf9
SHA256:
04bb63cd98f63ba08f945ad5e91ddc8656eb7c55d809b13d99a9c71741306d50
FIRSTBYTES:
3139322e3234312e3233312e3531202d202d205b / 192.241.231.51 - - [
CREATED:
Thu Aug 29 15:34:29.290 2024
MODIFIED:
Tue May 7 07:55:38.000 2024
ACCESSED:
Tue May 14 16:22:15.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXPL_Exchange_ProxyShell_Successful_Aug21_1 / Detects successful ProxyShell exploitation attempts in log files
SUBSCORE_1:
85
REF_1:
https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- /autodiscover/autodiscover.json?@zdi/Powershell at 0x187f in
  ".241.193.117 - - [05/May/2024:05:06:30 +0300] \"GET /autodiscover/autodiscover.json?@zdi/Powershell HTTP/1.1\" 403 199 \"-\" \"Mozilla/5.0 zgrab/0.x\"\x0a192"

RULEDATE_1:
2021-08-08
TAGS_1:
EXPLOIT, SCRIPT
RULENAME_1:
EXPL_Exchange_ProxyShell_Successful_Aug21_1
AUTHOR_1:
Florian Roth
REASONS_COUNT:
1

Alert 4

Aug 30 08:29:45 WIN-LRTT94FA08M/10.100.5.12
MODULE:
LogScan
MESSAGE:
Malicious Log Entry found
ENTRY:
192.241.193.117 - - [05/May/2024:05:06:30 +0300] "GET /autodiscover/autodiscover.json?@zdi/Powershell HTTP/1.1" 403 199 "-" "Mozilla/5.0 zgrab/0.x"
SCORE:
90
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\mpirogova\sites\site2\core\Logs[deleted]\httpd\access_log
LOG_MODIFIED:
Tue May 7 07:55:38 2024
LOG_ACCESSED:
Tue May 14 16:22:15 2024
LOG_CREATED:
Fri Aug 30 07:25:01 2024
REASON_1:
YARA rule EXPL_Exchange_ProxyShell_Successful_Aug21_1 / Detects successful ProxyShell exploitation attempts in log files
SUBSCORE_1:
85
REF_1:
https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- /autodiscover/autodiscover.json?@zdi/Powershell

RULEDATE_1:
2021-08-08
TAGS_1:
EXPLOIT, SCRIPT
RULENAME_1:
EXPL_Exchange_ProxyShell_Successful_Aug21_1
AUTHOR_1:
Florian Roth
REASON_2:
YARA rule EXPL_Exchange_ProxyShell_Aug21_1 / Detects successful ProxyShell exploitation attempts in log files
SUBSCORE_2:
70
REF_2:
https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html
SIGTYPE_2:
internal
SIGCLASS_2:
YARA Rule
MATCHED_2

- /autodiscover/autodiscover.json?@zdi/Powershell

RULEDATE_2:
2021-08-08
TAGS_2:
EXPLOIT, SCRIPT
RULENAME_2:
EXPL_Exchange_ProxyShell_Aug21_1
AUTHOR_2:
Florian Roth
REASONS_COUNT:
2

Alert 5

Aug 30 08:29:45 WIN-LRTT94FA08M/10.100.5.12
MODULE:
LogScan
MESSAGE:
Malicious Log Entry found
ENTRY:
192.241.193.117 - - [05/May/2024:05:06:45 +0300] "GET /autodiscover/autodiscover.json?@zdi/Powershell HTTP/1.1" 403 199 "-" "Mozilla/5.0 zgrab/0.x"
SCORE:
90
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\mpirogova\sites\site2\core\Logs[deleted]\httpd\access_log
LOG_MODIFIED:
Tue May 7 07:55:38 2024
LOG_ACCESSED:
Tue May 14 16:22:15 2024
LOG_CREATED:
Fri Aug 30 07:25:01 2024
REASON_1:
YARA rule EXPL_Exchange_ProxyShell_Successful_Aug21_1 / Detects successful ProxyShell exploitation attempts in log files
SUBSCORE_1:
85
REF_1:
https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- /autodiscover/autodiscover.json?@zdi/Powershell

RULEDATE_1:
2021-08-08
TAGS_1:
EXPLOIT, SCRIPT
RULENAME_1:
EXPL_Exchange_ProxyShell_Successful_Aug21_1
AUTHOR_1:
Florian Roth
REASON_2:
YARA rule EXPL_Exchange_ProxyShell_Aug21_1 / Detects successful ProxyShell exploitation attempts in log files
SUBSCORE_2:
70
REF_2:
https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html
SIGTYPE_2:
internal
SIGCLASS_2:
YARA Rule
MATCHED_2

- /autodiscover/autodiscover.json?@zdi/Powershell

RULEDATE_2:
2021-08-08
TAGS_2:
EXPLOIT, SCRIPT
RULENAME_2:
EXPL_Exchange_ProxyShell_Aug21_1
AUTHOR_2:
Florian Roth
REASONS_COUNT:
2

Alert 6

Aug 30 08:29:46 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Malware file found
SCORE:
85
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\mpirogova\sites\site2\core\Logs[deleted]\httpd\access_log
EXT:
TYPE:
IP Log
SIZE:
703152
MD5:
857a3b06303b8c133060b62f06f817cd
SHA1:
4660e22431e4423208ffb7a2eeb65ae00efbfaf9
SHA256:
04bb63cd98f63ba08f945ad5e91ddc8656eb7c55d809b13d99a9c71741306d50
FIRSTBYTES:
3139322e3234312e3233312e3531202d202d205b / 192.241.231.51 - - [
CREATED:
Fri Aug 30 07:25:01.721 2024
MODIFIED:
Tue May 7 07:55:38.000 2024
ACCESSED:
Tue May 14 16:22:15.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXPL_Exchange_ProxyShell_Successful_Aug21_1 / Detects successful ProxyShell exploitation attempts in log files
SUBSCORE_1:
85
REF_1:
https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- /autodiscover/autodiscover.json?@zdi/Powershell at 0x187f in
  ".241.193.117 - - [05/May/2024:05:06:30 +0300] \"GET /autodiscover/autodiscover.json?@zdi/Powershell HTTP/1.1\" 403 199 \"-\" \"Mozilla/5.0 zgrab/0.x\"\x0a192"

RULEDATE_1:
2021-08-08
TAGS_1:
EXPLOIT, SCRIPT
RULENAME_1:
EXPL_Exchange_ProxyShell_Successful_Aug21_1
AUTHOR_1:
Florian Roth
REASONS_COUNT:
1

Alert 7

Aug 30 08:35:01 WIN-LRTT94FA08M/10.100.5.12
MODULE:
LogScan
MESSAGE:
Malicious Log Entry found
ENTRY:
192.241.193.117 - - [05/May/2024:05:06:30 +0300] "GET /autodiscover/autodiscover.json?@zdi/Powershell HTTP/1.1" 403 199 "-" "Mozilla/5.0 zgrab/0.x"
SCORE:
90
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\var\var\httpd\access_log
LOG_MODIFIED:
Tue May 7 07:55:38 2024
LOG_ACCESSED:
Tue May 14 16:36:08 2024
LOG_CREATED:
Fri Aug 30 07:36:47 2024
REASON_1:
YARA rule EXPL_Exchange_ProxyShell_Successful_Aug21_1 / Detects successful ProxyShell exploitation attempts in log files
SUBSCORE_1:
85
REF_1:
https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- /autodiscover/autodiscover.json?@zdi/Powershell

RULEDATE_1:
2021-08-08
TAGS_1:
EXPLOIT, SCRIPT
RULENAME_1:
EXPL_Exchange_ProxyShell_Successful_Aug21_1
AUTHOR_1:
Florian Roth
REASON_2:
YARA rule EXPL_Exchange_ProxyShell_Aug21_1 / Detects successful ProxyShell exploitation attempts in log files
SUBSCORE_2:
70
REF_2:
https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html
SIGTYPE_2:
internal
SIGCLASS_2:
YARA Rule
MATCHED_2

- /autodiscover/autodiscover.json?@zdi/Powershell

RULEDATE_2:
2021-08-08
TAGS_2:
EXPLOIT, SCRIPT
RULENAME_2:
EXPL_Exchange_ProxyShell_Aug21_1
AUTHOR_2:
Florian Roth
REASONS_COUNT:
2

Alert 8

Aug 30 08:35:01 WIN-LRTT94FA08M/10.100.5.12
MODULE:
LogScan
MESSAGE:
Malicious Log Entry found
ENTRY:
192.241.193.117 - - [05/May/2024:05:06:45 +0300] "GET /autodiscover/autodiscover.json?@zdi/Powershell HTTP/1.1" 403 199 "-" "Mozilla/5.0 zgrab/0.x"
SCORE:
90
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\var\var\httpd\access_log
LOG_MODIFIED:
Tue May 7 07:55:38 2024
LOG_ACCESSED:
Tue May 14 16:36:08 2024
LOG_CREATED:
Fri Aug 30 07:36:47 2024
REASON_1:
YARA rule EXPL_Exchange_ProxyShell_Successful_Aug21_1 / Detects successful ProxyShell exploitation attempts in log files
SUBSCORE_1:
85
REF_1:
https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- /autodiscover/autodiscover.json?@zdi/Powershell

RULEDATE_1:
2021-08-08
TAGS_1:
EXPLOIT, SCRIPT
RULENAME_1:
EXPL_Exchange_ProxyShell_Successful_Aug21_1
AUTHOR_1:
Florian Roth
REASON_2:
YARA rule EXPL_Exchange_ProxyShell_Aug21_1 / Detects successful ProxyShell exploitation attempts in log files
SUBSCORE_2:
70
REF_2:
https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html
SIGTYPE_2:
internal
SIGCLASS_2:
YARA Rule
MATCHED_2

- /autodiscover/autodiscover.json?@zdi/Powershell

RULEDATE_2:
2021-08-08
TAGS_2:
EXPLOIT, SCRIPT
RULENAME_2:
EXPL_Exchange_ProxyShell_Aug21_1
AUTHOR_2:
Florian Roth
REASONS_COUNT:
2

Alert 9

Aug 30 08:35:02 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Malware file found
SCORE:
85
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\var\var\httpd\access_log
EXT:
TYPE:
IP Log
SIZE:
703152
MD5:
857a3b06303b8c133060b62f06f817cd
SHA1:
4660e22431e4423208ffb7a2eeb65ae00efbfaf9
SHA256:
04bb63cd98f63ba08f945ad5e91ddc8656eb7c55d809b13d99a9c71741306d50
FIRSTBYTES:
3139322e3234312e3233312e3531202d202d205b / 192.241.231.51 - - [
CREATED:
Fri Aug 30 07:36:47.995 2024
MODIFIED:
Tue May 7 07:55:38.000 2024
ACCESSED:
Tue May 14 16:36:08.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXPL_Exchange_ProxyShell_Successful_Aug21_1 / Detects successful ProxyShell exploitation attempts in log files
SUBSCORE_1:
85
REF_1:
https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- /autodiscover/autodiscover.json?@zdi/Powershell at 0x187f in
  ".241.193.117 - - [05/May/2024:05:06:30 +0300] \"GET /autodiscover/autodiscover.json?@zdi/Powershell HTTP/1.1\" 403 199 \"-\" \"Mozilla/5.0 zgrab/0.x\"\x0a192"

RULEDATE_1:
2021-08-08
TAGS_1:
EXPLOIT, SCRIPT
RULENAME_1:
EXPL_Exchange_ProxyShell_Successful_Aug21_1
AUTHOR_1:
Florian Roth
REASONS_COUNT:
1

Warnings
Warning 1 | Aug 30 08:26:48 WIN-LRTT94FA08M/10.100.5.12 MODULE: Startup MESSAGE: Signature file is older than 60 days. Run 'thor-util upgrade' to get new signatures.

Warning 2

Aug 30 08:28:17 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Malware file found
SCORE:
83
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\mpirogova\.cache\composer\files\phpunit\phpunit\1f77ae2d4af2b1612629468e2c7afc682466b121.zip\sebastianbergmann-phpunit-6e35126\src\Util\PHP\eval-stdin.php
EXT:
.php
TYPE:
PHP
SIZE:
54
MD5:
120ac49800671dc383b6f3709c25c099
SHA1:
5f1ec986c407846c7cde2bc5d939cdfab7125967
SHA256:
64589452b166cb815b3f7ab28324bd743fc606e7a3a8ca207d2faa313e5d4cf3
FIRSTBYTES:
3c3f7068700a0a6576616c28273f3e27202e2066 / <?php eval('?>' . f
MODIFIED:
Thu Feb 11 14:56:33.000 2016
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\mpirogova\.cache\composer\files\phpunit\phpunit\1f77ae2d4af2b1612629468e2c7afc682466b121.zip
ARCHIVE_TYPE:
ZIP
ARCHIVE_SIZE:
593998
ARCHIVE_MD5:
37db7eb21d082a60ca7d1ec77a7b86c8
ARCHIVE_SHA1:
77383c303ab5aa4110129074e8bec4da69c7d0b9
ARCHIVE_SHA256:
b4efd93e85bd67b8097a13f58020bb2cba7de73cc01e265859ef49984db58172
ARCHIVE_FIRSTBYTES:
504b03040a000000000010374b48000000000000 / PK 7KH
ARCHIVE_CREATED:
Thu Aug 29 15:38:58.104 2024
ARCHIVE_MODIFIED:
Tue Sep 3 10:20:38.000 2019
ARCHIVE_ACCESSED:
Tue May 14 16:10:01.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_WEBSHELL_PHP_Generic / php webshell having some kind of input and some kind of payload. restricted to small files or big ones inclusing suspicious strings
SUBSCORE_1:
75
REF_1:
Internal Research
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- <? at 0x0 in
  "<?php\x0a\x0aeval('?>' . file_get_contents('php://input'))"
- <?php at 0x0 in
  "<?php\x0a\x0aeval('?>' . file_get_contents('php://input'));\x0a"
- php://input at 0x26 in
  "<?php\x0a\x0aeval('?>' . file_get_contents('php://input'));\x0a"
- eval(' at 0x7 in
  "<?php\x0a\x0aeval('?>' . file_get_contents('php://input'));\x0a"
- eval(' at 0x7 in
  "<?php\x0a\x0aeval('?>' . file_get_contents('php://input'));\x0a"

RULEDATE_1:
2021-01-14
TAGS_1:
GEN, T1033, T1087_002, T1505_003, VENDOR, WEBSHELL
RULENAME_1:
EXT_WEBSHELL_PHP_Generic
AUTHOR_1:
Arnim Rupp (https://github.com/ruppde)
REASON_2:
YARA rule SUSP_WEBSHELL_Tiny_Eval_Oct20 / Detects suspicious tiny files including an eval statement
SUBSCORE_2:
65
REF_2:
Internal Research
SIGTYPE_2:
internal
SIGCLASS_2:
YARA Rule
MATCHED_2

- eval( at 0x7 in
  "<?php\x0a\x0aeval('?>' . file_get_contents('php://input'));\x0a"

RULEDATE_2:
2020-10-15
TAGS_2:
FILE, SUSP, T1505_003, WEBSHELL
RULENAME_2:
SUSP_WEBSHELL_Tiny_Eval_Oct20
AUTHOR_2:
Florian Roth
REASONS_COUNT:
2

Warning 3

Aug 30 08:28:53 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Possibly Dangerous file found
SCORE:
70
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\mpirogova\.cache\composer\repo\https---repo.packagist.org\p-provider-2019-07.json
EXT:
.json
TYPE:
UNKNOWN
SIZE:
2579459
MD5:
375539ac49b5bbb3d4210f5e2f8693b0
SHA1:
5a327f54f00968c113eeacb8090f97db3b678d8c
SHA256:
9333a714c76df9ed3d7206446e4c8f9ff33dcb46545e1278aa7453bc35a5e6f6
FIRSTBYTES:
7b2270726f766964657273223a7b22302e302e30 / {"providers":{"0.0.0
CREATED:
Thu Aug 29 15:38:55.954 2024
MODIFIED:
Thu Dec 5 09:35:54.000 2019
ACCESSED:
Tue May 14 16:14:59.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule SUSP_JS_Dropping_Exe_Aug23 / Detects JavaScript file that drops executables
SUBSCORE_1:
70
REF_1:
https://twitter.com/James_inthe_box/status/1674105216575373312
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "4d5a at 0x5081e in
  c88af246862def815"},"carno-php/serving":{"sha256":"4d5abf1f8ae6ebf1fa75860d47845d9a8c944ee01d8529c95c571d
- powershell at 0x13de3 in
  0eca93a8c250536ecb27819edf"},"alissonpelizaro/ssh_powershell":{"sha256":"d542da6654214697055931a1024fc2ffc2862

RULEDATE_1:
2023-08-03
TAGS_1:
EXE, FILE, SUSP
RULENAME_1:
SUSP_JS_Dropping_Exe_Aug23
AUTHOR_1:
X__Junior
REASONS_COUNT:
1

Warning 4

Aug 30 08:29:57 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Possibly Dangerous file found
SCORE:
60
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\mpirogova\sites\site2\core\components\modalconsole\files\1.php
EXT:
.php
TYPE:
PHP
SIZE:
1238
MD5:
0bc2508476c9bb5e51863f1676fff755
SHA1:
a8e2af20dfcea4e2ea5a6355d6605a05d24e1b2b
SHA256:
e2ee8470f319042893992f498d3344700b1b7c3295e95e70d5b81a79f972f13a
FIRSTBYTES:
3c3f7068700a246576656e74537461747573203d / <?php $eventStatus =
CREATED:
Fri Aug 30 07:22:20.619 2024
MODIFIED:
Mon Nov 25 12:10:57.000 2019
ACCESSED:
Tue May 14 16:20:50.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
Filename IOC \\[0-9]\.(aspx|asp|jsp|jspx|php)
SUBSCORE_1:
60
REF_1:
Suspicious Web Shell file names https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/new-apt-group-chamelgang/#id3-1
SIGTYPE_1:
internal
SIGCLASS_1:
Filename IOC
MATCHED_1

- \1.php

REASONS_COUNT:
1

Warning 5

Aug 30 08:29:57 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Possibly Dangerous file found
SCORE:
60
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\mpirogova\sites\site2\core\components\modalconsole\files\2.php
EXT:
.php
TYPE:
PHP
SIZE:
1465
MD5:
6d199d7b1d8ee58b56fb48771999a7a1
SHA1:
2bfc77a99278f1ea51f1fad04a3f5177c24d8638
SHA256:
ca49ac28acf7f7cf3da6a66da9bf78c5598edbb5e822de7e5d4bc9819c0b4212
FIRSTBYTES:
3c3f7068700a246576656e74537461747573203d / <?php $eventStatus =
CREATED:
Fri Aug 30 07:22:20.620 2024
MODIFIED:
Mon Nov 25 13:42:16.000 2019
ACCESSED:
Tue May 14 16:21:01.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
Filename IOC \\[0-9]\.(aspx|asp|jsp|jspx|php)
SUBSCORE_1:
60
REF_1:
Suspicious Web Shell file names https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/new-apt-group-chamelgang/#id3-1
SIGTYPE_1:
internal
SIGCLASS_1:
Filename IOC
MATCHED_1

- \2.php

REASONS_COUNT:
1

Warning 6

Aug 30 08:29:57 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Possibly Dangerous file found
SCORE:
60
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\mpirogova\sites\site2\core\components\modalconsole\files\3.php
EXT:
.php
TYPE:
PHP
SIZE:
1726
MD5:
e7bb65f839e337812c6e6d291193d8dc
SHA1:
2a029dcd757e66a68e709ba1b04c32884457509b
SHA256:
ba87b7a83977494070f63c3b9aa8b2143b2f84f6735a922443609163b75e8841
FIRSTBYTES:
3c3f7068700a246576656e74537461747573203d / <?php $eventStatus =
CREATED:
Fri Aug 30 07:22:20.622 2024
MODIFIED:
Mon Nov 25 14:38:48.000 2019
ACCESSED:
Tue May 14 16:21:06.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
Filename IOC \\[0-9]\.(aspx|asp|jsp|jspx|php)
SUBSCORE_1:
60
REF_1:
Suspicious Web Shell file names https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/new-apt-group-chamelgang/#id3-1
SIGTYPE_1:
internal
SIGCLASS_1:
Filename IOC
MATCHED_1

- \3.php

REASONS_COUNT:
1

Warning 7

Aug 30 08:29:57 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Possibly Dangerous file found
SCORE:
60
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\mpirogova\sites\site2\core\components\modalconsole\files\4.php
EXT:
.php
TYPE:
PHP
SIZE:
1024
MD5:
d32aee0812eb2e4d7008d136799d379d
SHA1:
eb9683ef7d040fcb77bb038c0ab968cca331f243
SHA256:
5dcdd7254ae41af8273bafd27c5b6b46ab2838a7e25e3abc13010088cd42cb01
FIRSTBYTES:
3c3f7068700a246576656e74537461747573203d / <?php $eventStatus =
CREATED:
Fri Aug 30 07:22:20.674 2024
MODIFIED:
Mon Nov 25 15:21:12.000 2019
ACCESSED:
Tue May 14 16:21:11.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
Filename IOC \\[0-9]\.(aspx|asp|jsp|jspx|php)
SUBSCORE_1:
60
REF_1:
Suspicious Web Shell file names https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/new-apt-group-chamelgang/#id3-1
SIGTYPE_1:
internal
SIGCLASS_1:
Filename IOC
MATCHED_1

- \4.php

REASONS_COUNT:
1

Warning 8

Aug 30 08:33:11 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Possibly Dangerous file found
SCORE:
70
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\.cache\composer\repo\https---repo.packagist.org\p-provider-2019-07.json
EXT:
.json
TYPE:
UNKNOWN
SIZE:
2216307
MD5:
8e950fa473ea314a8fcf3632b27fd48d
SHA1:
4b77fdf2be0cec8ec91090c7138603ca990cbfa5
SHA256:
9e16e658955dcc7c4f8c7808f5492b84f43c10784b87557024fb0ede0913c2c8
FIRSTBYTES:
7b2270726f766964657273223a7b22302e302e30 / {"providers":{"0.0.0
CREATED:
Fri Aug 30 07:30:27.859 2024
MODIFIED:
Mon Feb 3 14:17:02.000 2020
ACCESSED:
Tue May 14 16:13:09.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule SUSP_JS_Dropping_Exe_Aug23 / Detects JavaScript file that drops executables
SUBSCORE_1:
70
REF_1:
https://twitter.com/James_inthe_box/status/1674105216575373312
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "4d5a at 0x433cd in
  c88af246862def815"},"carno-php/serving":{"sha256":"4d5abf1f8ae6ebf1fa75860d47845d9a8c944ee01d8529c95c571d
- powershell at 0x11454 in
  0eca93a8c250536ecb27819edf"},"alissonpelizaro/ssh_powershell":{"sha256":"d542da6654214697055931a1024fc2ffc2862

RULEDATE_1:
2023-08-03
TAGS_1:
EXE, FILE, SUSP
RULENAME_1:
SUSP_JS_Dropping_Exe_Aug23
AUTHOR_1:
X__Junior
REASONS_COUNT:
1

Notices

Notice 1

Aug 30 08:27:26 WIN-LRTT94FA08M/10.100.5.12
MODULE:
LogScan
MESSAGE:
Notable Log Entry found
ENTRY:
10.16.6.250 - - [06/May/2024:11:56:51 +0300] "GET /autodiscover/autodiscover.json?@test.com/owa/?&Email=autodiscover/autodiscover.json%3F@test.com HTTP/1.1" 403 199 "-" "-"
SCORE:
50
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\it_sec\httpd\access_log
LOG_MODIFIED:
Tue May 7 07:55:38 2024
LOG_ACCESSED:
Tue May 14 16:22:15 2024
LOG_CREATED:
Thu Aug 29 15:34:29 2024
REASON_1:
YARA rule LOG_EXPL_Exchange_ProxyShell_Attempt_Aug21_1 / Detects ProxyShell exploitation attempts in log files
SUBSCORE_1:
50
REF_1:
https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- /autodiscover/autodiscover.json?@test.com/owa/?&Email=autodiscover/autodiscover.json%3F@

RULEDATE_1:
2021-08-09
TAGS_1:
EXPLOIT, LOG
RULENAME_1:
LOG_EXPL_Exchange_ProxyShell_Attempt_Aug21_1
AUTHOR_1:
Florian Roth
REASONS_COUNT:
1

Notice 2

Aug 30 08:27:27 WIN-LRTT94FA08M/10.100.5.12
MODULE:
LogScan
MESSAGE:
Notable Log Entry found
ENTRY:
10.16.6.250 - - [07/May/2024:10:31:56 +0300] "GET /autodiscover/autodiscover.json?@test.com/owa/?&Email=autodiscover/autodiscover.json%3F@test.com HTTP/1.1" 403 199 "-" "-"
SCORE:
50
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\it_sec\httpd\access_log
LOG_MODIFIED:
Tue May 7 07:55:38 2024
LOG_ACCESSED:
Tue May 14 16:22:15 2024
LOG_CREATED:
Thu Aug 29 15:34:29 2024
REASON_1:
YARA rule LOG_EXPL_Exchange_ProxyShell_Attempt_Aug21_1 / Detects ProxyShell exploitation attempts in log files
SUBSCORE_1:
50
REF_1:
https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- /autodiscover/autodiscover.json?@test.com/owa/?&Email=autodiscover/autodiscover.json%3F@

RULEDATE_1:
2021-08-09
TAGS_1:
EXPLOIT, LOG
RULENAME_1:
LOG_EXPL_Exchange_ProxyShell_Attempt_Aug21_1
AUTHOR_1:
Florian Roth
REASONS_COUNT:
1

Notice 3

Aug 30 08:29:45 WIN-LRTT94FA08M/10.100.5.12
MODULE:
LogScan
MESSAGE:
Notable Log Entry found
ENTRY:
10.16.6.250 - - [06/May/2024:11:56:51 +0300] "GET /autodiscover/autodiscover.json?@test.com/owa/?&Email=autodiscover/autodiscover.json%3F@test.com HTTP/1.1" 403 199 "-" "-"
SCORE:
50
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\mpirogova\sites\site2\core\Logs[deleted]\httpd\access_log
LOG_MODIFIED:
Tue May 7 07:55:38 2024
LOG_ACCESSED:
Tue May 14 16:22:15 2024
LOG_CREATED:
Fri Aug 30 07:25:01 2024
REASON_1:
YARA rule LOG_EXPL_Exchange_ProxyShell_Attempt_Aug21_1 / Detects ProxyShell exploitation attempts in log files
SUBSCORE_1:
50
REF_1:
https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- /autodiscover/autodiscover.json?@test.com/owa/?&Email=autodiscover/autodiscover.json%3F@

RULEDATE_1:
2021-08-09
TAGS_1:
EXPLOIT, LOG
RULENAME_1:
LOG_EXPL_Exchange_ProxyShell_Attempt_Aug21_1
AUTHOR_1:
Florian Roth
REASONS_COUNT:
1

Notice 4

Aug 30 08:29:46 WIN-LRTT94FA08M/10.100.5.12
MODULE:
LogScan
MESSAGE:
Notable Log Entry found
ENTRY:
10.16.6.250 - - [07/May/2024:10:31:56 +0300] "GET /autodiscover/autodiscover.json?@test.com/owa/?&Email=autodiscover/autodiscover.json%3F@test.com HTTP/1.1" 403 199 "-" "-"
SCORE:
50
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\mpirogova\sites\site2\core\Logs[deleted]\httpd\access_log
LOG_MODIFIED:
Tue May 7 07:55:38 2024
LOG_ACCESSED:
Tue May 14 16:22:15 2024
LOG_CREATED:
Fri Aug 30 07:25:01 2024
REASON_1:
YARA rule LOG_EXPL_Exchange_ProxyShell_Attempt_Aug21_1 / Detects ProxyShell exploitation attempts in log files
SUBSCORE_1:
50
REF_1:
https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- /autodiscover/autodiscover.json?@test.com/owa/?&Email=autodiscover/autodiscover.json%3F@

RULEDATE_1:
2021-08-09
TAGS_1:
EXPLOIT, LOG
RULENAME_1:
LOG_EXPL_Exchange_ProxyShell_Attempt_Aug21_1
AUTHOR_1:
Florian Roth
REASONS_COUNT:
1

Notice 5

Aug 30 08:32:06 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.5p1\regress\rsa_openssh.prv
EXT:
.prv
TYPE:
Certificate PEM
SIZE:
883
MD5:
a6b110f820948e73bbde7b948744b3c5
SHA1:
614e6d353be614ded246a12ed6e14af20f063710
SHA256:
79b8783d0b10a3f65b9b3e349a1daa692cc27be08028131ff5a9a08799035f46
FIRSTBYTES:
2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA
CREATED:
Thu Aug 29 15:37:24.013 2024
MODIFIED:
Tue Mar 2 10:31:47.000 2021
ACCESSED:
Tue May 14 16:09:22.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x43\x57\x67\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x73\x69\x6c\x77\x4b\x63\x61\x4b\x4e\x36\x77\x53\x4d\x4e\x64\x31\x57\x67\x51\x39\x2b\x48\x52\x71\x51\x45\x6b\x44\x30\x6b\x43\x54\x56\x74\x74\x72\x61\x7a"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 6

Aug 30 08:32:07 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.5p1\regress\misc\fuzz-harness\testdata\id_dsa
EXT:
TYPE:
Certificate PEM
SIZE:
1361
MD5:
a9521c2825fbf778b6b82b1dcda95d72
SHA1:
29bc6d9b491473450487aad65a659675154b8fb8
SHA256:
a6fa247970fe3fe15b9647e9ae301495d10ea278dbe9516abdf70e69b1849744
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Thu Aug 29 15:37:23.979 2024
MODIFIED:
Tue Mar 2 10:31:47.000 2021
ACCESSED:
Tue May 14 16:22:49.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x42\x73\x67\x41\x41\x41\x41\x64\x7a\x63\x32\x67\x74\x5a\x48\x0a\x4e\x7a\x41\x41\x41\x41\x67\x51\x43\x73"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 7

Aug 30 08:32:07 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.5p1\regress\misc\fuzz-harness\testdata\id_ecdsa
EXT:
TYPE:
Certificate PEM
SIZE:
492
MD5:
b14d14c4a2eb3a89c43be1d828fe2604
SHA1:
56c94a39972cc4c2ab982f6b206702cf3b558bde
SHA256:
00120fd3e06a2c9a2debabe94c75cb9a8fb313d17b3a114dda6264874ae56c60
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Thu Aug 29 15:37:23.981 2024
MODIFIED:
Tue Mar 2 10:31:47.000 2021
ACCESSED:
Tue May 14 16:23:02.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x61\x41\x41\x41\x41\x42\x4e\x6c\x59\x32\x52\x7a\x59\x53\x0a\x31\x7a\x61\x47\x45\x79\x4c\x57\x35\x70"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 8

Aug 30 08:32:07 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.5p1\regress\misc\fuzz-harness\testdata\id_ecdsa_sk
EXT:
TYPE:
Certificate PEM
SIZE:
858
MD5:
c87bc24fa8b257e7af7374511f44d2c5
SHA1:
2c1d6e64ad0052837b53739841f6acfc60a191ed
SHA256:
50e6649901ffdf7bc4d85dd0f45937b9d99bdd85e472c112f8586bd3e35beb58
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Thu Aug 29 15:37:23.984 2024
MODIFIED:
Tue Mar 2 10:31:47.000 2021
ACCESSED:
Tue May 14 16:23:15.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x66\x77\x41\x41\x41\x43\x4a\x7a\x61\x79\x31\x6c\x59\x32\x0a\x52\x7a\x59\x53\x31\x7a\x61\x47\x45\x79"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 9

Aug 30 08:32:07 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.5p1\regress\misc\fuzz-harness\testdata\id_ed25519
EXT:
TYPE:
Certificate PEM
SIZE:
387
MD5:
904e0a369a7fbe86bcb4e0bc1363c539
SHA1:
1074da4383390925d414ad562a0818a88e116208
SHA256:
6efecdbb70364afc9cf004e325a9a1d2673d86e85a6238e1126d6d105cea56c1
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Thu Aug 29 15:37:23.985 2024
MODIFIED:
Tue Mar 2 10:31:47.000 2021
ACCESSED:
Tue May 14 16:23:28.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 10

Aug 30 08:32:07 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.5p1\regress\misc\fuzz-harness\testdata\id_ed25519_sk
EXT:
TYPE:
Certificate PEM
SIZE:
496
MD5:
c3c7cad31e9edf76f806848501011568
SHA1:
f936a6c0f3b1250ef7fd0cbf4ea5a5d3c9c63507
SHA256:
5fd315701b14a13467331e1d0819a8016abdf5888ab695f068fce488bd37169d
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Thu Aug 29 15:37:23.987 2024
MODIFIED:
Tue Mar 2 10:31:47.000 2021
ACCESSED:
Tue May 14 16:23:44.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x53\x67\x41\x41\x41\x42\x70\x7a\x61\x79\x31\x7a\x63\x32\x0a\x67\x74\x5a\x57\x51\x79\x4e\x54\x55\x78"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 11

Aug 30 08:32:07 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.5p1\regress\misc\fuzz-harness\testdata\id_rsa
EXT:
TYPE:
Certificate PEM
SIZE:
1799
MD5:
0e4d9d0e310d6dc6a5c2d33660f70542
SHA1:
7bef427ad9067a465009d543787063fdaceef3e5
SHA256:
83822e39fb2ee059431a45c3c48cffcda3fb869273a364a45898ce9abad09e84
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Thu Aug 29 15:37:23.989 2024
MODIFIED:
Tue Mar 2 10:31:47.000 2021
ACCESSED:
Tue May 14 16:23:58.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x42\x46\x77\x41\x41\x41\x41\x64\x7a\x63\x32\x67\x74\x63\x6e\x0a\x4e\x68\x41\x41\x41\x41\x41\x77\x45\x41"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 12

Aug 30 08:32:08 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.5p1\regress\unittests\sshkey\testdata\dsa_1
EXT:
TYPE:
Certificate PEM
SIZE:
672
MD5:
aebcad00ac7fb84f1a7de01322c99be3
SHA1:
a9a0e1cf84bee8c27802295819b399833e5d4d08
SHA256:
b7f7c2bb695b28e585951a2da4ad2d6c933c440afe118798c6e2363e17da2b93
FIRSTBYTES:
2d2d2d2d2d424547494e20445341205052495641 / -----BEGIN DSA PRIVA
CREATED:
Thu Aug 29 15:37:24.200 2024
MODIFIED:
Tue Mar 2 10:31:47.000 2021
ACCESSED:
Tue May 14 16:20:25.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x44\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x42\x76\x41\x49\x42\x41\x41\x4b\x42\x67\x51" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x44\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x42\x76\x41\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x36\x6b\x75\x74\x4e\x46\x52\x73\x48\x54\x77\x45\x41\x76\x36\x64\x33\x39\x4c\x68\x73\x71\x79\x31\x61\x70\x64\x48\x42\x5a\x39\x63\x32\x48\x66\x79\x52\x72\x37\x57\x6d\x79\x70\x79\x47\x49\x79\x32\x6d"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 13

Aug 30 08:32:08 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.5p1\regress\unittests\sshkey\testdata\dsa_n
EXT:
TYPE:
Certificate PEM
SIZE:
1361
MD5:
6fcf088f9850b2f2213186cee4dc4811
SHA1:
a04d604886c6a7c2217df9b7eea5c998da91d561
SHA256:
db691de6aa454ec8aa45c84c58022a54611427f6f44c20d152ac05e0ea2284ba
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Thu Aug 29 15:37:24.213 2024
MODIFIED:
Tue Mar 2 10:31:47.000 2021
ACCESSED:
Tue May 14 16:21:26.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x42\x73\x77\x41\x41\x41\x41\x64\x7a\x63\x32\x67\x74\x5a\x48\x0a\x4e\x7a\x41\x41\x41\x41\x67\x51\x44\x36"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 14

Aug 30 08:32:08 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.5p1\regress\unittests\sshkey\testdata\ecdsa_1
EXT:
TYPE:
Certificate PEM
SIZE:
227
MD5:
610b43e1fd8e09f2794aba398c6950eb
SHA1:
c7e5b5ff84b30ff8880e4d75942a600d012516b6
SHA256:
42a90746ef5975c6ef98c6d56305dad0bc698a1b05c83518bc90584c83935d5c
FIRSTBYTES:
2d2d2d2d2d424547494e20454320505249564154 / -----BEGIN EC PRIVAT
CREATED:
Thu Aug 29 15:37:24.214 2024
MODIFIED:
Tue Mar 2 10:31:47.000 2021
ACCESSED:
Tue May 14 16:21:35.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x48\x63\x43\x41\x51\x45\x45\x49\x50\x50\x4e\x79\x55\x41\x6e\x6a\x76\x46\x72\x2b\x65\x54\x2f\x37\x74\x2f\x49\x79\x6a\x75\x51\x51\x64\x2f\x61\x4c\x46\x69\x54\x59\x39\x32\x4c\x42\x39\x67\x49\x6a\x79\x72"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 15

Aug 30 08:32:08 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.5p1\regress\unittests\sshkey\testdata\ecdsa_2
EXT:
TYPE:
Certificate PEM
SIZE:
365
MD5:
0346ad9a21f23d98cb3abe4845df078d
SHA1:
07091af93e22c676e03e6f96e9d0e53c9b53d775
SHA256:
320396e36bd5ecc12089f26849f8e7b6e0ab3c037f0492dee978cef6646d5826
FIRSTBYTES:
2d2d2d2d2d424547494e20454320505249564154 / -----BEGIN EC PRIVAT
CREATED:
Thu Aug 29 15:37:24.217 2024
MODIFIED:
Tue Mar 2 10:31:47.000 2021
ACCESSED:
Tue May 14 16:22:18.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x48\x63\x41\x67\x45\x42\x42\x45\x49\x42\x71\x42\x74\x4e\x37\x65\x36\x45\x73\x73\x64\x33\x64\x6c\x73\x67\x49\x53\x56\x69\x50\x43\x58\x58\x43\x30\x61\x74\x6c\x4e\x6b\x47\x74\x6f\x4d\x67\x53\x51\x64"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 16

Aug 30 08:32:08 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.5p1\regress\unittests\sshkey\testdata\ecdsa_n
EXT:
TYPE:
Certificate PEM
SIZE:
492
MD5:
0ffc5b7197ecb4b69f503d4f3cc24c8c
SHA1:
c2c7fd9527d9cc84781346a3ac8e2100d4d20ad3
SHA256:
1cccaa23aca49238099494fc7b49b550311719c9ac6bb138797e1077f4d7973d
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Thu Aug 29 15:37:24.224 2024
MODIFIED:
Tue Mar 2 10:31:47.000 2021
ACCESSED:
Tue May 14 16:22:50.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x61\x41\x41\x41\x41\x42\x4e\x6c\x59\x32\x52\x7a\x59\x53\x0a\x31\x7a\x61\x47\x45\x79\x4c\x57\x35\x70"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 17

Aug 30 08:32:08 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.5p1\regress\unittests\sshkey\testdata\ecdsa_sk1
EXT:
TYPE:
Certificate PEM
SIZE:
849
MD5:
97206cfa158fdda5a45c6eb542f739c0
SHA1:
e55ec614db8cea92d7269d5f903cf72baca36454
SHA256:
e4df7ea4ca133a7457069be073203c556166c65635ed6fb6c12b9a84f027346e
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Thu Aug 29 15:37:24.225 2024
MODIFIED:
Tue Mar 2 10:31:47.000 2021
ACCESSED:
Tue May 14 16:22:58.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x66\x77\x41\x41\x41\x43\x4a\x7a\x61\x79\x31\x6c\x59\x32\x0a\x52\x7a\x59\x53\x31\x7a\x61\x47\x45\x79"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 18

Aug 30 08:32:08 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.5p1\regress\unittests\sshkey\testdata\ecdsa_sk2
EXT:
TYPE:
Certificate PEM
SIZE:
849
MD5:
14ecb7595ee296b15d413ae395454a4c
SHA1:
909379299593aeebc79f44df0ec22578123acce7
SHA256:
de6f60d862f799ca088bd4611865e24bb0635d81097bb9496f0178aefa4acbae
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Thu Aug 29 15:37:24.240 2024
MODIFIED:
Tue Mar 2 10:31:47.000 2021
ACCESSED:
Tue May 14 16:23:29.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x66\x77\x41\x41\x41\x43\x4a\x7a\x61\x79\x31\x6c\x59\x32\x0a\x52\x7a\x59\x53\x31\x7a\x61\x47\x45\x79"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 19

Aug 30 08:32:08 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.5p1\regress\unittests\sshkey\testdata\ed25519_1
EXT:
TYPE:
Certificate PEM
SIZE:
411
MD5:
514e8e39c48edb2b8934ef78a5030042
SHA1:
a7a368a6f3d09bc2cfc1315f6e0899bde0574ffd
SHA256:
74f95c1990e3512af471cf6fb58d08a8078bbab597e7ee86a7ccd233f6855fd1
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Thu Aug 29 15:37:24.243 2024
MODIFIED:
Tue Mar 2 10:31:47.000 2021
ACCESSED:
Tue May 14 16:23:49.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 20

Aug 30 08:32:08 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.5p1\regress\unittests\sshkey\testdata\ed25519_2
EXT:
TYPE:
Certificate PEM
SIZE:
411
MD5:
bfc2ac8495dbc6070241303ec50a6dc2
SHA1:
53e388e7c836c6ba874e852d71a6e1e708611d25
SHA256:
31689f4706b3bdad29ee21b05af62e9f2257399d07092089944514ed5edb131d
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Thu Aug 29 15:37:24.248 2024
MODIFIED:
Tue Mar 2 10:31:47.000 2021
ACCESSED:
Tue May 14 16:24:23.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 21

Aug 30 08:32:08 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.5p1\regress\unittests\sshkey\testdata\ed25519_sk1
EXT:
TYPE:
Certificate PEM
SIZE:
484
MD5:
ab9dcdbff00763217a3f85069a9c2f67
SHA1:
05396ad046c37370093f48c0bdb2510b8894aa76
SHA256:
45c058d08280c4ca36a9d020478504cd550e7c5752c207d182363c3edf669ce8
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Thu Aug 29 15:37:24.254 2024
MODIFIED:
Tue Mar 2 10:31:47.000 2021
ACCESSED:
Tue May 14 16:24:45.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x53\x67\x41\x41\x41\x42\x70\x7a\x61\x79\x31\x7a\x63\x32\x0a\x67\x74\x5a\x57\x51\x79\x4e\x54\x55\x78"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 22

Aug 30 08:32:08 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.5p1\regress\unittests\sshkey\testdata\ed25519_sk2
EXT:
TYPE:
Certificate PEM
SIZE:
484
MD5:
8a666562de41f71d57d47c5f6404293a
SHA1:
069c9341d4b0cd94669ff23feab92853b6a42540
SHA256:
b862e169114ee63ae5e8497110075a9e67c4e3f24bad01e7c06951d268a3ec0f
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Thu Aug 29 15:37:24.258 2024
MODIFIED:
Tue Mar 2 10:31:47.000 2021
ACCESSED:
Tue May 14 16:25:17.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x53\x67\x41\x41\x41\x42\x70\x7a\x61\x79\x31\x7a\x63\x32\x0a\x67\x74\x5a\x57\x51\x79\x4e\x54\x55\x78"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 23

Aug 30 08:32:08 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.5p1\regress\unittests\sshkey\testdata\rsa_1
EXT:
TYPE:
Certificate PEM
SIZE:
887
MD5:
197f14927e89c5c573213416bde709cb
SHA1:
2f5cfafbddd00c351ce72e2f140458fb5ac7b60a
SHA256:
07586a53bef4dd9daf59c473399fca5fcb39891bed0d2c2f8a88249e02392ac5
FIRSTBYTES:
2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA
CREATED:
Thu Aug 29 15:37:24.261 2024
MODIFIED:
Tue Mar 2 10:31:47.000 2021
ACCESSED:
Tue May 14 16:25:39.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x43\x58\x41\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x4c\x56\x35\x6c\x55\x54\x74\x37\x46\x72\x41\x44\x73\x65\x42\x2f\x43\x47\x68\x45\x5a\x7a\x70\x6f\x6f\x6a\x6a\x45\x57\x35\x79\x38\x2b\x65\x50\x76\x4c\x70"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 24

Aug 30 08:32:08 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.5p1\regress\unittests\sshkey\testdata\rsa_1_sha1
EXT:
TYPE:
Certificate PEM
SIZE:
887
MD5:
197f14927e89c5c573213416bde709cb
SHA1:
2f5cfafbddd00c351ce72e2f140458fb5ac7b60a
SHA256:
07586a53bef4dd9daf59c473399fca5fcb39891bed0d2c2f8a88249e02392ac5
FIRSTBYTES:
2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA
CREATED:
Thu Aug 29 15:37:24.266 2024
MODIFIED:
Tue Mar 2 10:31:47.000 2021
ACCESSED:
Tue May 14 16:09:43.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x43\x58\x41\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x4c\x56\x35\x6c\x55\x54\x74\x37\x46\x72\x41\x44\x73\x65\x42\x2f\x43\x47\x68\x45\x5a\x7a\x70\x6f\x6f\x6a\x6a\x45\x57\x35\x79\x38\x2b\x65\x50\x76\x4c\x70"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 25

Aug 30 08:32:08 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.5p1\regress\unittests\sshkey\testdata\rsa_1_sha512
EXT:
TYPE:
Certificate PEM
SIZE:
887
MD5:
197f14927e89c5c573213416bde709cb
SHA1:
2f5cfafbddd00c351ce72e2f140458fb5ac7b60a
SHA256:
07586a53bef4dd9daf59c473399fca5fcb39891bed0d2c2f8a88249e02392ac5
FIRSTBYTES:
2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA
CREATED:
Thu Aug 29 15:37:24.268 2024
MODIFIED:
Tue Mar 2 10:31:47.000 2021
ACCESSED:
Tue May 14 16:09:57.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x43\x58\x41\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x4c\x56\x35\x6c\x55\x54\x74\x37\x46\x72\x41\x44\x73\x65\x42\x2f\x43\x47\x68\x45\x5a\x7a\x70\x6f\x6f\x6a\x6a\x45\x57\x35\x79\x38\x2b\x65\x50\x76\x4c\x70"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 26

Aug 30 08:32:08 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.5p1\regress\unittests\sshkey\testdata\rsa_2
EXT:
TYPE:
Certificate PEM
SIZE:
1679
MD5:
c8860a2d208d222eade1e9866449ccbc
SHA1:
64133ddc79d593e467c864c429e3793c69e4dc22
SHA256:
e42925e663a7215e19cdc89bd9fe018903eeb013f131b188d3c87f0ef01c5a24
FIRSTBYTES:
2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA
CREATED:
Thu Aug 29 15:37:24.270 2024
MODIFIED:
Tue Mar 2 10:31:47.000 2021
ACCESSED:
Tue May 14 16:10:10.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x45\x70\x41\x49\x42\x41\x41\x4b\x43\x41\x51\x45\x41\x39\x4e\x45\x55\x58\x70\x37\x38\x53\x41\x6b\x6d\x4c\x34\x2b\x65\x41\x6a\x34\x6d\x42\x7a\x50\x4f\x6a\x6b\x2b\x63\x63\x43\x50\x56\x7a\x6b\x54\x52\x2b"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 27

Aug 30 08:32:08 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.5p1\regress\unittests\sshkey\testdata\rsa_n
EXT:
TYPE:
Certificate PEM
SIZE:
1020
MD5:
d60f55c106077131ba136f02e9b9ba88
SHA1:
d6a3a8961cb40e8a4ff03dbfd5983c9fc5dfeb39
SHA256:
0ad47d17d5f21f350c26c4c94564bf41b6fd28ab55187166b4f46b1b35daed6d
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Thu Aug 29 15:37:24.274 2024
MODIFIED:
Tue Mar 2 10:31:47.000 2021
ACCESSED:
Tue May 14 16:10:40.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x6c\x77\x41\x41\x41\x41\x64\x7a\x63\x32\x67\x74\x63\x6e\x0a\x4e\x68\x41\x41\x41\x41\x41\x77\x45\x41"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 28

Aug 30 08:32:08 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.5p1\regress\unittests\sshsig\testdata\ecdsa
EXT:
TYPE:
Certificate PEM
SIZE:
227
MD5:
53f2aa69e4e8d05ea1c0848c4a946b71
SHA1:
69a4f47fbbb55eb5dea9adea057509384a32bb69
SHA256:
585957bd0a19fcff2d22cd8af7ffb13b68cc30c9dc13dfefb57271b03f3a999f
FIRSTBYTES:
2d2d2d2d2d424547494e20454320505249564154 / -----BEGIN EC PRIVAT
CREATED:
Thu Aug 29 15:37:24.281 2024
MODIFIED:
Tue Mar 2 10:31:47.000 2021
ACCESSED:
Tue May 14 16:11:16.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x48\x63\x43\x41\x51\x45\x45\x49\x46\x67\x30\x5a\x43\x53\x45\x42\x35\x4c\x4e\x65\x4c\x73\x58\x59\x4c\x32\x35\x67\x33\x6b\x71\x45\x57\x73\x71\x68\x35\x32\x44\x52\x2b\x79\x4e\x4f\x6a\x79\x51\x4a\x71\x79"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 29

Aug 30 08:32:08 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.5p1\regress\unittests\sshsig\testdata\ecdsa_sk
EXT:
TYPE:
Certificate PEM
SIZE:
837
MD5:
36948c6f96600caa24052b4d8322cbd9
SHA1:
b7bf9e701f8da5d50f61064849d052e04fb77c3f
SHA256:
f81b969ccd3e85f02b71465ba38fb51b5adf6f11b09f2e9e82ed6b2ab31f2356
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Thu Aug 29 15:37:24.283 2024
MODIFIED:
Tue Mar 2 10:31:47.000 2021
ACCESSED:
Tue May 14 16:11:29.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x66\x77\x41\x41\x41\x43\x4a\x7a\x61\x79\x31\x6c\x59\x32\x0a\x52\x7a\x59\x53\x31\x7a\x61\x47\x45\x79"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 30

Aug 30 08:32:08 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.5p1\regress\unittests\sshsig\testdata\ed25519
EXT:
TYPE:
Certificate PEM
SIZE:
411
MD5:
8bb197113a031c8f6d76de369316d0eb
SHA1:
40847760b4f753f2b17156d3f6f9cdcc7c0b91d4
SHA256:
c4683c666d6394fc5e8f3455b5379304979e0b41502560ddef20c824fa9fb66b
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Thu Aug 29 15:37:24.290 2024
MODIFIED:
Tue Mar 2 10:31:47.000 2021
ACCESSED:
Tue May 14 16:11:50.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 31

Aug 30 08:32:08 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.5p1\regress\unittests\sshsig\testdata\ed25519_sk
EXT:
TYPE:
Certificate PEM
SIZE:
484
MD5:
85bc2e18e08c06aa85cf023e7a97a585
SHA1:
95ea85c4709baf47e7cc2573ceac480cc35bde67
SHA256:
0e2221a7c8e8cea4fb6e9d2666b1d05166a3b0f5876c54433f0c35b564f22025
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Thu Aug 29 15:37:24.292 2024
MODIFIED:
Tue Mar 2 10:31:47.000 2021
ACCESSED:
Tue May 14 16:12:02.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x53\x67\x41\x41\x41\x42\x70\x7a\x61\x79\x31\x7a\x63\x32\x0a\x67\x74\x5a\x57\x51\x79\x4e\x54\x55\x78"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 32

Aug 30 08:32:08 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.5p1\regress\unittests\sshsig\testdata\rsa
EXT:
TYPE:
Certificate PEM
SIZE:
2455
MD5:
efe804ccdc63abc29233f3a1e11e173b
SHA1:
481c1773197aabc2d9d87336ad84f44410251ed4
SHA256:
d7eb37f534b846bb582bcdcf78232bdb33932e34fb72d6bfa130a8fd699b10b6
FIRSTBYTES:
2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA
CREATED:
Thu Aug 29 15:37:24.294 2024
MODIFIED:
Tue Mar 2 10:31:47.000 2021
ACCESSED:
Tue May 14 16:12:19.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x47\x34\x77\x49\x42\x41\x41\x4b\x43\x41\x59\x45\x41\x33\x38\x36\x6c\x6d\x6a\x52\x48\x74\x4a\x70\x79\x6a\x38\x37\x42\x72\x53\x2b\x73\x73\x4d\x6d\x74\x76\x63\x2f\x31\x53\x50\x4e\x30\x67\x58\x54\x50\x73"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 33

Aug 30 08:32:12 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.8p1\regress\ed25519_openssh.prv
EXT:
.prv
TYPE:
Certificate PEM
SIZE:
419
MD5:
c1d6034878b590c80805ad1e66039091
SHA1:
9127798b0fadd4539c81ee4f294287e8262eddb0
SHA256:
11bab46497954bd367ea5c2541cb3bad4814515481aee687fcdddc5680ee642d
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Thu Aug 29 15:37:25.452 2024
MODIFIED:
Sun Sep 26 14:03:19.000 2021
ACCESSED:
Tue May 14 16:18:04.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 34

Aug 30 08:32:12 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.8p1\regress\rsa_openssh.prv
EXT:
.prv
TYPE:
Certificate PEM
SIZE:
883
MD5:
a6b110f820948e73bbde7b948744b3c5
SHA1:
614e6d353be614ded246a12ed6e14af20f063710
SHA256:
79b8783d0b10a3f65b9b3e349a1daa692cc27be08028131ff5a9a08799035f46
FIRSTBYTES:
2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA
CREATED:
Thu Aug 29 15:37:25.532 2024
MODIFIED:
Sun Sep 26 14:03:19.000 2021
ACCESSED:
Tue May 14 16:24:55.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x43\x57\x67\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x73\x69\x6c\x77\x4b\x63\x61\x4b\x4e\x36\x77\x53\x4d\x4e\x64\x31\x57\x67\x51\x39\x2b\x48\x52\x71\x51\x45\x6b\x44\x30\x6b\x43\x54\x56\x74\x74\x72\x61\x7a"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 35

Aug 30 08:32:13 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.8p1\regress\misc\fuzz-harness\testdata\id_dsa
EXT:
TYPE:
Certificate PEM
SIZE:
1361
MD5:
a9521c2825fbf778b6b82b1dcda95d72
SHA1:
29bc6d9b491473450487aad65a659675154b8fb8
SHA256:
a6fa247970fe3fe15b9647e9ae301495d10ea278dbe9516abdf70e69b1849744
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Thu Aug 29 15:37:25.506 2024
MODIFIED:
Sun Sep 26 14:03:19.000 2021
ACCESSED:
Tue May 14 16:21:47.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x42\x73\x67\x41\x41\x41\x41\x64\x7a\x63\x32\x67\x74\x5a\x48\x0a\x4e\x7a\x41\x41\x41\x41\x67\x51\x43\x73"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 36

Aug 30 08:32:13 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.8p1\regress\misc\fuzz-harness\testdata\id_ecdsa
EXT:
TYPE:
Certificate PEM
SIZE:
492
MD5:
b14d14c4a2eb3a89c43be1d828fe2604
SHA1:
56c94a39972cc4c2ab982f6b206702cf3b558bde
SHA256:
00120fd3e06a2c9a2debabe94c75cb9a8fb313d17b3a114dda6264874ae56c60
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Thu Aug 29 15:37:25.508 2024
MODIFIED:
Sun Sep 26 14:03:19.000 2021
ACCESSED:
Tue May 14 16:22:01.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x61\x41\x41\x41\x41\x42\x4e\x6c\x59\x32\x52\x7a\x59\x53\x0a\x31\x7a\x61\x47\x45\x79\x4c\x57\x35\x70"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 37

Aug 30 08:32:13 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.8p1\regress\misc\fuzz-harness\testdata\id_ecdsa_sk
EXT:
TYPE:
Certificate PEM
SIZE:
858
MD5:
c87bc24fa8b257e7af7374511f44d2c5
SHA1:
2c1d6e64ad0052837b53739841f6acfc60a191ed
SHA256:
50e6649901ffdf7bc4d85dd0f45937b9d99bdd85e472c112f8586bd3e35beb58
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Thu Aug 29 15:37:25.512 2024
MODIFIED:
Sun Sep 26 14:03:19.000 2021
ACCESSED:
Tue May 14 16:22:14.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x66\x77\x41\x41\x41\x43\x4a\x7a\x61\x79\x31\x6c\x59\x32\x0a\x52\x7a\x59\x53\x31\x7a\x61\x47\x45\x79"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 38

Aug 30 08:32:13 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.8p1\regress\misc\fuzz-harness\testdata\id_ed25519
EXT:
TYPE:
Certificate PEM
SIZE:
387
MD5:
904e0a369a7fbe86bcb4e0bc1363c539
SHA1:
1074da4383390925d414ad562a0818a88e116208
SHA256:
6efecdbb70364afc9cf004e325a9a1d2673d86e85a6238e1126d6d105cea56c1
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Thu Aug 29 15:37:25.513 2024
MODIFIED:
Sun Sep 26 14:03:19.000 2021
ACCESSED:
Tue May 14 16:22:27.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 39

Aug 30 08:32:13 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.8p1\regress\misc\fuzz-harness\testdata\id_ed25519_sk
EXT:
TYPE:
Certificate PEM
SIZE:
496
MD5:
c3c7cad31e9edf76f806848501011568
SHA1:
f936a6c0f3b1250ef7fd0cbf4ea5a5d3c9c63507
SHA256:
5fd315701b14a13467331e1d0819a8016abdf5888ab695f068fce488bd37169d
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Thu Aug 29 15:37:25.515 2024
MODIFIED:
Sun Sep 26 14:03:19.000 2021
ACCESSED:
Tue May 14 16:22:39.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x53\x67\x41\x41\x41\x42\x70\x7a\x61\x79\x31\x7a\x63\x32\x0a\x67\x74\x5a\x57\x51\x79\x4e\x54\x55\x78"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 40

Aug 30 08:32:13 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.8p1\regress\misc\fuzz-harness\testdata\id_rsa
EXT:
TYPE:
Certificate PEM
SIZE:
1799
MD5:
0e4d9d0e310d6dc6a5c2d33660f70542
SHA1:
7bef427ad9067a465009d543787063fdaceef3e5
SHA256:
83822e39fb2ee059431a45c3c48cffcda3fb869273a364a45898ce9abad09e84
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Thu Aug 29 15:37:25.517 2024
MODIFIED:
Sun Sep 26 14:03:19.000 2021
ACCESSED:
Tue May 14 16:22:52.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x42\x46\x77\x41\x41\x41\x41\x64\x7a\x63\x32\x67\x74\x63\x6e\x0a\x4e\x68\x41\x41\x41\x41\x41\x77\x45\x41"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 41

Aug 30 08:32:13 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.8p1\regress\unittests\sshkey\testdata\dsa_1
EXT:
TYPE:
Certificate PEM
SIZE:
672
MD5:
aebcad00ac7fb84f1a7de01322c99be3
SHA1:
a9a0e1cf84bee8c27802295819b399833e5d4d08
SHA256:
b7f7c2bb695b28e585951a2da4ad2d6c933c440afe118798c6e2363e17da2b93
FIRSTBYTES:
2d2d2d2d2d424547494e20445341205052495641 / -----BEGIN DSA PRIVA
CREATED:
Thu Aug 29 15:37:25.698 2024
MODIFIED:
Sun Sep 26 14:03:19.000 2021
ACCESSED:
Tue May 14 16:19:01.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x44\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x42\x76\x41\x49\x42\x41\x41\x4b\x42\x67\x51" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x44\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x42\x76\x41\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x36\x6b\x75\x74\x4e\x46\x52\x73\x48\x54\x77\x45\x41\x76\x36\x64\x33\x39\x4c\x68\x73\x71\x79\x31\x61\x70\x64\x48\x42\x5a\x39\x63\x32\x48\x66\x79\x52\x72\x37\x57\x6d\x79\x70\x79\x47\x49\x79\x32\x6d"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 42

Aug 30 08:32:14 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.8p1\regress\unittests\sshkey\testdata\dsa_n
EXT:
TYPE:
Certificate PEM
SIZE:
1361
MD5:
6fcf088f9850b2f2213186cee4dc4811
SHA1:
a04d604886c6a7c2217df9b7eea5c998da91d561
SHA256:
db691de6aa454ec8aa45c84c58022a54611427f6f44c20d152ac05e0ea2284ba
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Thu Aug 29 15:37:25.708 2024
MODIFIED:
Sun Sep 26 14:03:19.000 2021
ACCESSED:
Tue May 14 16:20:07.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x42\x73\x77\x41\x41\x41\x41\x64\x7a\x63\x32\x67\x74\x5a\x48\x0a\x4e\x7a\x41\x41\x41\x41\x67\x51\x44\x36"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 43

Aug 30 08:32:14 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.8p1\regress\unittests\sshkey\testdata\ecdsa_1
EXT:
TYPE:
Certificate PEM
SIZE:
227
MD5:
610b43e1fd8e09f2794aba398c6950eb
SHA1:
c7e5b5ff84b30ff8880e4d75942a600d012516b6
SHA256:
42a90746ef5975c6ef98c6d56305dad0bc698a1b05c83518bc90584c83935d5c
FIRSTBYTES:
2d2d2d2d2d424547494e20454320505249564154 / -----BEGIN EC PRIVAT
CREATED:
Thu Aug 29 15:37:25.709 2024
MODIFIED:
Sun Sep 26 14:03:19.000 2021
ACCESSED:
Tue May 14 16:20:17.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x48\x63\x43\x41\x51\x45\x45\x49\x50\x50\x4e\x79\x55\x41\x6e\x6a\x76\x46\x72\x2b\x65\x54\x2f\x37\x74\x2f\x49\x79\x6a\x75\x51\x51\x64\x2f\x61\x4c\x46\x69\x54\x59\x39\x32\x4c\x42\x39\x67\x49\x6a\x79\x72"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 44

Aug 30 08:32:14 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.8p1\regress\unittests\sshkey\testdata\ecdsa_2
EXT:
TYPE:
Certificate PEM
SIZE:
365
MD5:
0346ad9a21f23d98cb3abe4845df078d
SHA1:
07091af93e22c676e03e6f96e9d0e53c9b53d775
SHA256:
320396e36bd5ecc12089f26849f8e7b6e0ab3c037f0492dee978cef6646d5826
FIRSTBYTES:
2d2d2d2d2d424547494e20454320505249564154 / -----BEGIN EC PRIVAT
CREATED:
Thu Aug 29 15:37:25.713 2024
MODIFIED:
Sun Sep 26 14:03:19.000 2021
ACCESSED:
Tue May 14 16:21:01.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x48\x63\x41\x67\x45\x42\x42\x45\x49\x42\x71\x42\x74\x4e\x37\x65\x36\x45\x73\x73\x64\x33\x64\x6c\x73\x67\x49\x53\x56\x69\x50\x43\x58\x58\x43\x30\x61\x74\x6c\x4e\x6b\x47\x74\x6f\x4d\x67\x53\x51\x64"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 45

Aug 30 08:32:14 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.8p1\regress\unittests\sshkey\testdata\ecdsa_n
EXT:
TYPE:
Certificate PEM
SIZE:
492
MD5:
0ffc5b7197ecb4b69f503d4f3cc24c8c
SHA1:
c2c7fd9527d9cc84781346a3ac8e2100d4d20ad3
SHA256:
1cccaa23aca49238099494fc7b49b550311719c9ac6bb138797e1077f4d7973d
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Thu Aug 29 15:37:25.720 2024
MODIFIED:
Sun Sep 26 14:03:19.000 2021
ACCESSED:
Tue May 14 16:21:32.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x61\x41\x41\x41\x41\x42\x4e\x6c\x59\x32\x52\x7a\x59\x53\x0a\x31\x7a\x61\x47\x45\x79\x4c\x57\x35\x70"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 46

Aug 30 08:32:14 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.8p1\regress\unittests\sshkey\testdata\ecdsa_sk1
EXT:
TYPE:
Certificate PEM
SIZE:
849
MD5:
97206cfa158fdda5a45c6eb542f739c0
SHA1:
e55ec614db8cea92d7269d5f903cf72baca36454
SHA256:
e4df7ea4ca133a7457069be073203c556166c65635ed6fb6c12b9a84f027346e
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Thu Aug 29 15:37:25.721 2024
MODIFIED:
Sun Sep 26 14:03:19.000 2021
ACCESSED:
Tue May 14 16:21:40.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x66\x77\x41\x41\x41\x43\x4a\x7a\x61\x79\x31\x6c\x59\x32\x0a\x52\x7a\x59\x53\x31\x7a\x61\x47\x45\x79"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 47

Aug 30 08:32:14 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.8p1\regress\unittests\sshkey\testdata\ecdsa_sk2
EXT:
TYPE:
Certificate PEM
SIZE:
849
MD5:
14ecb7595ee296b15d413ae395454a4c
SHA1:
909379299593aeebc79f44df0ec22578123acce7
SHA256:
de6f60d862f799ca088bd4611865e24bb0635d81097bb9496f0178aefa4acbae
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Thu Aug 29 15:37:25.725 2024
MODIFIED:
Sun Sep 26 14:03:19.000 2021
ACCESSED:
Tue May 14 16:22:10.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x66\x77\x41\x41\x41\x43\x4a\x7a\x61\x79\x31\x6c\x59\x32\x0a\x52\x7a\x59\x53\x31\x7a\x61\x47\x45\x79"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 48

Aug 30 08:32:14 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.8p1\regress\unittests\sshkey\testdata\ed25519_1
EXT:
TYPE:
Certificate PEM
SIZE:
411
MD5:
514e8e39c48edb2b8934ef78a5030042
SHA1:
a7a368a6f3d09bc2cfc1315f6e0899bde0574ffd
SHA256:
74f95c1990e3512af471cf6fb58d08a8078bbab597e7ee86a7ccd233f6855fd1
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Thu Aug 29 15:37:25.727 2024
MODIFIED:
Sun Sep 26 14:03:19.000 2021
ACCESSED:
Tue May 14 16:22:27.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 49

Aug 30 08:32:14 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.8p1\regress\unittests\sshkey\testdata\ed25519_2
EXT:
TYPE:
Certificate PEM
SIZE:
411
MD5:
bfc2ac8495dbc6070241303ec50a6dc2
SHA1:
53e388e7c836c6ba874e852d71a6e1e708611d25
SHA256:
31689f4706b3bdad29ee21b05af62e9f2257399d07092089944514ed5edb131d
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Thu Aug 29 15:37:25.732 2024
MODIFIED:
Sun Sep 26 14:03:19.000 2021
ACCESSED:
Tue May 14 16:22:58.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 50

Aug 30 08:32:14 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.8p1\regress\unittests\sshkey\testdata\ed25519_sk1
EXT:
TYPE:
Certificate PEM
SIZE:
484
MD5:
ab9dcdbff00763217a3f85069a9c2f67
SHA1:
05396ad046c37370093f48c0bdb2510b8894aa76
SHA256:
45c058d08280c4ca36a9d020478504cd550e7c5752c207d182363c3edf669ce8
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Thu Aug 29 15:37:25.784 2024
MODIFIED:
Sun Sep 26 14:03:19.000 2021
ACCESSED:
Tue May 14 16:23:17.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x53\x67\x41\x41\x41\x42\x70\x7a\x61\x79\x31\x7a\x63\x32\x0a\x67\x74\x5a\x57\x51\x79\x4e\x54\x55\x78"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 51

Aug 30 08:32:14 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.8p1\regress\unittests\sshkey\testdata\ed25519_sk2
EXT:
TYPE:
Certificate PEM
SIZE:
484
MD5:
8a666562de41f71d57d47c5f6404293a
SHA1:
069c9341d4b0cd94669ff23feab92853b6a42540
SHA256:
b862e169114ee63ae5e8497110075a9e67c4e3f24bad01e7c06951d268a3ec0f
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Thu Aug 29 15:37:25.790 2024
MODIFIED:
Sun Sep 26 14:03:19.000 2021
ACCESSED:
Tue May 14 16:23:49.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x53\x67\x41\x41\x41\x42\x70\x7a\x61\x79\x31\x7a\x63\x32\x0a\x67\x74\x5a\x57\x51\x79\x4e\x54\x55\x78"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 52

Aug 30 08:32:14 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.8p1\regress\unittests\sshkey\testdata\rsa_1
EXT:
TYPE:
Certificate PEM
SIZE:
887
MD5:
197f14927e89c5c573213416bde709cb
SHA1:
2f5cfafbddd00c351ce72e2f140458fb5ac7b60a
SHA256:
07586a53bef4dd9daf59c473399fca5fcb39891bed0d2c2f8a88249e02392ac5
FIRSTBYTES:
2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA
CREATED:
Thu Aug 29 15:37:25.794 2024
MODIFIED:
Sun Sep 26 14:03:19.000 2021
ACCESSED:
Tue May 14 16:24:15.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x43\x58\x41\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x4c\x56\x35\x6c\x55\x54\x74\x37\x46\x72\x41\x44\x73\x65\x42\x2f\x43\x47\x68\x45\x5a\x7a\x70\x6f\x6f\x6a\x6a\x45\x57\x35\x79\x38\x2b\x65\x50\x76\x4c\x70"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 53

Aug 30 08:32:14 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.8p1\regress\unittests\sshkey\testdata\rsa_1_sha1
EXT:
TYPE:
Certificate PEM
SIZE:
887
MD5:
197f14927e89c5c573213416bde709cb
SHA1:
2f5cfafbddd00c351ce72e2f140458fb5ac7b60a
SHA256:
07586a53bef4dd9daf59c473399fca5fcb39891bed0d2c2f8a88249e02392ac5
FIRSTBYTES:
2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA
CREATED:
Thu Aug 29 15:37:25.801 2024
MODIFIED:
Sun Sep 26 14:03:19.000 2021
ACCESSED:
Tue May 14 16:25:04.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x43\x58\x41\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x4c\x56\x35\x6c\x55\x54\x74\x37\x46\x72\x41\x44\x73\x65\x42\x2f\x43\x47\x68\x45\x5a\x7a\x70\x6f\x6f\x6a\x6a\x45\x57\x35\x79\x38\x2b\x65\x50\x76\x4c\x70"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 54

Aug 30 08:32:14 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.8p1\regress\unittests\sshkey\testdata\rsa_1_sha512
EXT:
TYPE:
Certificate PEM
SIZE:
887
MD5:
197f14927e89c5c573213416bde709cb
SHA1:
2f5cfafbddd00c351ce72e2f140458fb5ac7b60a
SHA256:
07586a53bef4dd9daf59c473399fca5fcb39891bed0d2c2f8a88249e02392ac5
FIRSTBYTES:
2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA
CREATED:
Thu Aug 29 15:37:25.803 2024
MODIFIED:
Sun Sep 26 14:03:19.000 2021
ACCESSED:
Tue May 14 16:25:17.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x43\x58\x41\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x4c\x56\x35\x6c\x55\x54\x74\x37\x46\x72\x41\x44\x73\x65\x42\x2f\x43\x47\x68\x45\x5a\x7a\x70\x6f\x6f\x6a\x6a\x45\x57\x35\x79\x38\x2b\x65\x50\x76\x4c\x70"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 55

Aug 30 08:32:14 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.8p1\regress\unittests\sshkey\testdata\rsa_2
EXT:
TYPE:
Certificate PEM
SIZE:
1679
MD5:
c8860a2d208d222eade1e9866449ccbc
SHA1:
64133ddc79d593e467c864c429e3793c69e4dc22
SHA256:
e42925e663a7215e19cdc89bd9fe018903eeb013f131b188d3c87f0ef01c5a24
FIRSTBYTES:
2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA
CREATED:
Thu Aug 29 15:37:25.806 2024
MODIFIED:
Sun Sep 26 14:03:19.000 2021
ACCESSED:
Tue May 14 16:25:31.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x45\x70\x41\x49\x42\x41\x41\x4b\x43\x41\x51\x45\x41\x39\x4e\x45\x55\x58\x70\x37\x38\x53\x41\x6b\x6d\x4c\x34\x2b\x65\x41\x6a\x34\x6d\x42\x7a\x50\x4f\x6a\x6b\x2b\x63\x63\x43\x50\x56\x7a\x6b\x54\x52\x2b"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 56

Aug 30 08:32:14 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.8p1\regress\unittests\sshkey\testdata\rsa_n
EXT:
TYPE:
Certificate PEM
SIZE:
1020
MD5:
d60f55c106077131ba136f02e9b9ba88
SHA1:
d6a3a8961cb40e8a4ff03dbfd5983c9fc5dfeb39
SHA256:
0ad47d17d5f21f350c26c4c94564bf41b6fd28ab55187166b4f46b1b35daed6d
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Thu Aug 29 15:37:25.810 2024
MODIFIED:
Sun Sep 26 14:03:19.000 2021
ACCESSED:
Tue May 14 16:09:21.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x6c\x77\x41\x41\x41\x41\x64\x7a\x63\x32\x67\x74\x63\x6e\x0a\x4e\x68\x41\x41\x41\x41\x41\x77\x45\x41"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 57

Aug 30 08:32:14 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.8p1\regress\unittests\sshsig\testdata\ecdsa
EXT:
TYPE:
Certificate PEM
SIZE:
227
MD5:
53f2aa69e4e8d05ea1c0848c4a946b71
SHA1:
69a4f47fbbb55eb5dea9adea057509384a32bb69
SHA256:
585957bd0a19fcff2d22cd8af7ffb13b68cc30c9dc13dfefb57271b03f3a999f
FIRSTBYTES:
2d2d2d2d2d424547494e20454320505249564154 / -----BEGIN EC PRIVAT
CREATED:
Thu Aug 29 15:37:25.868 2024
MODIFIED:
Sun Sep 26 14:03:19.000 2021
ACCESSED:
Tue May 14 16:10:02.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x48\x63\x43\x41\x51\x45\x45\x49\x46\x67\x30\x5a\x43\x53\x45\x42\x35\x4c\x4e\x65\x4c\x73\x58\x59\x4c\x32\x35\x67\x33\x6b\x71\x45\x57\x73\x71\x68\x35\x32\x44\x52\x2b\x79\x4e\x4f\x6a\x79\x51\x4a\x71\x79"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 58

Aug 30 08:32:14 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.8p1\regress\unittests\sshsig\testdata\ecdsa_sk
EXT:
TYPE:
Certificate PEM
SIZE:
837
MD5:
36948c6f96600caa24052b4d8322cbd9
SHA1:
b7bf9e701f8da5d50f61064849d052e04fb77c3f
SHA256:
f81b969ccd3e85f02b71465ba38fb51b5adf6f11b09f2e9e82ed6b2ab31f2356
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Thu Aug 29 15:37:25.871 2024
MODIFIED:
Sun Sep 26 14:03:19.000 2021
ACCESSED:
Tue May 14 16:10:18.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x66\x77\x41\x41\x41\x43\x4a\x7a\x61\x79\x31\x6c\x59\x32\x0a\x52\x7a\x59\x53\x31\x7a\x61\x47\x45\x79"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 59

Aug 30 08:32:14 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.8p1\regress\unittests\sshsig\testdata\ed25519
EXT:
TYPE:
Certificate PEM
SIZE:
411
MD5:
8bb197113a031c8f6d76de369316d0eb
SHA1:
40847760b4f753f2b17156d3f6f9cdcc7c0b91d4
SHA256:
c4683c666d6394fc5e8f3455b5379304979e0b41502560ddef20c824fa9fb66b
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Thu Aug 29 15:37:25.875 2024
MODIFIED:
Sun Sep 26 14:03:19.000 2021
ACCESSED:
Tue May 14 16:10:40.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 60

Aug 30 08:32:14 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.8p1\regress\unittests\sshsig\testdata\ed25519_sk
EXT:
TYPE:
Certificate PEM
SIZE:
484
MD5:
85bc2e18e08c06aa85cf023e7a97a585
SHA1:
95ea85c4709baf47e7cc2573ceac480cc35bde67
SHA256:
0e2221a7c8e8cea4fb6e9d2666b1d05166a3b0f5876c54433f0c35b564f22025
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Thu Aug 29 15:37:25.877 2024
MODIFIED:
Sun Sep 26 14:03:19.000 2021
ACCESSED:
Tue May 14 16:10:52.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x53\x67\x41\x41\x41\x42\x70\x7a\x61\x79\x31\x7a\x63\x32\x0a\x67\x74\x5a\x57\x51\x79\x4e\x54\x55\x78"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 61

Aug 30 08:32:14 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\BUILD\openssh-8.8p1\regress\unittests\sshsig\testdata\rsa
EXT:
TYPE:
Certificate PEM
SIZE:
2455
MD5:
efe804ccdc63abc29233f3a1e11e173b
SHA1:
481c1773197aabc2d9d87336ad84f44410251ed4
SHA256:
d7eb37f534b846bb582bcdcf78232bdb33932e34fb72d6bfa130a8fd699b10b6
FIRSTBYTES:
2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA
CREATED:
Thu Aug 29 15:37:25.880 2024
MODIFIED:
Sun Sep 26 14:03:19.000 2021
ACCESSED:
Tue May 14 16:11:09.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x47\x34\x77\x49\x42\x41\x41\x4b\x43\x41\x59\x45\x41\x33\x38\x36\x6c\x6d\x6a\x52\x48\x74\x4a\x70\x79\x6a\x38\x37\x42\x72\x53\x2b\x73\x73\x4d\x6d\x74\x76\x63\x2f\x31\x53\x50\x4e\x30\x67\x58\x54\x50\x73"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 62

Aug 30 08:32:16 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\misc\fuzz-harness\testdata\id_dsa
EXT:
TYPE:
Certificate PEM
SIZE:
1361
MD5:
a9521c2825fbf778b6b82b1dcda95d72
SHA1:
29bc6d9b491473450487aad65a659675154b8fb8
SHA256:
a6fa247970fe3fe15b9647e9ae301495d10ea278dbe9516abdf70e69b1849744
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Tue Mar 2 10:31:47.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1779733
ARCHIVE_MD5:
9eb9420cf587edc26f8998ab679ad390
ARCHIVE_SHA1:
72eadcbe313b07b1dd3b693e41d3cd56d354e24e
ARCHIVE_SHA256:
f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbde976db48962e5a7f / vH.Z
ARCHIVE_CREATED:
Thu Aug 29 15:37:22.848 2024
ARCHIVE_MODIFIED:
Tue Oct 19 13:53:34.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:13:50.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x42\x73\x67\x41\x41\x41\x41\x64\x7a\x63\x32\x67\x74\x5a\x48\x0a\x4e\x7a\x41\x41\x41\x41\x67\x51\x43\x73"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 63

Aug 30 08:32:16 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\misc\fuzz-harness\testdata\id_ecdsa
EXT:
TYPE:
Certificate PEM
SIZE:
492
MD5:
b14d14c4a2eb3a89c43be1d828fe2604
SHA1:
56c94a39972cc4c2ab982f6b206702cf3b558bde
SHA256:
00120fd3e06a2c9a2debabe94c75cb9a8fb313d17b3a114dda6264874ae56c60
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Tue Mar 2 10:31:47.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1779733
ARCHIVE_MD5:
9eb9420cf587edc26f8998ab679ad390
ARCHIVE_SHA1:
72eadcbe313b07b1dd3b693e41d3cd56d354e24e
ARCHIVE_SHA256:
f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbde976db48962e5a7f / vH.Z
ARCHIVE_CREATED:
Thu Aug 29 15:37:22.848 2024
ARCHIVE_MODIFIED:
Tue Oct 19 13:53:34.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:13:50.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x61\x41\x41\x41\x41\x42\x4e\x6c\x59\x32\x52\x7a\x59\x53\x0a\x31\x7a\x61\x47\x45\x79\x4c\x57\x35\x70"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 64

Aug 30 08:32:16 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\misc\fuzz-harness\testdata\id_ecdsa_sk
EXT:
TYPE:
Certificate PEM
SIZE:
858
MD5:
c87bc24fa8b257e7af7374511f44d2c5
SHA1:
2c1d6e64ad0052837b53739841f6acfc60a191ed
SHA256:
50e6649901ffdf7bc4d85dd0f45937b9d99bdd85e472c112f8586bd3e35beb58
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Tue Mar 2 10:31:47.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1779733
ARCHIVE_MD5:
9eb9420cf587edc26f8998ab679ad390
ARCHIVE_SHA1:
72eadcbe313b07b1dd3b693e41d3cd56d354e24e
ARCHIVE_SHA256:
f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbde976db48962e5a7f / vH.Z
ARCHIVE_CREATED:
Thu Aug 29 15:37:22.848 2024
ARCHIVE_MODIFIED:
Tue Oct 19 13:53:34.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:13:50.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x66\x77\x41\x41\x41\x43\x4a\x7a\x61\x79\x31\x6c\x59\x32\x0a\x52\x7a\x59\x53\x31\x7a\x61\x47\x45\x79"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 65

Aug 30 08:32:16 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\misc\fuzz-harness\testdata\id_ed25519
EXT:
TYPE:
Certificate PEM
SIZE:
387
MD5:
904e0a369a7fbe86bcb4e0bc1363c539
SHA1:
1074da4383390925d414ad562a0818a88e116208
SHA256:
6efecdbb70364afc9cf004e325a9a1d2673d86e85a6238e1126d6d105cea56c1
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Tue Mar 2 10:31:47.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1779733
ARCHIVE_MD5:
9eb9420cf587edc26f8998ab679ad390
ARCHIVE_SHA1:
72eadcbe313b07b1dd3b693e41d3cd56d354e24e
ARCHIVE_SHA256:
f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbde976db48962e5a7f / vH.Z
ARCHIVE_CREATED:
Thu Aug 29 15:37:22.848 2024
ARCHIVE_MODIFIED:
Tue Oct 19 13:53:34.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:13:50.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 66

Aug 30 08:32:16 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\misc\fuzz-harness\testdata\id_ed25519_sk
EXT:
TYPE:
Certificate PEM
SIZE:
496
MD5:
c3c7cad31e9edf76f806848501011568
SHA1:
f936a6c0f3b1250ef7fd0cbf4ea5a5d3c9c63507
SHA256:
5fd315701b14a13467331e1d0819a8016abdf5888ab695f068fce488bd37169d
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Tue Mar 2 10:31:47.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1779733
ARCHIVE_MD5:
9eb9420cf587edc26f8998ab679ad390
ARCHIVE_SHA1:
72eadcbe313b07b1dd3b693e41d3cd56d354e24e
ARCHIVE_SHA256:
f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbde976db48962e5a7f / vH.Z
ARCHIVE_CREATED:
Thu Aug 29 15:37:22.848 2024
ARCHIVE_MODIFIED:
Tue Oct 19 13:53:34.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:13:50.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x53\x67\x41\x41\x41\x42\x70\x7a\x61\x79\x31\x7a\x63\x32\x0a\x67\x74\x5a\x57\x51\x79\x4e\x54\x55\x78"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 67

Aug 30 08:32:16 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\misc\fuzz-harness\testdata\id_rsa
EXT:
TYPE:
Certificate PEM
SIZE:
1799
MD5:
0e4d9d0e310d6dc6a5c2d33660f70542
SHA1:
7bef427ad9067a465009d543787063fdaceef3e5
SHA256:
83822e39fb2ee059431a45c3c48cffcda3fb869273a364a45898ce9abad09e84
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Tue Mar 2 10:31:47.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1779733
ARCHIVE_MD5:
9eb9420cf587edc26f8998ab679ad390
ARCHIVE_SHA1:
72eadcbe313b07b1dd3b693e41d3cd56d354e24e
ARCHIVE_SHA256:
f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbde976db48962e5a7f / vH.Z
ARCHIVE_CREATED:
Thu Aug 29 15:37:22.848 2024
ARCHIVE_MODIFIED:
Tue Oct 19 13:53:34.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:13:50.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x42\x46\x77\x41\x41\x41\x41\x64\x7a\x63\x32\x67\x74\x63\x6e\x0a\x4e\x68\x41\x41\x41\x41\x41\x77\x45\x41"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 68

Aug 30 08:32:16 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\rsa_openssh.prv
EXT:
.prv
TYPE:
Certificate PEM
SIZE:
883
MD5:
a6b110f820948e73bbde7b948744b3c5
SHA1:
614e6d353be614ded246a12ed6e14af20f063710
SHA256:
79b8783d0b10a3f65b9b3e349a1daa692cc27be08028131ff5a9a08799035f46
FIRSTBYTES:
2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA
MODIFIED:
Tue Mar 2 10:31:47.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1779733
ARCHIVE_MD5:
9eb9420cf587edc26f8998ab679ad390
ARCHIVE_SHA1:
72eadcbe313b07b1dd3b693e41d3cd56d354e24e
ARCHIVE_SHA256:
f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbde976db48962e5a7f / vH.Z
ARCHIVE_CREATED:
Thu Aug 29 15:37:22.848 2024
ARCHIVE_MODIFIED:
Tue Oct 19 13:53:34.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:13:50.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x43\x57\x67\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x73\x69\x6c\x77\x4b\x63\x61\x4b\x4e\x36\x77\x53\x4d\x4e\x64\x31\x57\x67\x51\x39\x2b\x48\x52\x71\x51\x45\x6b\x44\x30\x6b\x43\x54\x56\x74\x74\x72\x61\x7a"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 69

Aug 30 08:32:16 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshkey\testdata\dsa_1
EXT:
TYPE:
Certificate PEM
SIZE:
672
MD5:
aebcad00ac7fb84f1a7de01322c99be3
SHA1:
a9a0e1cf84bee8c27802295819b399833e5d4d08
SHA256:
b7f7c2bb695b28e585951a2da4ad2d6c933c440afe118798c6e2363e17da2b93
FIRSTBYTES:
2d2d2d2d2d424547494e20445341205052495641 / -----BEGIN DSA PRIVA
MODIFIED:
Tue Mar 2 10:31:47.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1779733
ARCHIVE_MD5:
9eb9420cf587edc26f8998ab679ad390
ARCHIVE_SHA1:
72eadcbe313b07b1dd3b693e41d3cd56d354e24e
ARCHIVE_SHA256:
f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbde976db48962e5a7f / vH.Z
ARCHIVE_CREATED:
Thu Aug 29 15:37:22.848 2024
ARCHIVE_MODIFIED:
Tue Oct 19 13:53:34.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:13:50.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x44\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x42\x76\x41\x49\x42\x41\x41\x4b\x42\x67\x51" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x44\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x42\x76\x41\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x36\x6b\x75\x74\x4e\x46\x52\x73\x48\x54\x77\x45\x41\x76\x36\x64\x33\x39\x4c\x68\x73\x71\x79\x31\x61\x70\x64\x48\x42\x5a\x39\x63\x32\x48\x66\x79\x52\x72\x37\x57\x6d\x79\x70\x79\x47\x49\x79\x32\x6d"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 70

Aug 30 08:32:16 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshkey\testdata\dsa_n
EXT:
TYPE:
Certificate PEM
SIZE:
1361
MD5:
6fcf088f9850b2f2213186cee4dc4811
SHA1:
a04d604886c6a7c2217df9b7eea5c998da91d561
SHA256:
db691de6aa454ec8aa45c84c58022a54611427f6f44c20d152ac05e0ea2284ba
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Tue Mar 2 10:31:47.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1779733
ARCHIVE_MD5:
9eb9420cf587edc26f8998ab679ad390
ARCHIVE_SHA1:
72eadcbe313b07b1dd3b693e41d3cd56d354e24e
ARCHIVE_SHA256:
f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbde976db48962e5a7f / vH.Z
ARCHIVE_CREATED:
Thu Aug 29 15:37:22.848 2024
ARCHIVE_MODIFIED:
Tue Oct 19 13:53:34.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:13:50.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x42\x73\x77\x41\x41\x41\x41\x64\x7a\x63\x32\x67\x74\x5a\x48\x0a\x4e\x7a\x41\x41\x41\x41\x67\x51\x44\x36"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 71

Aug 30 08:32:16 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshkey\testdata\ecdsa_1
EXT:
TYPE:
Certificate PEM
SIZE:
227
MD5:
610b43e1fd8e09f2794aba398c6950eb
SHA1:
c7e5b5ff84b30ff8880e4d75942a600d012516b6
SHA256:
42a90746ef5975c6ef98c6d56305dad0bc698a1b05c83518bc90584c83935d5c
FIRSTBYTES:
2d2d2d2d2d424547494e20454320505249564154 / -----BEGIN EC PRIVAT
MODIFIED:
Tue Mar 2 10:31:47.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1779733
ARCHIVE_MD5:
9eb9420cf587edc26f8998ab679ad390
ARCHIVE_SHA1:
72eadcbe313b07b1dd3b693e41d3cd56d354e24e
ARCHIVE_SHA256:
f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbde976db48962e5a7f / vH.Z
ARCHIVE_CREATED:
Thu Aug 29 15:37:22.848 2024
ARCHIVE_MODIFIED:
Tue Oct 19 13:53:34.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:13:50.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x48\x63\x43\x41\x51\x45\x45\x49\x50\x50\x4e\x79\x55\x41\x6e\x6a\x76\x46\x72\x2b\x65\x54\x2f\x37\x74\x2f\x49\x79\x6a\x75\x51\x51\x64\x2f\x61\x4c\x46\x69\x54\x59\x39\x32\x4c\x42\x39\x67\x49\x6a\x79\x72"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 72

Aug 30 08:32:16 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshkey\testdata\ecdsa_2
EXT:
TYPE:
Certificate PEM
SIZE:
365
MD5:
0346ad9a21f23d98cb3abe4845df078d
SHA1:
07091af93e22c676e03e6f96e9d0e53c9b53d775
SHA256:
320396e36bd5ecc12089f26849f8e7b6e0ab3c037f0492dee978cef6646d5826
FIRSTBYTES:
2d2d2d2d2d424547494e20454320505249564154 / -----BEGIN EC PRIVAT
MODIFIED:
Tue Mar 2 10:31:47.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1779733
ARCHIVE_MD5:
9eb9420cf587edc26f8998ab679ad390
ARCHIVE_SHA1:
72eadcbe313b07b1dd3b693e41d3cd56d354e24e
ARCHIVE_SHA256:
f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbde976db48962e5a7f / vH.Z
ARCHIVE_CREATED:
Thu Aug 29 15:37:22.848 2024
ARCHIVE_MODIFIED:
Tue Oct 19 13:53:34.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:13:50.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x48\x63\x41\x67\x45\x42\x42\x45\x49\x42\x71\x42\x74\x4e\x37\x65\x36\x45\x73\x73\x64\x33\x64\x6c\x73\x67\x49\x53\x56\x69\x50\x43\x58\x58\x43\x30\x61\x74\x6c\x4e\x6b\x47\x74\x6f\x4d\x67\x53\x51\x64"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 73

Aug 30 08:32:16 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshkey\testdata\ecdsa_n
EXT:
TYPE:
Certificate PEM
SIZE:
492
MD5:
0ffc5b7197ecb4b69f503d4f3cc24c8c
SHA1:
c2c7fd9527d9cc84781346a3ac8e2100d4d20ad3
SHA256:
1cccaa23aca49238099494fc7b49b550311719c9ac6bb138797e1077f4d7973d
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Tue Mar 2 10:31:47.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1779733
ARCHIVE_MD5:
9eb9420cf587edc26f8998ab679ad390
ARCHIVE_SHA1:
72eadcbe313b07b1dd3b693e41d3cd56d354e24e
ARCHIVE_SHA256:
f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbde976db48962e5a7f / vH.Z
ARCHIVE_CREATED:
Thu Aug 29 15:37:22.848 2024
ARCHIVE_MODIFIED:
Tue Oct 19 13:53:34.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:13:50.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x61\x41\x41\x41\x41\x42\x4e\x6c\x59\x32\x52\x7a\x59\x53\x0a\x31\x7a\x61\x47\x45\x79\x4c\x57\x35\x70"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 74

Aug 30 08:32:16 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshkey\testdata\ecdsa_sk1
EXT:
TYPE:
Certificate PEM
SIZE:
849
MD5:
97206cfa158fdda5a45c6eb542f739c0
SHA1:
e55ec614db8cea92d7269d5f903cf72baca36454
SHA256:
e4df7ea4ca133a7457069be073203c556166c65635ed6fb6c12b9a84f027346e
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Tue Mar 2 10:31:47.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1779733
ARCHIVE_MD5:
9eb9420cf587edc26f8998ab679ad390
ARCHIVE_SHA1:
72eadcbe313b07b1dd3b693e41d3cd56d354e24e
ARCHIVE_SHA256:
f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbde976db48962e5a7f / vH.Z
ARCHIVE_CREATED:
Thu Aug 29 15:37:22.848 2024
ARCHIVE_MODIFIED:
Tue Oct 19 13:53:34.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:13:50.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x66\x77\x41\x41\x41\x43\x4a\x7a\x61\x79\x31\x6c\x59\x32\x0a\x52\x7a\x59\x53\x31\x7a\x61\x47\x45\x79"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 75

Aug 30 08:32:16 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshkey\testdata\ecdsa_sk2
EXT:
TYPE:
Certificate PEM
SIZE:
849
MD5:
14ecb7595ee296b15d413ae395454a4c
SHA1:
909379299593aeebc79f44df0ec22578123acce7
SHA256:
de6f60d862f799ca088bd4611865e24bb0635d81097bb9496f0178aefa4acbae
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Tue Mar 2 10:31:47.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1779733
ARCHIVE_MD5:
9eb9420cf587edc26f8998ab679ad390
ARCHIVE_SHA1:
72eadcbe313b07b1dd3b693e41d3cd56d354e24e
ARCHIVE_SHA256:
f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbde976db48962e5a7f / vH.Z
ARCHIVE_CREATED:
Thu Aug 29 15:37:22.848 2024
ARCHIVE_MODIFIED:
Tue Oct 19 13:53:34.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:13:50.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x66\x77\x41\x41\x41\x43\x4a\x7a\x61\x79\x31\x6c\x59\x32\x0a\x52\x7a\x59\x53\x31\x7a\x61\x47\x45\x79"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 76

Aug 30 08:32:16 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshkey\testdata\ed25519_1
EXT:
TYPE:
Certificate PEM
SIZE:
411
MD5:
514e8e39c48edb2b8934ef78a5030042
SHA1:
a7a368a6f3d09bc2cfc1315f6e0899bde0574ffd
SHA256:
74f95c1990e3512af471cf6fb58d08a8078bbab597e7ee86a7ccd233f6855fd1
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Tue Mar 2 10:31:47.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1779733
ARCHIVE_MD5:
9eb9420cf587edc26f8998ab679ad390
ARCHIVE_SHA1:
72eadcbe313b07b1dd3b693e41d3cd56d354e24e
ARCHIVE_SHA256:
f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbde976db48962e5a7f / vH.Z
ARCHIVE_CREATED:
Thu Aug 29 15:37:22.848 2024
ARCHIVE_MODIFIED:
Tue Oct 19 13:53:34.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:13:50.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 77

Aug 30 08:32:16 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshkey\testdata\ed25519_2
EXT:
TYPE:
Certificate PEM
SIZE:
411
MD5:
bfc2ac8495dbc6070241303ec50a6dc2
SHA1:
53e388e7c836c6ba874e852d71a6e1e708611d25
SHA256:
31689f4706b3bdad29ee21b05af62e9f2257399d07092089944514ed5edb131d
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Tue Mar 2 10:31:47.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1779733
ARCHIVE_MD5:
9eb9420cf587edc26f8998ab679ad390
ARCHIVE_SHA1:
72eadcbe313b07b1dd3b693e41d3cd56d354e24e
ARCHIVE_SHA256:
f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbde976db48962e5a7f / vH.Z
ARCHIVE_CREATED:
Thu Aug 29 15:37:22.848 2024
ARCHIVE_MODIFIED:
Tue Oct 19 13:53:34.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:13:50.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 78

Aug 30 08:32:17 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshkey\testdata\ed25519_sk1
EXT:
TYPE:
Certificate PEM
SIZE:
484
MD5:
ab9dcdbff00763217a3f85069a9c2f67
SHA1:
05396ad046c37370093f48c0bdb2510b8894aa76
SHA256:
45c058d08280c4ca36a9d020478504cd550e7c5752c207d182363c3edf669ce8
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Tue Mar 2 10:31:47.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1779733
ARCHIVE_MD5:
9eb9420cf587edc26f8998ab679ad390
ARCHIVE_SHA1:
72eadcbe313b07b1dd3b693e41d3cd56d354e24e
ARCHIVE_SHA256:
f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbde976db48962e5a7f / vH.Z
ARCHIVE_CREATED:
Thu Aug 29 15:37:22.848 2024
ARCHIVE_MODIFIED:
Tue Oct 19 13:53:34.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:13:50.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x53\x67\x41\x41\x41\x42\x70\x7a\x61\x79\x31\x7a\x63\x32\x0a\x67\x74\x5a\x57\x51\x79\x4e\x54\x55\x78"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 79

Aug 30 08:32:17 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshkey\testdata\ed25519_sk2
EXT:
TYPE:
Certificate PEM
SIZE:
484
MD5:
8a666562de41f71d57d47c5f6404293a
SHA1:
069c9341d4b0cd94669ff23feab92853b6a42540
SHA256:
b862e169114ee63ae5e8497110075a9e67c4e3f24bad01e7c06951d268a3ec0f
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Tue Mar 2 10:31:47.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1779733
ARCHIVE_MD5:
9eb9420cf587edc26f8998ab679ad390
ARCHIVE_SHA1:
72eadcbe313b07b1dd3b693e41d3cd56d354e24e
ARCHIVE_SHA256:
f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbde976db48962e5a7f / vH.Z
ARCHIVE_CREATED:
Thu Aug 29 15:37:22.848 2024
ARCHIVE_MODIFIED:
Tue Oct 19 13:53:34.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:13:50.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x53\x67\x41\x41\x41\x42\x70\x7a\x61\x79\x31\x7a\x63\x32\x0a\x67\x74\x5a\x57\x51\x79\x4e\x54\x55\x78"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 80

Aug 30 08:32:17 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshkey\testdata\rsa_1
EXT:
TYPE:
Certificate PEM
SIZE:
887
MD5:
197f14927e89c5c573213416bde709cb
SHA1:
2f5cfafbddd00c351ce72e2f140458fb5ac7b60a
SHA256:
07586a53bef4dd9daf59c473399fca5fcb39891bed0d2c2f8a88249e02392ac5
FIRSTBYTES:
2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA
MODIFIED:
Tue Mar 2 10:31:47.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1779733
ARCHIVE_MD5:
9eb9420cf587edc26f8998ab679ad390
ARCHIVE_SHA1:
72eadcbe313b07b1dd3b693e41d3cd56d354e24e
ARCHIVE_SHA256:
f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbde976db48962e5a7f / vH.Z
ARCHIVE_CREATED:
Thu Aug 29 15:37:22.848 2024
ARCHIVE_MODIFIED:
Tue Oct 19 13:53:34.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:13:50.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x43\x58\x41\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x4c\x56\x35\x6c\x55\x54\x74\x37\x46\x72\x41\x44\x73\x65\x42\x2f\x43\x47\x68\x45\x5a\x7a\x70\x6f\x6f\x6a\x6a\x45\x57\x35\x79\x38\x2b\x65\x50\x76\x4c\x70"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 81

Aug 30 08:32:17 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshkey\testdata\rsa_1_sha1
EXT:
TYPE:
Certificate PEM
SIZE:
887
MD5:
197f14927e89c5c573213416bde709cb
SHA1:
2f5cfafbddd00c351ce72e2f140458fb5ac7b60a
SHA256:
07586a53bef4dd9daf59c473399fca5fcb39891bed0d2c2f8a88249e02392ac5
FIRSTBYTES:
2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA
MODIFIED:
Tue Mar 2 10:31:47.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1779733
ARCHIVE_MD5:
9eb9420cf587edc26f8998ab679ad390
ARCHIVE_SHA1:
72eadcbe313b07b1dd3b693e41d3cd56d354e24e
ARCHIVE_SHA256:
f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbde976db48962e5a7f / vH.Z
ARCHIVE_CREATED:
Thu Aug 29 15:37:22.848 2024
ARCHIVE_MODIFIED:
Tue Oct 19 13:53:34.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:13:50.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x43\x58\x41\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x4c\x56\x35\x6c\x55\x54\x74\x37\x46\x72\x41\x44\x73\x65\x42\x2f\x43\x47\x68\x45\x5a\x7a\x70\x6f\x6f\x6a\x6a\x45\x57\x35\x79\x38\x2b\x65\x50\x76\x4c\x70"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 82

Aug 30 08:32:17 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshkey\testdata\rsa_1_sha512
EXT:
TYPE:
Certificate PEM
SIZE:
887
MD5:
197f14927e89c5c573213416bde709cb
SHA1:
2f5cfafbddd00c351ce72e2f140458fb5ac7b60a
SHA256:
07586a53bef4dd9daf59c473399fca5fcb39891bed0d2c2f8a88249e02392ac5
FIRSTBYTES:
2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA
MODIFIED:
Tue Mar 2 10:31:47.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1779733
ARCHIVE_MD5:
9eb9420cf587edc26f8998ab679ad390
ARCHIVE_SHA1:
72eadcbe313b07b1dd3b693e41d3cd56d354e24e
ARCHIVE_SHA256:
f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbde976db48962e5a7f / vH.Z
ARCHIVE_CREATED:
Thu Aug 29 15:37:22.848 2024
ARCHIVE_MODIFIED:
Tue Oct 19 13:53:34.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:13:50.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x43\x58\x41\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x4c\x56\x35\x6c\x55\x54\x74\x37\x46\x72\x41\x44\x73\x65\x42\x2f\x43\x47\x68\x45\x5a\x7a\x70\x6f\x6f\x6a\x6a\x45\x57\x35\x79\x38\x2b\x65\x50\x76\x4c\x70"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 83

Aug 30 08:32:17 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshkey\testdata\rsa_2
EXT:
TYPE:
Certificate PEM
SIZE:
1679
MD5:
c8860a2d208d222eade1e9866449ccbc
SHA1:
64133ddc79d593e467c864c429e3793c69e4dc22
SHA256:
e42925e663a7215e19cdc89bd9fe018903eeb013f131b188d3c87f0ef01c5a24
FIRSTBYTES:
2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA
MODIFIED:
Tue Mar 2 10:31:47.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1779733
ARCHIVE_MD5:
9eb9420cf587edc26f8998ab679ad390
ARCHIVE_SHA1:
72eadcbe313b07b1dd3b693e41d3cd56d354e24e
ARCHIVE_SHA256:
f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbde976db48962e5a7f / vH.Z
ARCHIVE_CREATED:
Thu Aug 29 15:37:22.848 2024
ARCHIVE_MODIFIED:
Tue Oct 19 13:53:34.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:13:50.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x45\x70\x41\x49\x42\x41\x41\x4b\x43\x41\x51\x45\x41\x39\x4e\x45\x55\x58\x70\x37\x38\x53\x41\x6b\x6d\x4c\x34\x2b\x65\x41\x6a\x34\x6d\x42\x7a\x50\x4f\x6a\x6b\x2b\x63\x63\x43\x50\x56\x7a\x6b\x54\x52\x2b"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 84

Aug 30 08:32:17 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshkey\testdata\rsa_n
EXT:
TYPE:
Certificate PEM
SIZE:
1020
MD5:
d60f55c106077131ba136f02e9b9ba88
SHA1:
d6a3a8961cb40e8a4ff03dbfd5983c9fc5dfeb39
SHA256:
0ad47d17d5f21f350c26c4c94564bf41b6fd28ab55187166b4f46b1b35daed6d
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Tue Mar 2 10:31:47.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1779733
ARCHIVE_MD5:
9eb9420cf587edc26f8998ab679ad390
ARCHIVE_SHA1:
72eadcbe313b07b1dd3b693e41d3cd56d354e24e
ARCHIVE_SHA256:
f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbde976db48962e5a7f / vH.Z
ARCHIVE_CREATED:
Thu Aug 29 15:37:22.848 2024
ARCHIVE_MODIFIED:
Tue Oct 19 13:53:34.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:13:50.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x6c\x77\x41\x41\x41\x41\x64\x7a\x63\x32\x67\x74\x63\x6e\x0a\x4e\x68\x41\x41\x41\x41\x41\x77\x45\x41"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 85

Aug 30 08:32:17 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshsig\testdata\ecdsa
EXT:
TYPE:
Certificate PEM
SIZE:
227
MD5:
53f2aa69e4e8d05ea1c0848c4a946b71
SHA1:
69a4f47fbbb55eb5dea9adea057509384a32bb69
SHA256:
585957bd0a19fcff2d22cd8af7ffb13b68cc30c9dc13dfefb57271b03f3a999f
FIRSTBYTES:
2d2d2d2d2d424547494e20454320505249564154 / -----BEGIN EC PRIVAT
MODIFIED:
Tue Mar 2 10:31:47.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1779733
ARCHIVE_MD5:
9eb9420cf587edc26f8998ab679ad390
ARCHIVE_SHA1:
72eadcbe313b07b1dd3b693e41d3cd56d354e24e
ARCHIVE_SHA256:
f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbde976db48962e5a7f / vH.Z
ARCHIVE_CREATED:
Thu Aug 29 15:37:22.848 2024
ARCHIVE_MODIFIED:
Tue Oct 19 13:53:34.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:13:50.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x48\x63\x43\x41\x51\x45\x45\x49\x46\x67\x30\x5a\x43\x53\x45\x42\x35\x4c\x4e\x65\x4c\x73\x58\x59\x4c\x32\x35\x67\x33\x6b\x71\x45\x57\x73\x71\x68\x35\x32\x44\x52\x2b\x79\x4e\x4f\x6a\x79\x51\x4a\x71\x79"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 86

Aug 30 08:32:17 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshsig\testdata\ecdsa_sk
EXT:
TYPE:
Certificate PEM
SIZE:
837
MD5:
36948c6f96600caa24052b4d8322cbd9
SHA1:
b7bf9e701f8da5d50f61064849d052e04fb77c3f
SHA256:
f81b969ccd3e85f02b71465ba38fb51b5adf6f11b09f2e9e82ed6b2ab31f2356
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Tue Mar 2 10:31:47.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1779733
ARCHIVE_MD5:
9eb9420cf587edc26f8998ab679ad390
ARCHIVE_SHA1:
72eadcbe313b07b1dd3b693e41d3cd56d354e24e
ARCHIVE_SHA256:
f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbde976db48962e5a7f / vH.Z
ARCHIVE_CREATED:
Thu Aug 29 15:37:22.848 2024
ARCHIVE_MODIFIED:
Tue Oct 19 13:53:34.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:13:50.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x66\x77\x41\x41\x41\x43\x4a\x7a\x61\x79\x31\x6c\x59\x32\x0a\x52\x7a\x59\x53\x31\x7a\x61\x47\x45\x79"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 87

Aug 30 08:32:17 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshsig\testdata\ed25519
EXT:
TYPE:
Certificate PEM
SIZE:
411
MD5:
8bb197113a031c8f6d76de369316d0eb
SHA1:
40847760b4f753f2b17156d3f6f9cdcc7c0b91d4
SHA256:
c4683c666d6394fc5e8f3455b5379304979e0b41502560ddef20c824fa9fb66b
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Tue Mar 2 10:31:47.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1779733
ARCHIVE_MD5:
9eb9420cf587edc26f8998ab679ad390
ARCHIVE_SHA1:
72eadcbe313b07b1dd3b693e41d3cd56d354e24e
ARCHIVE_SHA256:
f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbde976db48962e5a7f / vH.Z
ARCHIVE_CREATED:
Thu Aug 29 15:37:22.848 2024
ARCHIVE_MODIFIED:
Tue Oct 19 13:53:34.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:13:50.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 88

Aug 30 08:32:17 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshsig\testdata\ed25519_sk
EXT:
TYPE:
Certificate PEM
SIZE:
484
MD5:
85bc2e18e08c06aa85cf023e7a97a585
SHA1:
95ea85c4709baf47e7cc2573ceac480cc35bde67
SHA256:
0e2221a7c8e8cea4fb6e9d2666b1d05166a3b0f5876c54433f0c35b564f22025
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Tue Mar 2 10:31:47.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1779733
ARCHIVE_MD5:
9eb9420cf587edc26f8998ab679ad390
ARCHIVE_SHA1:
72eadcbe313b07b1dd3b693e41d3cd56d354e24e
ARCHIVE_SHA256:
f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbde976db48962e5a7f / vH.Z
ARCHIVE_CREATED:
Thu Aug 29 15:37:22.848 2024
ARCHIVE_MODIFIED:
Tue Oct 19 13:53:34.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:13:50.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x53\x67\x41\x41\x41\x42\x70\x7a\x61\x79\x31\x7a\x63\x32\x0a\x67\x74\x5a\x57\x51\x79\x4e\x54\x55\x78"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 89

Aug 30 08:32:17 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshsig\testdata\rsa
EXT:
TYPE:
Certificate PEM
SIZE:
2455
MD5:
efe804ccdc63abc29233f3a1e11e173b
SHA1:
481c1773197aabc2d9d87336ad84f44410251ed4
SHA256:
d7eb37f534b846bb582bcdcf78232bdb33932e34fb72d6bfa130a8fd699b10b6
FIRSTBYTES:
2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA
MODIFIED:
Tue Mar 2 10:31:47.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.5p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1779733
ARCHIVE_MD5:
9eb9420cf587edc26f8998ab679ad390
ARCHIVE_SHA1:
72eadcbe313b07b1dd3b693e41d3cd56d354e24e
ARCHIVE_SHA256:
f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbde976db48962e5a7f / vH.Z
ARCHIVE_CREATED:
Thu Aug 29 15:37:22.848 2024
ARCHIVE_MODIFIED:
Tue Oct 19 13:53:34.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:13:50.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x47\x34\x77\x49\x42\x41\x41\x4b\x43\x41\x59\x45\x41\x33\x38\x36\x6c\x6d\x6a\x52\x48\x74\x4a\x70\x79\x6a\x38\x37\x42\x72\x53\x2b\x73\x73\x4d\x6d\x74\x76\x63\x2f\x31\x53\x50\x4e\x30\x67\x58\x54\x50\x73"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 90

Aug 30 08:32:18 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\ed25519_openssh.prv
EXT:
.prv
TYPE:
Certificate PEM
SIZE:
419
MD5:
c1d6034878b590c80805ad1e66039091
SHA1:
9127798b0fadd4539c81ee4f294287e8262eddb0
SHA256:
11bab46497954bd367ea5c2541cb3bad4814515481aee687fcdddc5680ee642d
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Sun Sep 26 14:03:19.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1815060
ARCHIVE_MD5:
8ce5f390958baeeab635aafd0ef41453
ARCHIVE_SHA1:
1eb964897a4372f6fb96c7effeb509ec71c379c9
ARCHIVE_SHA256:
4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbdeb76db46b62eda7f / vF.
ARCHIVE_CREATED:
Thu Aug 29 15:37:22.890 2024
ARCHIVE_MODIFIED:
Tue Oct 19 14:06:19.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:25:11.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 91

Aug 30 08:32:18 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\misc\fuzz-harness\testdata\id_dsa
EXT:
TYPE:
Certificate PEM
SIZE:
1361
MD5:
a9521c2825fbf778b6b82b1dcda95d72
SHA1:
29bc6d9b491473450487aad65a659675154b8fb8
SHA256:
a6fa247970fe3fe15b9647e9ae301495d10ea278dbe9516abdf70e69b1849744
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Sun Sep 26 14:03:19.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1815060
ARCHIVE_MD5:
8ce5f390958baeeab635aafd0ef41453
ARCHIVE_SHA1:
1eb964897a4372f6fb96c7effeb509ec71c379c9
ARCHIVE_SHA256:
4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbdeb76db46b62eda7f / vF.
ARCHIVE_CREATED:
Thu Aug 29 15:37:22.890 2024
ARCHIVE_MODIFIED:
Tue Oct 19 14:06:19.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:25:11.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x42\x73\x67\x41\x41\x41\x41\x64\x7a\x63\x32\x67\x74\x5a\x48\x0a\x4e\x7a\x41\x41\x41\x41\x67\x51\x43\x73"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 92

Aug 30 08:32:18 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\misc\fuzz-harness\testdata\id_ecdsa
EXT:
TYPE:
Certificate PEM
SIZE:
492
MD5:
b14d14c4a2eb3a89c43be1d828fe2604
SHA1:
56c94a39972cc4c2ab982f6b206702cf3b558bde
SHA256:
00120fd3e06a2c9a2debabe94c75cb9a8fb313d17b3a114dda6264874ae56c60
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Sun Sep 26 14:03:19.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1815060
ARCHIVE_MD5:
8ce5f390958baeeab635aafd0ef41453
ARCHIVE_SHA1:
1eb964897a4372f6fb96c7effeb509ec71c379c9
ARCHIVE_SHA256:
4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbdeb76db46b62eda7f / vF.
ARCHIVE_CREATED:
Thu Aug 29 15:37:22.890 2024
ARCHIVE_MODIFIED:
Tue Oct 19 14:06:19.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:25:11.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x61\x41\x41\x41\x41\x42\x4e\x6c\x59\x32\x52\x7a\x59\x53\x0a\x31\x7a\x61\x47\x45\x79\x4c\x57\x35\x70"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 93

Aug 30 08:32:18 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\misc\fuzz-harness\testdata\id_ecdsa_sk
EXT:
TYPE:
Certificate PEM
SIZE:
858
MD5:
c87bc24fa8b257e7af7374511f44d2c5
SHA1:
2c1d6e64ad0052837b53739841f6acfc60a191ed
SHA256:
50e6649901ffdf7bc4d85dd0f45937b9d99bdd85e472c112f8586bd3e35beb58
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Sun Sep 26 14:03:19.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1815060
ARCHIVE_MD5:
8ce5f390958baeeab635aafd0ef41453
ARCHIVE_SHA1:
1eb964897a4372f6fb96c7effeb509ec71c379c9
ARCHIVE_SHA256:
4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbdeb76db46b62eda7f / vF.
ARCHIVE_CREATED:
Thu Aug 29 15:37:22.890 2024
ARCHIVE_MODIFIED:
Tue Oct 19 14:06:19.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:25:11.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x66\x77\x41\x41\x41\x43\x4a\x7a\x61\x79\x31\x6c\x59\x32\x0a\x52\x7a\x59\x53\x31\x7a\x61\x47\x45\x79"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 94

Aug 30 08:32:18 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\misc\fuzz-harness\testdata\id_ed25519
EXT:
TYPE:
Certificate PEM
SIZE:
387
MD5:
904e0a369a7fbe86bcb4e0bc1363c539
SHA1:
1074da4383390925d414ad562a0818a88e116208
SHA256:
6efecdbb70364afc9cf004e325a9a1d2673d86e85a6238e1126d6d105cea56c1
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Sun Sep 26 14:03:19.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1815060
ARCHIVE_MD5:
8ce5f390958baeeab635aafd0ef41453
ARCHIVE_SHA1:
1eb964897a4372f6fb96c7effeb509ec71c379c9
ARCHIVE_SHA256:
4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbdeb76db46b62eda7f / vF.
ARCHIVE_CREATED:
Thu Aug 29 15:37:22.890 2024
ARCHIVE_MODIFIED:
Tue Oct 19 14:06:19.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:25:11.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 95

Aug 30 08:32:18 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\misc\fuzz-harness\testdata\id_ed25519_sk
EXT:
TYPE:
Certificate PEM
SIZE:
496
MD5:
c3c7cad31e9edf76f806848501011568
SHA1:
f936a6c0f3b1250ef7fd0cbf4ea5a5d3c9c63507
SHA256:
5fd315701b14a13467331e1d0819a8016abdf5888ab695f068fce488bd37169d
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Sun Sep 26 14:03:19.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1815060
ARCHIVE_MD5:
8ce5f390958baeeab635aafd0ef41453
ARCHIVE_SHA1:
1eb964897a4372f6fb96c7effeb509ec71c379c9
ARCHIVE_SHA256:
4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbdeb76db46b62eda7f / vF.
ARCHIVE_CREATED:
Thu Aug 29 15:37:22.890 2024
ARCHIVE_MODIFIED:
Tue Oct 19 14:06:19.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:25:11.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x53\x67\x41\x41\x41\x42\x70\x7a\x61\x79\x31\x7a\x63\x32\x0a\x67\x74\x5a\x57\x51\x79\x4e\x54\x55\x78"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 96

Aug 30 08:32:18 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\misc\fuzz-harness\testdata\id_rsa
EXT:
TYPE:
Certificate PEM
SIZE:
1799
MD5:
0e4d9d0e310d6dc6a5c2d33660f70542
SHA1:
7bef427ad9067a465009d543787063fdaceef3e5
SHA256:
83822e39fb2ee059431a45c3c48cffcda3fb869273a364a45898ce9abad09e84
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Sun Sep 26 14:03:19.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1815060
ARCHIVE_MD5:
8ce5f390958baeeab635aafd0ef41453
ARCHIVE_SHA1:
1eb964897a4372f6fb96c7effeb509ec71c379c9
ARCHIVE_SHA256:
4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbdeb76db46b62eda7f / vF.
ARCHIVE_CREATED:
Thu Aug 29 15:37:22.890 2024
ARCHIVE_MODIFIED:
Tue Oct 19 14:06:19.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:25:11.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x42\x46\x77\x41\x41\x41\x41\x64\x7a\x63\x32\x67\x74\x63\x6e\x0a\x4e\x68\x41\x41\x41\x41\x41\x77\x45\x41"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 97

Aug 30 08:32:19 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\rsa_openssh.prv
EXT:
.prv
TYPE:
Certificate PEM
SIZE:
883
MD5:
a6b110f820948e73bbde7b948744b3c5
SHA1:
614e6d353be614ded246a12ed6e14af20f063710
SHA256:
79b8783d0b10a3f65b9b3e349a1daa692cc27be08028131ff5a9a08799035f46
FIRSTBYTES:
2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA
MODIFIED:
Sun Sep 26 14:03:19.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1815060
ARCHIVE_MD5:
8ce5f390958baeeab635aafd0ef41453
ARCHIVE_SHA1:
1eb964897a4372f6fb96c7effeb509ec71c379c9
ARCHIVE_SHA256:
4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbdeb76db46b62eda7f / vF.
ARCHIVE_CREATED:
Thu Aug 29 15:37:22.890 2024
ARCHIVE_MODIFIED:
Tue Oct 19 14:06:19.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:25:11.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x43\x57\x67\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x73\x69\x6c\x77\x4b\x63\x61\x4b\x4e\x36\x77\x53\x4d\x4e\x64\x31\x57\x67\x51\x39\x2b\x48\x52\x71\x51\x45\x6b\x44\x30\x6b\x43\x54\x56\x74\x74\x72\x61\x7a"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 98

Aug 30 08:32:19 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshkey\testdata\dsa_1
EXT:
TYPE:
Certificate PEM
SIZE:
672
MD5:
aebcad00ac7fb84f1a7de01322c99be3
SHA1:
a9a0e1cf84bee8c27802295819b399833e5d4d08
SHA256:
b7f7c2bb695b28e585951a2da4ad2d6c933c440afe118798c6e2363e17da2b93
FIRSTBYTES:
2d2d2d2d2d424547494e20445341205052495641 / -----BEGIN DSA PRIVA
MODIFIED:
Sun Sep 26 14:03:19.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1815060
ARCHIVE_MD5:
8ce5f390958baeeab635aafd0ef41453
ARCHIVE_SHA1:
1eb964897a4372f6fb96c7effeb509ec71c379c9
ARCHIVE_SHA256:
4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbdeb76db46b62eda7f / vF.
ARCHIVE_CREATED:
Thu Aug 29 15:37:22.890 2024
ARCHIVE_MODIFIED:
Tue Oct 19 14:06:19.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:25:11.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x44\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x42\x76\x41\x49\x42\x41\x41\x4b\x42\x67\x51" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x44\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x42\x76\x41\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x36\x6b\x75\x74\x4e\x46\x52\x73\x48\x54\x77\x45\x41\x76\x36\x64\x33\x39\x4c\x68\x73\x71\x79\x31\x61\x70\x64\x48\x42\x5a\x39\x63\x32\x48\x66\x79\x52\x72\x37\x57\x6d\x79\x70\x79\x47\x49\x79\x32\x6d"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 99

Aug 30 08:32:19 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshkey\testdata\dsa_n
EXT:
TYPE:
Certificate PEM
SIZE:
1361
MD5:
6fcf088f9850b2f2213186cee4dc4811
SHA1:
a04d604886c6a7c2217df9b7eea5c998da91d561
SHA256:
db691de6aa454ec8aa45c84c58022a54611427f6f44c20d152ac05e0ea2284ba
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Sun Sep 26 14:03:19.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1815060
ARCHIVE_MD5:
8ce5f390958baeeab635aafd0ef41453
ARCHIVE_SHA1:
1eb964897a4372f6fb96c7effeb509ec71c379c9
ARCHIVE_SHA256:
4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbdeb76db46b62eda7f / vF.
ARCHIVE_CREATED:
Thu Aug 29 15:37:22.890 2024
ARCHIVE_MODIFIED:
Tue Oct 19 14:06:19.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:25:11.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x42\x73\x77\x41\x41\x41\x41\x64\x7a\x63\x32\x67\x74\x5a\x48\x0a\x4e\x7a\x41\x41\x41\x41\x67\x51\x44\x36"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 100

Aug 30 08:32:19 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshkey\testdata\ecdsa_1
EXT:
TYPE:
Certificate PEM
SIZE:
227
MD5:
610b43e1fd8e09f2794aba398c6950eb
SHA1:
c7e5b5ff84b30ff8880e4d75942a600d012516b6
SHA256:
42a90746ef5975c6ef98c6d56305dad0bc698a1b05c83518bc90584c83935d5c
FIRSTBYTES:
2d2d2d2d2d424547494e20454320505249564154 / -----BEGIN EC PRIVAT
MODIFIED:
Sun Sep 26 14:03:19.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1815060
ARCHIVE_MD5:
8ce5f390958baeeab635aafd0ef41453
ARCHIVE_SHA1:
1eb964897a4372f6fb96c7effeb509ec71c379c9
ARCHIVE_SHA256:
4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbdeb76db46b62eda7f / vF.
ARCHIVE_CREATED:
Thu Aug 29 15:37:22.890 2024
ARCHIVE_MODIFIED:
Tue Oct 19 14:06:19.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:25:11.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x48\x63\x43\x41\x51\x45\x45\x49\x50\x50\x4e\x79\x55\x41\x6e\x6a\x76\x46\x72\x2b\x65\x54\x2f\x37\x74\x2f\x49\x79\x6a\x75\x51\x51\x64\x2f\x61\x4c\x46\x69\x54\x59\x39\x32\x4c\x42\x39\x67\x49\x6a\x79\x72"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 101

Aug 30 08:32:19 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshkey\testdata\ecdsa_2
EXT:
TYPE:
Certificate PEM
SIZE:
365
MD5:
0346ad9a21f23d98cb3abe4845df078d
SHA1:
07091af93e22c676e03e6f96e9d0e53c9b53d775
SHA256:
320396e36bd5ecc12089f26849f8e7b6e0ab3c037f0492dee978cef6646d5826
FIRSTBYTES:
2d2d2d2d2d424547494e20454320505249564154 / -----BEGIN EC PRIVAT
MODIFIED:
Sun Sep 26 14:03:19.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1815060
ARCHIVE_MD5:
8ce5f390958baeeab635aafd0ef41453
ARCHIVE_SHA1:
1eb964897a4372f6fb96c7effeb509ec71c379c9
ARCHIVE_SHA256:
4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbdeb76db46b62eda7f / vF.
ARCHIVE_CREATED:
Thu Aug 29 15:37:22.890 2024
ARCHIVE_MODIFIED:
Tue Oct 19 14:06:19.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:25:11.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x48\x63\x41\x67\x45\x42\x42\x45\x49\x42\x71\x42\x74\x4e\x37\x65\x36\x45\x73\x73\x64\x33\x64\x6c\x73\x67\x49\x53\x56\x69\x50\x43\x58\x58\x43\x30\x61\x74\x6c\x4e\x6b\x47\x74\x6f\x4d\x67\x53\x51\x64"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 102

Aug 30 08:32:19 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshkey\testdata\ecdsa_n
EXT:
TYPE:
Certificate PEM
SIZE:
492
MD5:
0ffc5b7197ecb4b69f503d4f3cc24c8c
SHA1:
c2c7fd9527d9cc84781346a3ac8e2100d4d20ad3
SHA256:
1cccaa23aca49238099494fc7b49b550311719c9ac6bb138797e1077f4d7973d
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Sun Sep 26 14:03:19.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1815060
ARCHIVE_MD5:
8ce5f390958baeeab635aafd0ef41453
ARCHIVE_SHA1:
1eb964897a4372f6fb96c7effeb509ec71c379c9
ARCHIVE_SHA256:
4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbdeb76db46b62eda7f / vF.
ARCHIVE_CREATED:
Thu Aug 29 15:37:22.890 2024
ARCHIVE_MODIFIED:
Tue Oct 19 14:06:19.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:25:11.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x61\x41\x41\x41\x41\x42\x4e\x6c\x59\x32\x52\x7a\x59\x53\x0a\x31\x7a\x61\x47\x45\x79\x4c\x57\x35\x70"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 103

Aug 30 08:32:19 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshkey\testdata\ecdsa_sk1
EXT:
TYPE:
Certificate PEM
SIZE:
849
MD5:
97206cfa158fdda5a45c6eb542f739c0
SHA1:
e55ec614db8cea92d7269d5f903cf72baca36454
SHA256:
e4df7ea4ca133a7457069be073203c556166c65635ed6fb6c12b9a84f027346e
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Sun Sep 26 14:03:19.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1815060
ARCHIVE_MD5:
8ce5f390958baeeab635aafd0ef41453
ARCHIVE_SHA1:
1eb964897a4372f6fb96c7effeb509ec71c379c9
ARCHIVE_SHA256:
4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbdeb76db46b62eda7f / vF.
ARCHIVE_CREATED:
Thu Aug 29 15:37:22.890 2024
ARCHIVE_MODIFIED:
Tue Oct 19 14:06:19.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:25:11.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x66\x77\x41\x41\x41\x43\x4a\x7a\x61\x79\x31\x6c\x59\x32\x0a\x52\x7a\x59\x53\x31\x7a\x61\x47\x45\x79"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 104

Aug 30 08:32:19 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshkey\testdata\ecdsa_sk2
EXT:
TYPE:
Certificate PEM
SIZE:
849
MD5:
14ecb7595ee296b15d413ae395454a4c
SHA1:
909379299593aeebc79f44df0ec22578123acce7
SHA256:
de6f60d862f799ca088bd4611865e24bb0635d81097bb9496f0178aefa4acbae
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Sun Sep 26 14:03:19.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1815060
ARCHIVE_MD5:
8ce5f390958baeeab635aafd0ef41453
ARCHIVE_SHA1:
1eb964897a4372f6fb96c7effeb509ec71c379c9
ARCHIVE_SHA256:
4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbdeb76db46b62eda7f / vF.
ARCHIVE_CREATED:
Thu Aug 29 15:37:22.890 2024
ARCHIVE_MODIFIED:
Tue Oct 19 14:06:19.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:25:11.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x66\x77\x41\x41\x41\x43\x4a\x7a\x61\x79\x31\x6c\x59\x32\x0a\x52\x7a\x59\x53\x31\x7a\x61\x47\x45\x79"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 105

Aug 30 08:32:19 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshkey\testdata\ed25519_1
EXT:
TYPE:
Certificate PEM
SIZE:
411
MD5:
514e8e39c48edb2b8934ef78a5030042
SHA1:
a7a368a6f3d09bc2cfc1315f6e0899bde0574ffd
SHA256:
74f95c1990e3512af471cf6fb58d08a8078bbab597e7ee86a7ccd233f6855fd1
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Sun Sep 26 14:03:19.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1815060
ARCHIVE_MD5:
8ce5f390958baeeab635aafd0ef41453
ARCHIVE_SHA1:
1eb964897a4372f6fb96c7effeb509ec71c379c9
ARCHIVE_SHA256:
4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbdeb76db46b62eda7f / vF.
ARCHIVE_CREATED:
Thu Aug 29 15:37:22.890 2024
ARCHIVE_MODIFIED:
Tue Oct 19 14:06:19.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:25:11.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 106

Aug 30 08:32:19 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshkey\testdata\ed25519_2
EXT:
TYPE:
Certificate PEM
SIZE:
411
MD5:
bfc2ac8495dbc6070241303ec50a6dc2
SHA1:
53e388e7c836c6ba874e852d71a6e1e708611d25
SHA256:
31689f4706b3bdad29ee21b05af62e9f2257399d07092089944514ed5edb131d
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Sun Sep 26 14:03:19.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1815060
ARCHIVE_MD5:
8ce5f390958baeeab635aafd0ef41453
ARCHIVE_SHA1:
1eb964897a4372f6fb96c7effeb509ec71c379c9
ARCHIVE_SHA256:
4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbdeb76db46b62eda7f / vF.
ARCHIVE_CREATED:
Thu Aug 29 15:37:22.890 2024
ARCHIVE_MODIFIED:
Tue Oct 19 14:06:19.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:25:11.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 107

Aug 30 08:32:19 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshkey\testdata\ed25519_sk1
EXT:
TYPE:
Certificate PEM
SIZE:
484
MD5:
ab9dcdbff00763217a3f85069a9c2f67
SHA1:
05396ad046c37370093f48c0bdb2510b8894aa76
SHA256:
45c058d08280c4ca36a9d020478504cd550e7c5752c207d182363c3edf669ce8
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Sun Sep 26 14:03:19.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1815060
ARCHIVE_MD5:
8ce5f390958baeeab635aafd0ef41453
ARCHIVE_SHA1:
1eb964897a4372f6fb96c7effeb509ec71c379c9
ARCHIVE_SHA256:
4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbdeb76db46b62eda7f / vF.
ARCHIVE_CREATED:
Thu Aug 29 15:37:22.890 2024
ARCHIVE_MODIFIED:
Tue Oct 19 14:06:19.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:25:11.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x53\x67\x41\x41\x41\x42\x70\x7a\x61\x79\x31\x7a\x63\x32\x0a\x67\x74\x5a\x57\x51\x79\x4e\x54\x55\x78"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 108

Aug 30 08:32:19 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshkey\testdata\ed25519_sk2
EXT:
TYPE:
Certificate PEM
SIZE:
484
MD5:
8a666562de41f71d57d47c5f6404293a
SHA1:
069c9341d4b0cd94669ff23feab92853b6a42540
SHA256:
b862e169114ee63ae5e8497110075a9e67c4e3f24bad01e7c06951d268a3ec0f
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Sun Sep 26 14:03:19.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1815060
ARCHIVE_MD5:
8ce5f390958baeeab635aafd0ef41453
ARCHIVE_SHA1:
1eb964897a4372f6fb96c7effeb509ec71c379c9
ARCHIVE_SHA256:
4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbdeb76db46b62eda7f / vF.
ARCHIVE_CREATED:
Thu Aug 29 15:37:22.890 2024
ARCHIVE_MODIFIED:
Tue Oct 19 14:06:19.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:25:11.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x53\x67\x41\x41\x41\x42\x70\x7a\x61\x79\x31\x7a\x63\x32\x0a\x67\x74\x5a\x57\x51\x79\x4e\x54\x55\x78"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 109

Aug 30 08:32:19 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshkey\testdata\rsa_1
EXT:
TYPE:
Certificate PEM
SIZE:
887
MD5:
197f14927e89c5c573213416bde709cb
SHA1:
2f5cfafbddd00c351ce72e2f140458fb5ac7b60a
SHA256:
07586a53bef4dd9daf59c473399fca5fcb39891bed0d2c2f8a88249e02392ac5
FIRSTBYTES:
2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA
MODIFIED:
Sun Sep 26 14:03:19.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1815060
ARCHIVE_MD5:
8ce5f390958baeeab635aafd0ef41453
ARCHIVE_SHA1:
1eb964897a4372f6fb96c7effeb509ec71c379c9
ARCHIVE_SHA256:
4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbdeb76db46b62eda7f / vF.
ARCHIVE_CREATED:
Thu Aug 29 15:37:22.890 2024
ARCHIVE_MODIFIED:
Tue Oct 19 14:06:19.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:25:11.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x43\x58\x41\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x4c\x56\x35\x6c\x55\x54\x74\x37\x46\x72\x41\x44\x73\x65\x42\x2f\x43\x47\x68\x45\x5a\x7a\x70\x6f\x6f\x6a\x6a\x45\x57\x35\x79\x38\x2b\x65\x50\x76\x4c\x70"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 110

Aug 30 08:32:19 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshkey\testdata\rsa_1_sha1
EXT:
TYPE:
Certificate PEM
SIZE:
887
MD5:
197f14927e89c5c573213416bde709cb
SHA1:
2f5cfafbddd00c351ce72e2f140458fb5ac7b60a
SHA256:
07586a53bef4dd9daf59c473399fca5fcb39891bed0d2c2f8a88249e02392ac5
FIRSTBYTES:
2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA
MODIFIED:
Sun Sep 26 14:03:19.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1815060
ARCHIVE_MD5:
8ce5f390958baeeab635aafd0ef41453
ARCHIVE_SHA1:
1eb964897a4372f6fb96c7effeb509ec71c379c9
ARCHIVE_SHA256:
4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbdeb76db46b62eda7f / vF.
ARCHIVE_CREATED:
Thu Aug 29 15:37:22.890 2024
ARCHIVE_MODIFIED:
Tue Oct 19 14:06:19.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:25:11.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x43\x58\x41\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x4c\x56\x35\x6c\x55\x54\x74\x37\x46\x72\x41\x44\x73\x65\x42\x2f\x43\x47\x68\x45\x5a\x7a\x70\x6f\x6f\x6a\x6a\x45\x57\x35\x79\x38\x2b\x65\x50\x76\x4c\x70"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 111

Aug 30 08:32:19 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshkey\testdata\rsa_1_sha512
EXT:
TYPE:
Certificate PEM
SIZE:
887
MD5:
197f14927e89c5c573213416bde709cb
SHA1:
2f5cfafbddd00c351ce72e2f140458fb5ac7b60a
SHA256:
07586a53bef4dd9daf59c473399fca5fcb39891bed0d2c2f8a88249e02392ac5
FIRSTBYTES:
2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA
MODIFIED:
Sun Sep 26 14:03:19.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1815060
ARCHIVE_MD5:
8ce5f390958baeeab635aafd0ef41453
ARCHIVE_SHA1:
1eb964897a4372f6fb96c7effeb509ec71c379c9
ARCHIVE_SHA256:
4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbdeb76db46b62eda7f / vF.
ARCHIVE_CREATED:
Thu Aug 29 15:37:22.890 2024
ARCHIVE_MODIFIED:
Tue Oct 19 14:06:19.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:25:11.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x43\x58\x41\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x4c\x56\x35\x6c\x55\x54\x74\x37\x46\x72\x41\x44\x73\x65\x42\x2f\x43\x47\x68\x45\x5a\x7a\x70\x6f\x6f\x6a\x6a\x45\x57\x35\x79\x38\x2b\x65\x50\x76\x4c\x70"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 112

Aug 30 08:32:19 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshkey\testdata\rsa_2
EXT:
TYPE:
Certificate PEM
SIZE:
1679
MD5:
c8860a2d208d222eade1e9866449ccbc
SHA1:
64133ddc79d593e467c864c429e3793c69e4dc22
SHA256:
e42925e663a7215e19cdc89bd9fe018903eeb013f131b188d3c87f0ef01c5a24
FIRSTBYTES:
2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA
MODIFIED:
Sun Sep 26 14:03:19.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1815060
ARCHIVE_MD5:
8ce5f390958baeeab635aafd0ef41453
ARCHIVE_SHA1:
1eb964897a4372f6fb96c7effeb509ec71c379c9
ARCHIVE_SHA256:
4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbdeb76db46b62eda7f / vF.
ARCHIVE_CREATED:
Thu Aug 29 15:37:22.890 2024
ARCHIVE_MODIFIED:
Tue Oct 19 14:06:19.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:25:11.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x45\x70\x41\x49\x42\x41\x41\x4b\x43\x41\x51\x45\x41\x39\x4e\x45\x55\x58\x70\x37\x38\x53\x41\x6b\x6d\x4c\x34\x2b\x65\x41\x6a\x34\x6d\x42\x7a\x50\x4f\x6a\x6b\x2b\x63\x63\x43\x50\x56\x7a\x6b\x54\x52\x2b"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 113

Aug 30 08:32:19 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshkey\testdata\rsa_n
EXT:
TYPE:
Certificate PEM
SIZE:
1020
MD5:
d60f55c106077131ba136f02e9b9ba88
SHA1:
d6a3a8961cb40e8a4ff03dbfd5983c9fc5dfeb39
SHA256:
0ad47d17d5f21f350c26c4c94564bf41b6fd28ab55187166b4f46b1b35daed6d
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Sun Sep 26 14:03:19.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1815060
ARCHIVE_MD5:
8ce5f390958baeeab635aafd0ef41453
ARCHIVE_SHA1:
1eb964897a4372f6fb96c7effeb509ec71c379c9
ARCHIVE_SHA256:
4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbdeb76db46b62eda7f / vF.
ARCHIVE_CREATED:
Thu Aug 29 15:37:22.890 2024
ARCHIVE_MODIFIED:
Tue Oct 19 14:06:19.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:25:11.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x6c\x77\x41\x41\x41\x41\x64\x7a\x63\x32\x67\x74\x63\x6e\x0a\x4e\x68\x41\x41\x41\x41\x41\x77\x45\x41"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 114

Aug 30 08:32:19 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshsig\testdata\ecdsa
EXT:
TYPE:
Certificate PEM
SIZE:
227
MD5:
53f2aa69e4e8d05ea1c0848c4a946b71
SHA1:
69a4f47fbbb55eb5dea9adea057509384a32bb69
SHA256:
585957bd0a19fcff2d22cd8af7ffb13b68cc30c9dc13dfefb57271b03f3a999f
FIRSTBYTES:
2d2d2d2d2d424547494e20454320505249564154 / -----BEGIN EC PRIVAT
MODIFIED:
Sun Sep 26 14:03:19.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1815060
ARCHIVE_MD5:
8ce5f390958baeeab635aafd0ef41453
ARCHIVE_SHA1:
1eb964897a4372f6fb96c7effeb509ec71c379c9
ARCHIVE_SHA256:
4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbdeb76db46b62eda7f / vF.
ARCHIVE_CREATED:
Thu Aug 29 15:37:22.890 2024
ARCHIVE_MODIFIED:
Tue Oct 19 14:06:19.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:25:11.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x48\x63\x43\x41\x51\x45\x45\x49\x46\x67\x30\x5a\x43\x53\x45\x42\x35\x4c\x4e\x65\x4c\x73\x58\x59\x4c\x32\x35\x67\x33\x6b\x71\x45\x57\x73\x71\x68\x35\x32\x44\x52\x2b\x79\x4e\x4f\x6a\x79\x51\x4a\x71\x79"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 115

Aug 30 08:32:19 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshsig\testdata\ecdsa_sk
EXT:
TYPE:
Certificate PEM
SIZE:
837
MD5:
36948c6f96600caa24052b4d8322cbd9
SHA1:
b7bf9e701f8da5d50f61064849d052e04fb77c3f
SHA256:
f81b969ccd3e85f02b71465ba38fb51b5adf6f11b09f2e9e82ed6b2ab31f2356
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Sun Sep 26 14:03:19.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1815060
ARCHIVE_MD5:
8ce5f390958baeeab635aafd0ef41453
ARCHIVE_SHA1:
1eb964897a4372f6fb96c7effeb509ec71c379c9
ARCHIVE_SHA256:
4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbdeb76db46b62eda7f / vF.
ARCHIVE_CREATED:
Thu Aug 29 15:37:22.890 2024
ARCHIVE_MODIFIED:
Tue Oct 19 14:06:19.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:25:11.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x66\x77\x41\x41\x41\x43\x4a\x7a\x61\x79\x31\x6c\x59\x32\x0a\x52\x7a\x59\x53\x31\x7a\x61\x47\x45\x79"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 116

Aug 30 08:32:19 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshsig\testdata\ed25519
EXT:
TYPE:
Certificate PEM
SIZE:
411
MD5:
8bb197113a031c8f6d76de369316d0eb
SHA1:
40847760b4f753f2b17156d3f6f9cdcc7c0b91d4
SHA256:
c4683c666d6394fc5e8f3455b5379304979e0b41502560ddef20c824fa9fb66b
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Sun Sep 26 14:03:19.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1815060
ARCHIVE_MD5:
8ce5f390958baeeab635aafd0ef41453
ARCHIVE_SHA1:
1eb964897a4372f6fb96c7effeb509ec71c379c9
ARCHIVE_SHA256:
4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbdeb76db46b62eda7f / vF.
ARCHIVE_CREATED:
Thu Aug 29 15:37:22.890 2024
ARCHIVE_MODIFIED:
Tue Oct 19 14:06:19.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:25:11.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 117

Aug 30 08:32:19 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshsig\testdata\ed25519_sk
EXT:
TYPE:
Certificate PEM
SIZE:
484
MD5:
85bc2e18e08c06aa85cf023e7a97a585
SHA1:
95ea85c4709baf47e7cc2573ceac480cc35bde67
SHA256:
0e2221a7c8e8cea4fb6e9d2666b1d05166a3b0f5876c54433f0c35b564f22025
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Sun Sep 26 14:03:19.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1815060
ARCHIVE_MD5:
8ce5f390958baeeab635aafd0ef41453
ARCHIVE_SHA1:
1eb964897a4372f6fb96c7effeb509ec71c379c9
ARCHIVE_SHA256:
4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbdeb76db46b62eda7f / vF.
ARCHIVE_CREATED:
Thu Aug 29 15:37:22.890 2024
ARCHIVE_MODIFIED:
Tue Oct 19 14:06:19.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:25:11.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x53\x67\x41\x41\x41\x42\x70\x7a\x61\x79\x31\x7a\x63\x32\x0a\x67\x74\x5a\x57\x51\x79\x4e\x54\x55\x78"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 118

Aug 30 08:32:20 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshsig\testdata\rsa
EXT:
TYPE:
Certificate PEM
SIZE:
2455
MD5:
efe804ccdc63abc29233f3a1e11e173b
SHA1:
481c1773197aabc2d9d87336ad84f44410251ed4
SHA256:
d7eb37f534b846bb582bcdcf78232bdb33932e34fb72d6bfa130a8fd699b10b6
FIRSTBYTES:
2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA
MODIFIED:
Sun Sep 26 14:03:19.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\home\rpmbuilder\rpmbuild\SOURCES\openssh-8.8p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1815060
ARCHIVE_MD5:
8ce5f390958baeeab635aafd0ef41453
ARCHIVE_SHA1:
1eb964897a4372f6fb96c7effeb509ec71c379c9
ARCHIVE_SHA256:
4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbdeb76db46b62eda7f / vF.
ARCHIVE_CREATED:
Thu Aug 29 15:37:22.890 2024
ARCHIVE_MODIFIED:
Tue Oct 19 14:06:19.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:25:11.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x47\x34\x77\x49\x42\x41\x41\x4b\x43\x41\x59\x45\x41\x33\x38\x36\x6c\x6d\x6a\x52\x48\x74\x4a\x70\x79\x6a\x38\x37\x42\x72\x53\x2b\x73\x73\x4d\x6d\x74\x76\x63\x2f\x31\x53\x50\x4e\x30\x67\x58\x54\x50\x73"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 119

Aug 30 08:32:21 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\misc\fuzz-harness\testdata\id_dsa
EXT:
TYPE:
Certificate PEM
SIZE:
1361
MD5:
a9521c2825fbf778b6b82b1dcda95d72
SHA1:
29bc6d9b491473450487aad65a659675154b8fb8
SHA256:
a6fa247970fe3fe15b9647e9ae301495d10ea278dbe9516abdf70e69b1849744
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Tue Mar 2 10:31:47.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1779733
ARCHIVE_MD5:
9eb9420cf587edc26f8998ab679ad390
ARCHIVE_SHA1:
72eadcbe313b07b1dd3b693e41d3cd56d354e24e
ARCHIVE_SHA256:
f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbde976db48962e5a7f / vH.Z
ARCHIVE_CREATED:
Fri Aug 30 07:32:13.477 2024
ARCHIVE_MODIFIED:
Wed Mar 3 00:46:27.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:27:15.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x42\x73\x67\x41\x41\x41\x41\x64\x7a\x63\x32\x67\x74\x5a\x48\x0a\x4e\x7a\x41\x41\x41\x41\x67\x51\x43\x73"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 120

Aug 30 08:32:21 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\misc\fuzz-harness\testdata\id_ecdsa
EXT:
TYPE:
Certificate PEM
SIZE:
492
MD5:
b14d14c4a2eb3a89c43be1d828fe2604
SHA1:
56c94a39972cc4c2ab982f6b206702cf3b558bde
SHA256:
00120fd3e06a2c9a2debabe94c75cb9a8fb313d17b3a114dda6264874ae56c60
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Tue Mar 2 10:31:47.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1779733
ARCHIVE_MD5:
9eb9420cf587edc26f8998ab679ad390
ARCHIVE_SHA1:
72eadcbe313b07b1dd3b693e41d3cd56d354e24e
ARCHIVE_SHA256:
f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbde976db48962e5a7f / vH.Z
ARCHIVE_CREATED:
Fri Aug 30 07:32:13.477 2024
ARCHIVE_MODIFIED:
Wed Mar 3 00:46:27.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:27:15.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x61\x41\x41\x41\x41\x42\x4e\x6c\x59\x32\x52\x7a\x59\x53\x0a\x31\x7a\x61\x47\x45\x79\x4c\x57\x35\x70"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 121

Aug 30 08:32:21 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\misc\fuzz-harness\testdata\id_ecdsa_sk
EXT:
TYPE:
Certificate PEM
SIZE:
858
MD5:
c87bc24fa8b257e7af7374511f44d2c5
SHA1:
2c1d6e64ad0052837b53739841f6acfc60a191ed
SHA256:
50e6649901ffdf7bc4d85dd0f45937b9d99bdd85e472c112f8586bd3e35beb58
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Tue Mar 2 10:31:47.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1779733
ARCHIVE_MD5:
9eb9420cf587edc26f8998ab679ad390
ARCHIVE_SHA1:
72eadcbe313b07b1dd3b693e41d3cd56d354e24e
ARCHIVE_SHA256:
f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbde976db48962e5a7f / vH.Z
ARCHIVE_CREATED:
Fri Aug 30 07:32:13.477 2024
ARCHIVE_MODIFIED:
Wed Mar 3 00:46:27.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:27:15.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x66\x77\x41\x41\x41\x43\x4a\x7a\x61\x79\x31\x6c\x59\x32\x0a\x52\x7a\x59\x53\x31\x7a\x61\x47\x45\x79"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 122

Aug 30 08:32:21 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\misc\fuzz-harness\testdata\id_ed25519
EXT:
TYPE:
Certificate PEM
SIZE:
387
MD5:
904e0a369a7fbe86bcb4e0bc1363c539
SHA1:
1074da4383390925d414ad562a0818a88e116208
SHA256:
6efecdbb70364afc9cf004e325a9a1d2673d86e85a6238e1126d6d105cea56c1
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Tue Mar 2 10:31:47.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1779733
ARCHIVE_MD5:
9eb9420cf587edc26f8998ab679ad390
ARCHIVE_SHA1:
72eadcbe313b07b1dd3b693e41d3cd56d354e24e
ARCHIVE_SHA256:
f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbde976db48962e5a7f / vH.Z
ARCHIVE_CREATED:
Fri Aug 30 07:32:13.477 2024
ARCHIVE_MODIFIED:
Wed Mar 3 00:46:27.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:27:15.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 123

Aug 30 08:32:21 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\misc\fuzz-harness\testdata\id_ed25519_sk
EXT:
TYPE:
Certificate PEM
SIZE:
496
MD5:
c3c7cad31e9edf76f806848501011568
SHA1:
f936a6c0f3b1250ef7fd0cbf4ea5a5d3c9c63507
SHA256:
5fd315701b14a13467331e1d0819a8016abdf5888ab695f068fce488bd37169d
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Tue Mar 2 10:31:47.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1779733
ARCHIVE_MD5:
9eb9420cf587edc26f8998ab679ad390
ARCHIVE_SHA1:
72eadcbe313b07b1dd3b693e41d3cd56d354e24e
ARCHIVE_SHA256:
f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbde976db48962e5a7f / vH.Z
ARCHIVE_CREATED:
Fri Aug 30 07:32:13.477 2024
ARCHIVE_MODIFIED:
Wed Mar 3 00:46:27.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:27:15.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x53\x67\x41\x41\x41\x42\x70\x7a\x61\x79\x31\x7a\x63\x32\x0a\x67\x74\x5a\x57\x51\x79\x4e\x54\x55\x78"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 124

Aug 30 08:32:21 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\misc\fuzz-harness\testdata\id_rsa
EXT:
TYPE:
Certificate PEM
SIZE:
1799
MD5:
0e4d9d0e310d6dc6a5c2d33660f70542
SHA1:
7bef427ad9067a465009d543787063fdaceef3e5
SHA256:
83822e39fb2ee059431a45c3c48cffcda3fb869273a364a45898ce9abad09e84
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Tue Mar 2 10:31:47.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1779733
ARCHIVE_MD5:
9eb9420cf587edc26f8998ab679ad390
ARCHIVE_SHA1:
72eadcbe313b07b1dd3b693e41d3cd56d354e24e
ARCHIVE_SHA256:
f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbde976db48962e5a7f / vH.Z
ARCHIVE_CREATED:
Fri Aug 30 07:32:13.477 2024
ARCHIVE_MODIFIED:
Wed Mar 3 00:46:27.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:27:15.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x42\x46\x77\x41\x41\x41\x41\x64\x7a\x63\x32\x67\x74\x63\x6e\x0a\x4e\x68\x41\x41\x41\x41\x41\x77\x45\x41"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 125

Aug 30 08:32:22 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\rsa_openssh.prv
EXT:
.prv
TYPE:
Certificate PEM
SIZE:
883
MD5:
a6b110f820948e73bbde7b948744b3c5
SHA1:
614e6d353be614ded246a12ed6e14af20f063710
SHA256:
79b8783d0b10a3f65b9b3e349a1daa692cc27be08028131ff5a9a08799035f46
FIRSTBYTES:
2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA
MODIFIED:
Tue Mar 2 10:31:47.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1779733
ARCHIVE_MD5:
9eb9420cf587edc26f8998ab679ad390
ARCHIVE_SHA1:
72eadcbe313b07b1dd3b693e41d3cd56d354e24e
ARCHIVE_SHA256:
f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbde976db48962e5a7f / vH.Z
ARCHIVE_CREATED:
Fri Aug 30 07:32:13.477 2024
ARCHIVE_MODIFIED:
Wed Mar 3 00:46:27.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:27:15.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x43\x57\x67\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x73\x69\x6c\x77\x4b\x63\x61\x4b\x4e\x36\x77\x53\x4d\x4e\x64\x31\x57\x67\x51\x39\x2b\x48\x52\x71\x51\x45\x6b\x44\x30\x6b\x43\x54\x56\x74\x74\x72\x61\x7a"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 126

Aug 30 08:32:22 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshkey\testdata\dsa_1
EXT:
TYPE:
Certificate PEM
SIZE:
672
MD5:
aebcad00ac7fb84f1a7de01322c99be3
SHA1:
a9a0e1cf84bee8c27802295819b399833e5d4d08
SHA256:
b7f7c2bb695b28e585951a2da4ad2d6c933c440afe118798c6e2363e17da2b93
FIRSTBYTES:
2d2d2d2d2d424547494e20445341205052495641 / -----BEGIN DSA PRIVA
MODIFIED:
Tue Mar 2 10:31:47.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1779733
ARCHIVE_MD5:
9eb9420cf587edc26f8998ab679ad390
ARCHIVE_SHA1:
72eadcbe313b07b1dd3b693e41d3cd56d354e24e
ARCHIVE_SHA256:
f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbde976db48962e5a7f / vH.Z
ARCHIVE_CREATED:
Fri Aug 30 07:32:13.477 2024
ARCHIVE_MODIFIED:
Wed Mar 3 00:46:27.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:27:15.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x44\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x42\x76\x41\x49\x42\x41\x41\x4b\x42\x67\x51" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x44\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x42\x76\x41\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x36\x6b\x75\x74\x4e\x46\x52\x73\x48\x54\x77\x45\x41\x76\x36\x64\x33\x39\x4c\x68\x73\x71\x79\x31\x61\x70\x64\x48\x42\x5a\x39\x63\x32\x48\x66\x79\x52\x72\x37\x57\x6d\x79\x70\x79\x47\x49\x79\x32\x6d"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 127

Aug 30 08:32:22 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshkey\testdata\dsa_n
EXT:
TYPE:
Certificate PEM
SIZE:
1361
MD5:
6fcf088f9850b2f2213186cee4dc4811
SHA1:
a04d604886c6a7c2217df9b7eea5c998da91d561
SHA256:
db691de6aa454ec8aa45c84c58022a54611427f6f44c20d152ac05e0ea2284ba
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Tue Mar 2 10:31:47.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1779733
ARCHIVE_MD5:
9eb9420cf587edc26f8998ab679ad390
ARCHIVE_SHA1:
72eadcbe313b07b1dd3b693e41d3cd56d354e24e
ARCHIVE_SHA256:
f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbde976db48962e5a7f / vH.Z
ARCHIVE_CREATED:
Fri Aug 30 07:32:13.477 2024
ARCHIVE_MODIFIED:
Wed Mar 3 00:46:27.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:27:15.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x42\x73\x77\x41\x41\x41\x41\x64\x7a\x63\x32\x67\x74\x5a\x48\x0a\x4e\x7a\x41\x41\x41\x41\x67\x51\x44\x36"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 128

Aug 30 08:32:22 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshkey\testdata\ecdsa_1
EXT:
TYPE:
Certificate PEM
SIZE:
227
MD5:
610b43e1fd8e09f2794aba398c6950eb
SHA1:
c7e5b5ff84b30ff8880e4d75942a600d012516b6
SHA256:
42a90746ef5975c6ef98c6d56305dad0bc698a1b05c83518bc90584c83935d5c
FIRSTBYTES:
2d2d2d2d2d424547494e20454320505249564154 / -----BEGIN EC PRIVAT
MODIFIED:
Tue Mar 2 10:31:47.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1779733
ARCHIVE_MD5:
9eb9420cf587edc26f8998ab679ad390
ARCHIVE_SHA1:
72eadcbe313b07b1dd3b693e41d3cd56d354e24e
ARCHIVE_SHA256:
f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbde976db48962e5a7f / vH.Z
ARCHIVE_CREATED:
Fri Aug 30 07:32:13.477 2024
ARCHIVE_MODIFIED:
Wed Mar 3 00:46:27.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:27:15.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x48\x63\x43\x41\x51\x45\x45\x49\x50\x50\x4e\x79\x55\x41\x6e\x6a\x76\x46\x72\x2b\x65\x54\x2f\x37\x74\x2f\x49\x79\x6a\x75\x51\x51\x64\x2f\x61\x4c\x46\x69\x54\x59\x39\x32\x4c\x42\x39\x67\x49\x6a\x79\x72"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 129

Aug 30 08:32:22 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshkey\testdata\ecdsa_2
EXT:
TYPE:
Certificate PEM
SIZE:
365
MD5:
0346ad9a21f23d98cb3abe4845df078d
SHA1:
07091af93e22c676e03e6f96e9d0e53c9b53d775
SHA256:
320396e36bd5ecc12089f26849f8e7b6e0ab3c037f0492dee978cef6646d5826
FIRSTBYTES:
2d2d2d2d2d424547494e20454320505249564154 / -----BEGIN EC PRIVAT
MODIFIED:
Tue Mar 2 10:31:47.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1779733
ARCHIVE_MD5:
9eb9420cf587edc26f8998ab679ad390
ARCHIVE_SHA1:
72eadcbe313b07b1dd3b693e41d3cd56d354e24e
ARCHIVE_SHA256:
f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbde976db48962e5a7f / vH.Z
ARCHIVE_CREATED:
Fri Aug 30 07:32:13.477 2024
ARCHIVE_MODIFIED:
Wed Mar 3 00:46:27.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:27:15.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x48\x63\x41\x67\x45\x42\x42\x45\x49\x42\x71\x42\x74\x4e\x37\x65\x36\x45\x73\x73\x64\x33\x64\x6c\x73\x67\x49\x53\x56\x69\x50\x43\x58\x58\x43\x30\x61\x74\x6c\x4e\x6b\x47\x74\x6f\x4d\x67\x53\x51\x64"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 130

Aug 30 08:32:22 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshkey\testdata\ecdsa_n
EXT:
TYPE:
Certificate PEM
SIZE:
492
MD5:
0ffc5b7197ecb4b69f503d4f3cc24c8c
SHA1:
c2c7fd9527d9cc84781346a3ac8e2100d4d20ad3
SHA256:
1cccaa23aca49238099494fc7b49b550311719c9ac6bb138797e1077f4d7973d
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Tue Mar 2 10:31:47.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1779733
ARCHIVE_MD5:
9eb9420cf587edc26f8998ab679ad390
ARCHIVE_SHA1:
72eadcbe313b07b1dd3b693e41d3cd56d354e24e
ARCHIVE_SHA256:
f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbde976db48962e5a7f / vH.Z
ARCHIVE_CREATED:
Fri Aug 30 07:32:13.477 2024
ARCHIVE_MODIFIED:
Wed Mar 3 00:46:27.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:27:15.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x61\x41\x41\x41\x41\x42\x4e\x6c\x59\x32\x52\x7a\x59\x53\x0a\x31\x7a\x61\x47\x45\x79\x4c\x57\x35\x70"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 131

Aug 30 08:32:22 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshkey\testdata\ecdsa_sk1
EXT:
TYPE:
Certificate PEM
SIZE:
849
MD5:
97206cfa158fdda5a45c6eb542f739c0
SHA1:
e55ec614db8cea92d7269d5f903cf72baca36454
SHA256:
e4df7ea4ca133a7457069be073203c556166c65635ed6fb6c12b9a84f027346e
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Tue Mar 2 10:31:47.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1779733
ARCHIVE_MD5:
9eb9420cf587edc26f8998ab679ad390
ARCHIVE_SHA1:
72eadcbe313b07b1dd3b693e41d3cd56d354e24e
ARCHIVE_SHA256:
f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbde976db48962e5a7f / vH.Z
ARCHIVE_CREATED:
Fri Aug 30 07:32:13.477 2024
ARCHIVE_MODIFIED:
Wed Mar 3 00:46:27.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:27:15.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x66\x77\x41\x41\x41\x43\x4a\x7a\x61\x79\x31\x6c\x59\x32\x0a\x52\x7a\x59\x53\x31\x7a\x61\x47\x45\x79"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 132

Aug 30 08:32:22 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshkey\testdata\ecdsa_sk2
EXT:
TYPE:
Certificate PEM
SIZE:
849
MD5:
14ecb7595ee296b15d413ae395454a4c
SHA1:
909379299593aeebc79f44df0ec22578123acce7
SHA256:
de6f60d862f799ca088bd4611865e24bb0635d81097bb9496f0178aefa4acbae
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Tue Mar 2 10:31:47.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1779733
ARCHIVE_MD5:
9eb9420cf587edc26f8998ab679ad390
ARCHIVE_SHA1:
72eadcbe313b07b1dd3b693e41d3cd56d354e24e
ARCHIVE_SHA256:
f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbde976db48962e5a7f / vH.Z
ARCHIVE_CREATED:
Fri Aug 30 07:32:13.477 2024
ARCHIVE_MODIFIED:
Wed Mar 3 00:46:27.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:27:15.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x66\x77\x41\x41\x41\x43\x4a\x7a\x61\x79\x31\x6c\x59\x32\x0a\x52\x7a\x59\x53\x31\x7a\x61\x47\x45\x79"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 133

Aug 30 08:32:22 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshkey\testdata\ed25519_1
EXT:
TYPE:
Certificate PEM
SIZE:
411
MD5:
514e8e39c48edb2b8934ef78a5030042
SHA1:
a7a368a6f3d09bc2cfc1315f6e0899bde0574ffd
SHA256:
74f95c1990e3512af471cf6fb58d08a8078bbab597e7ee86a7ccd233f6855fd1
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Tue Mar 2 10:31:47.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1779733
ARCHIVE_MD5:
9eb9420cf587edc26f8998ab679ad390
ARCHIVE_SHA1:
72eadcbe313b07b1dd3b693e41d3cd56d354e24e
ARCHIVE_SHA256:
f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbde976db48962e5a7f / vH.Z
ARCHIVE_CREATED:
Fri Aug 30 07:32:13.477 2024
ARCHIVE_MODIFIED:
Wed Mar 3 00:46:27.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:27:15.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 134

Aug 30 08:32:22 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshkey\testdata\ed25519_2
EXT:
TYPE:
Certificate PEM
SIZE:
411
MD5:
bfc2ac8495dbc6070241303ec50a6dc2
SHA1:
53e388e7c836c6ba874e852d71a6e1e708611d25
SHA256:
31689f4706b3bdad29ee21b05af62e9f2257399d07092089944514ed5edb131d
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Tue Mar 2 10:31:47.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1779733
ARCHIVE_MD5:
9eb9420cf587edc26f8998ab679ad390
ARCHIVE_SHA1:
72eadcbe313b07b1dd3b693e41d3cd56d354e24e
ARCHIVE_SHA256:
f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbde976db48962e5a7f / vH.Z
ARCHIVE_CREATED:
Fri Aug 30 07:32:13.477 2024
ARCHIVE_MODIFIED:
Wed Mar 3 00:46:27.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:27:15.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 135

Aug 30 08:32:22 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshkey\testdata\ed25519_sk1
EXT:
TYPE:
Certificate PEM
SIZE:
484
MD5:
ab9dcdbff00763217a3f85069a9c2f67
SHA1:
05396ad046c37370093f48c0bdb2510b8894aa76
SHA256:
45c058d08280c4ca36a9d020478504cd550e7c5752c207d182363c3edf669ce8
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Tue Mar 2 10:31:47.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1779733
ARCHIVE_MD5:
9eb9420cf587edc26f8998ab679ad390
ARCHIVE_SHA1:
72eadcbe313b07b1dd3b693e41d3cd56d354e24e
ARCHIVE_SHA256:
f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbde976db48962e5a7f / vH.Z
ARCHIVE_CREATED:
Fri Aug 30 07:32:13.477 2024
ARCHIVE_MODIFIED:
Wed Mar 3 00:46:27.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:27:15.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x53\x67\x41\x41\x41\x42\x70\x7a\x61\x79\x31\x7a\x63\x32\x0a\x67\x74\x5a\x57\x51\x79\x4e\x54\x55\x78"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 136

Aug 30 08:32:22 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshkey\testdata\ed25519_sk2
EXT:
TYPE:
Certificate PEM
SIZE:
484
MD5:
8a666562de41f71d57d47c5f6404293a
SHA1:
069c9341d4b0cd94669ff23feab92853b6a42540
SHA256:
b862e169114ee63ae5e8497110075a9e67c4e3f24bad01e7c06951d268a3ec0f
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Tue Mar 2 10:31:47.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1779733
ARCHIVE_MD5:
9eb9420cf587edc26f8998ab679ad390
ARCHIVE_SHA1:
72eadcbe313b07b1dd3b693e41d3cd56d354e24e
ARCHIVE_SHA256:
f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbde976db48962e5a7f / vH.Z
ARCHIVE_CREATED:
Fri Aug 30 07:32:13.477 2024
ARCHIVE_MODIFIED:
Wed Mar 3 00:46:27.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:27:15.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x53\x67\x41\x41\x41\x42\x70\x7a\x61\x79\x31\x7a\x63\x32\x0a\x67\x74\x5a\x57\x51\x79\x4e\x54\x55\x78"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 137

Aug 30 08:32:22 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshkey\testdata\rsa_1
EXT:
TYPE:
Certificate PEM
SIZE:
887
MD5:
197f14927e89c5c573213416bde709cb
SHA1:
2f5cfafbddd00c351ce72e2f140458fb5ac7b60a
SHA256:
07586a53bef4dd9daf59c473399fca5fcb39891bed0d2c2f8a88249e02392ac5
FIRSTBYTES:
2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA
MODIFIED:
Tue Mar 2 10:31:47.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1779733
ARCHIVE_MD5:
9eb9420cf587edc26f8998ab679ad390
ARCHIVE_SHA1:
72eadcbe313b07b1dd3b693e41d3cd56d354e24e
ARCHIVE_SHA256:
f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbde976db48962e5a7f / vH.Z
ARCHIVE_CREATED:
Fri Aug 30 07:32:13.477 2024
ARCHIVE_MODIFIED:
Wed Mar 3 00:46:27.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:27:15.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x43\x58\x41\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x4c\x56\x35\x6c\x55\x54\x74\x37\x46\x72\x41\x44\x73\x65\x42\x2f\x43\x47\x68\x45\x5a\x7a\x70\x6f\x6f\x6a\x6a\x45\x57\x35\x79\x38\x2b\x65\x50\x76\x4c\x70"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 138

Aug 30 08:32:22 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshkey\testdata\rsa_1_sha1
EXT:
TYPE:
Certificate PEM
SIZE:
887
MD5:
197f14927e89c5c573213416bde709cb
SHA1:
2f5cfafbddd00c351ce72e2f140458fb5ac7b60a
SHA256:
07586a53bef4dd9daf59c473399fca5fcb39891bed0d2c2f8a88249e02392ac5
FIRSTBYTES:
2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA
MODIFIED:
Tue Mar 2 10:31:47.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1779733
ARCHIVE_MD5:
9eb9420cf587edc26f8998ab679ad390
ARCHIVE_SHA1:
72eadcbe313b07b1dd3b693e41d3cd56d354e24e
ARCHIVE_SHA256:
f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbde976db48962e5a7f / vH.Z
ARCHIVE_CREATED:
Fri Aug 30 07:32:13.477 2024
ARCHIVE_MODIFIED:
Wed Mar 3 00:46:27.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:27:15.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x43\x58\x41\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x4c\x56\x35\x6c\x55\x54\x74\x37\x46\x72\x41\x44\x73\x65\x42\x2f\x43\x47\x68\x45\x5a\x7a\x70\x6f\x6f\x6a\x6a\x45\x57\x35\x79\x38\x2b\x65\x50\x76\x4c\x70"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 139

Aug 30 08:32:22 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshkey\testdata\rsa_1_sha512
EXT:
TYPE:
Certificate PEM
SIZE:
887
MD5:
197f14927e89c5c573213416bde709cb
SHA1:
2f5cfafbddd00c351ce72e2f140458fb5ac7b60a
SHA256:
07586a53bef4dd9daf59c473399fca5fcb39891bed0d2c2f8a88249e02392ac5
FIRSTBYTES:
2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA
MODIFIED:
Tue Mar 2 10:31:47.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1779733
ARCHIVE_MD5:
9eb9420cf587edc26f8998ab679ad390
ARCHIVE_SHA1:
72eadcbe313b07b1dd3b693e41d3cd56d354e24e
ARCHIVE_SHA256:
f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbde976db48962e5a7f / vH.Z
ARCHIVE_CREATED:
Fri Aug 30 07:32:13.477 2024
ARCHIVE_MODIFIED:
Wed Mar 3 00:46:27.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:27:15.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x43\x58\x41\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x4c\x56\x35\x6c\x55\x54\x74\x37\x46\x72\x41\x44\x73\x65\x42\x2f\x43\x47\x68\x45\x5a\x7a\x70\x6f\x6f\x6a\x6a\x45\x57\x35\x79\x38\x2b\x65\x50\x76\x4c\x70"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 140

Aug 30 08:32:22 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshkey\testdata\rsa_2
EXT:
TYPE:
Certificate PEM
SIZE:
1679
MD5:
c8860a2d208d222eade1e9866449ccbc
SHA1:
64133ddc79d593e467c864c429e3793c69e4dc22
SHA256:
e42925e663a7215e19cdc89bd9fe018903eeb013f131b188d3c87f0ef01c5a24
FIRSTBYTES:
2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA
MODIFIED:
Tue Mar 2 10:31:47.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1779733
ARCHIVE_MD5:
9eb9420cf587edc26f8998ab679ad390
ARCHIVE_SHA1:
72eadcbe313b07b1dd3b693e41d3cd56d354e24e
ARCHIVE_SHA256:
f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbde976db48962e5a7f / vH.Z
ARCHIVE_CREATED:
Fri Aug 30 07:32:13.477 2024
ARCHIVE_MODIFIED:
Wed Mar 3 00:46:27.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:27:15.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x45\x70\x41\x49\x42\x41\x41\x4b\x43\x41\x51\x45\x41\x39\x4e\x45\x55\x58\x70\x37\x38\x53\x41\x6b\x6d\x4c\x34\x2b\x65\x41\x6a\x34\x6d\x42\x7a\x50\x4f\x6a\x6b\x2b\x63\x63\x43\x50\x56\x7a\x6b\x54\x52\x2b"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 141

Aug 30 08:32:22 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshkey\testdata\rsa_n
EXT:
TYPE:
Certificate PEM
SIZE:
1020
MD5:
d60f55c106077131ba136f02e9b9ba88
SHA1:
d6a3a8961cb40e8a4ff03dbfd5983c9fc5dfeb39
SHA256:
0ad47d17d5f21f350c26c4c94564bf41b6fd28ab55187166b4f46b1b35daed6d
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Tue Mar 2 10:31:47.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1779733
ARCHIVE_MD5:
9eb9420cf587edc26f8998ab679ad390
ARCHIVE_SHA1:
72eadcbe313b07b1dd3b693e41d3cd56d354e24e
ARCHIVE_SHA256:
f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbde976db48962e5a7f / vH.Z
ARCHIVE_CREATED:
Fri Aug 30 07:32:13.477 2024
ARCHIVE_MODIFIED:
Wed Mar 3 00:46:27.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:27:15.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x6c\x77\x41\x41\x41\x41\x64\x7a\x63\x32\x67\x74\x63\x6e\x0a\x4e\x68\x41\x41\x41\x41\x41\x77\x45\x41"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 142

Aug 30 08:32:22 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshsig\testdata\ecdsa
EXT:
TYPE:
Certificate PEM
SIZE:
227
MD5:
53f2aa69e4e8d05ea1c0848c4a946b71
SHA1:
69a4f47fbbb55eb5dea9adea057509384a32bb69
SHA256:
585957bd0a19fcff2d22cd8af7ffb13b68cc30c9dc13dfefb57271b03f3a999f
FIRSTBYTES:
2d2d2d2d2d424547494e20454320505249564154 / -----BEGIN EC PRIVAT
MODIFIED:
Tue Mar 2 10:31:47.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1779733
ARCHIVE_MD5:
9eb9420cf587edc26f8998ab679ad390
ARCHIVE_SHA1:
72eadcbe313b07b1dd3b693e41d3cd56d354e24e
ARCHIVE_SHA256:
f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbde976db48962e5a7f / vH.Z
ARCHIVE_CREATED:
Fri Aug 30 07:32:13.477 2024
ARCHIVE_MODIFIED:
Wed Mar 3 00:46:27.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:27:15.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x48\x63\x43\x41\x51\x45\x45\x49\x46\x67\x30\x5a\x43\x53\x45\x42\x35\x4c\x4e\x65\x4c\x73\x58\x59\x4c\x32\x35\x67\x33\x6b\x71\x45\x57\x73\x71\x68\x35\x32\x44\x52\x2b\x79\x4e\x4f\x6a\x79\x51\x4a\x71\x79"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 143

Aug 30 08:32:22 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshsig\testdata\ecdsa_sk
EXT:
TYPE:
Certificate PEM
SIZE:
837
MD5:
36948c6f96600caa24052b4d8322cbd9
SHA1:
b7bf9e701f8da5d50f61064849d052e04fb77c3f
SHA256:
f81b969ccd3e85f02b71465ba38fb51b5adf6f11b09f2e9e82ed6b2ab31f2356
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Tue Mar 2 10:31:47.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1779733
ARCHIVE_MD5:
9eb9420cf587edc26f8998ab679ad390
ARCHIVE_SHA1:
72eadcbe313b07b1dd3b693e41d3cd56d354e24e
ARCHIVE_SHA256:
f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbde976db48962e5a7f / vH.Z
ARCHIVE_CREATED:
Fri Aug 30 07:32:13.477 2024
ARCHIVE_MODIFIED:
Wed Mar 3 00:46:27.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:27:15.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x66\x77\x41\x41\x41\x43\x4a\x7a\x61\x79\x31\x6c\x59\x32\x0a\x52\x7a\x59\x53\x31\x7a\x61\x47\x45\x79"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 144

Aug 30 08:32:22 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshsig\testdata\ed25519
EXT:
TYPE:
Certificate PEM
SIZE:
411
MD5:
8bb197113a031c8f6d76de369316d0eb
SHA1:
40847760b4f753f2b17156d3f6f9cdcc7c0b91d4
SHA256:
c4683c666d6394fc5e8f3455b5379304979e0b41502560ddef20c824fa9fb66b
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Tue Mar 2 10:31:47.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1779733
ARCHIVE_MD5:
9eb9420cf587edc26f8998ab679ad390
ARCHIVE_SHA1:
72eadcbe313b07b1dd3b693e41d3cd56d354e24e
ARCHIVE_SHA256:
f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbde976db48962e5a7f / vH.Z
ARCHIVE_CREATED:
Fri Aug 30 07:32:13.477 2024
ARCHIVE_MODIFIED:
Wed Mar 3 00:46:27.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:27:15.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 145

Aug 30 08:32:22 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshsig\testdata\ed25519_sk
EXT:
TYPE:
Certificate PEM
SIZE:
484
MD5:
85bc2e18e08c06aa85cf023e7a97a585
SHA1:
95ea85c4709baf47e7cc2573ceac480cc35bde67
SHA256:
0e2221a7c8e8cea4fb6e9d2666b1d05166a3b0f5876c54433f0c35b564f22025
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Tue Mar 2 10:31:47.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1779733
ARCHIVE_MD5:
9eb9420cf587edc26f8998ab679ad390
ARCHIVE_SHA1:
72eadcbe313b07b1dd3b693e41d3cd56d354e24e
ARCHIVE_SHA256:
f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbde976db48962e5a7f / vH.Z
ARCHIVE_CREATED:
Fri Aug 30 07:32:13.477 2024
ARCHIVE_MODIFIED:
Wed Mar 3 00:46:27.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:27:15.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x53\x67\x41\x41\x41\x42\x70\x7a\x61\x79\x31\x7a\x63\x32\x0a\x67\x74\x5a\x57\x51\x79\x4e\x54\x55\x78"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 146

Aug 30 08:32:22 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz\openssh-8.5p1\regress\unittests\sshsig\testdata\rsa
EXT:
TYPE:
Certificate PEM
SIZE:
2455
MD5:
efe804ccdc63abc29233f3a1e11e173b
SHA1:
481c1773197aabc2d9d87336ad84f44410251ed4
SHA256:
d7eb37f534b846bb582bcdcf78232bdb33932e34fb72d6bfa130a8fd699b10b6
FIRSTBYTES:
2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA
MODIFIED:
Tue Mar 2 10:31:47.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1779733
ARCHIVE_MD5:
9eb9420cf587edc26f8998ab679ad390
ARCHIVE_SHA1:
72eadcbe313b07b1dd3b693e41d3cd56d354e24e
ARCHIVE_SHA256:
f52f3f41d429aa9918e38cf200af225ccdd8e66f052da572870c89737646ec25
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbde976db48962e5a7f / vH.Z
ARCHIVE_CREATED:
Fri Aug 30 07:32:13.477 2024
ARCHIVE_MODIFIED:
Wed Mar 3 00:46:27.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:27:15.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x47\x34\x77\x49\x42\x41\x41\x4b\x43\x41\x59\x45\x41\x33\x38\x36\x6c\x6d\x6a\x52\x48\x74\x4a\x70\x79\x6a\x38\x37\x42\x72\x53\x2b\x73\x73\x4d\x6d\x74\x76\x63\x2f\x31\x53\x50\x4e\x30\x67\x58\x54\x50\x73"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 147

Aug 30 08:32:24 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\ed25519_openssh.prv
EXT:
.prv
TYPE:
Certificate PEM
SIZE:
419
MD5:
c1d6034878b590c80805ad1e66039091
SHA1:
9127798b0fadd4539c81ee4f294287e8262eddb0
SHA256:
11bab46497954bd367ea5c2541cb3bad4814515481aee687fcdddc5680ee642d
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Sun Sep 26 14:03:19.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1815060
ARCHIVE_MD5:
8ce5f390958baeeab635aafd0ef41453
ARCHIVE_SHA1:
1eb964897a4372f6fb96c7effeb509ec71c379c9
ARCHIVE_SHA256:
4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbdeb76db46b62eda7f / vF.
ARCHIVE_CREATED:
Fri Aug 30 07:32:13.502 2024
ARCHIVE_MODIFIED:
Sun Sep 26 14:39:51.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:26:04.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 148

Aug 30 08:32:24 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\misc\fuzz-harness\testdata\id_dsa
EXT:
TYPE:
Certificate PEM
SIZE:
1361
MD5:
a9521c2825fbf778b6b82b1dcda95d72
SHA1:
29bc6d9b491473450487aad65a659675154b8fb8
SHA256:
a6fa247970fe3fe15b9647e9ae301495d10ea278dbe9516abdf70e69b1849744
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Sun Sep 26 14:03:19.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1815060
ARCHIVE_MD5:
8ce5f390958baeeab635aafd0ef41453
ARCHIVE_SHA1:
1eb964897a4372f6fb96c7effeb509ec71c379c9
ARCHIVE_SHA256:
4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbdeb76db46b62eda7f / vF.
ARCHIVE_CREATED:
Fri Aug 30 07:32:13.502 2024
ARCHIVE_MODIFIED:
Sun Sep 26 14:39:51.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:26:04.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x42\x73\x67\x41\x41\x41\x41\x64\x7a\x63\x32\x67\x74\x5a\x48\x0a\x4e\x7a\x41\x41\x41\x41\x67\x51\x43\x73"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 149

Aug 30 08:32:24 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\misc\fuzz-harness\testdata\id_ecdsa
EXT:
TYPE:
Certificate PEM
SIZE:
492
MD5:
b14d14c4a2eb3a89c43be1d828fe2604
SHA1:
56c94a39972cc4c2ab982f6b206702cf3b558bde
SHA256:
00120fd3e06a2c9a2debabe94c75cb9a8fb313d17b3a114dda6264874ae56c60
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Sun Sep 26 14:03:19.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1815060
ARCHIVE_MD5:
8ce5f390958baeeab635aafd0ef41453
ARCHIVE_SHA1:
1eb964897a4372f6fb96c7effeb509ec71c379c9
ARCHIVE_SHA256:
4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbdeb76db46b62eda7f / vF.
ARCHIVE_CREATED:
Fri Aug 30 07:32:13.502 2024
ARCHIVE_MODIFIED:
Sun Sep 26 14:39:51.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:26:04.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x61\x41\x41\x41\x41\x42\x4e\x6c\x59\x32\x52\x7a\x59\x53\x0a\x31\x7a\x61\x47\x45\x79\x4c\x57\x35\x70"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 150

Aug 30 08:32:24 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\misc\fuzz-harness\testdata\id_ecdsa_sk
EXT:
TYPE:
Certificate PEM
SIZE:
858
MD5:
c87bc24fa8b257e7af7374511f44d2c5
SHA1:
2c1d6e64ad0052837b53739841f6acfc60a191ed
SHA256:
50e6649901ffdf7bc4d85dd0f45937b9d99bdd85e472c112f8586bd3e35beb58
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Sun Sep 26 14:03:19.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1815060
ARCHIVE_MD5:
8ce5f390958baeeab635aafd0ef41453
ARCHIVE_SHA1:
1eb964897a4372f6fb96c7effeb509ec71c379c9
ARCHIVE_SHA256:
4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbdeb76db46b62eda7f / vF.
ARCHIVE_CREATED:
Fri Aug 30 07:32:13.502 2024
ARCHIVE_MODIFIED:
Sun Sep 26 14:39:51.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:26:04.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x66\x77\x41\x41\x41\x43\x4a\x7a\x61\x79\x31\x6c\x59\x32\x0a\x52\x7a\x59\x53\x31\x7a\x61\x47\x45\x79"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 151

Aug 30 08:32:24 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\misc\fuzz-harness\testdata\id_ed25519
EXT:
TYPE:
Certificate PEM
SIZE:
387
MD5:
904e0a369a7fbe86bcb4e0bc1363c539
SHA1:
1074da4383390925d414ad562a0818a88e116208
SHA256:
6efecdbb70364afc9cf004e325a9a1d2673d86e85a6238e1126d6d105cea56c1
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Sun Sep 26 14:03:19.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1815060
ARCHIVE_MD5:
8ce5f390958baeeab635aafd0ef41453
ARCHIVE_SHA1:
1eb964897a4372f6fb96c7effeb509ec71c379c9
ARCHIVE_SHA256:
4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbdeb76db46b62eda7f / vF.
ARCHIVE_CREATED:
Fri Aug 30 07:32:13.502 2024
ARCHIVE_MODIFIED:
Sun Sep 26 14:39:51.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:26:04.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 152

Aug 30 08:32:24 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\misc\fuzz-harness\testdata\id_ed25519_sk
EXT:
TYPE:
Certificate PEM
SIZE:
496
MD5:
c3c7cad31e9edf76f806848501011568
SHA1:
f936a6c0f3b1250ef7fd0cbf4ea5a5d3c9c63507
SHA256:
5fd315701b14a13467331e1d0819a8016abdf5888ab695f068fce488bd37169d
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Sun Sep 26 14:03:19.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1815060
ARCHIVE_MD5:
8ce5f390958baeeab635aafd0ef41453
ARCHIVE_SHA1:
1eb964897a4372f6fb96c7effeb509ec71c379c9
ARCHIVE_SHA256:
4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbdeb76db46b62eda7f / vF.
ARCHIVE_CREATED:
Fri Aug 30 07:32:13.502 2024
ARCHIVE_MODIFIED:
Sun Sep 26 14:39:51.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:26:04.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x53\x67\x41\x41\x41\x42\x70\x7a\x61\x79\x31\x7a\x63\x32\x0a\x67\x74\x5a\x57\x51\x79\x4e\x54\x55\x78"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 153

Aug 30 08:32:24 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\misc\fuzz-harness\testdata\id_rsa
EXT:
TYPE:
Certificate PEM
SIZE:
1799
MD5:
0e4d9d0e310d6dc6a5c2d33660f70542
SHA1:
7bef427ad9067a465009d543787063fdaceef3e5
SHA256:
83822e39fb2ee059431a45c3c48cffcda3fb869273a364a45898ce9abad09e84
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Sun Sep 26 14:03:19.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1815060
ARCHIVE_MD5:
8ce5f390958baeeab635aafd0ef41453
ARCHIVE_SHA1:
1eb964897a4372f6fb96c7effeb509ec71c379c9
ARCHIVE_SHA256:
4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbdeb76db46b62eda7f / vF.
ARCHIVE_CREATED:
Fri Aug 30 07:32:13.502 2024
ARCHIVE_MODIFIED:
Sun Sep 26 14:39:51.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:26:04.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x42\x46\x77\x41\x41\x41\x41\x64\x7a\x63\x32\x67\x74\x63\x6e\x0a\x4e\x68\x41\x41\x41\x41\x41\x77\x45\x41"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 154

Aug 30 08:32:24 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\rsa_openssh.prv
EXT:
.prv
TYPE:
Certificate PEM
SIZE:
883
MD5:
a6b110f820948e73bbde7b948744b3c5
SHA1:
614e6d353be614ded246a12ed6e14af20f063710
SHA256:
79b8783d0b10a3f65b9b3e349a1daa692cc27be08028131ff5a9a08799035f46
FIRSTBYTES:
2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA
MODIFIED:
Sun Sep 26 14:03:19.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1815060
ARCHIVE_MD5:
8ce5f390958baeeab635aafd0ef41453
ARCHIVE_SHA1:
1eb964897a4372f6fb96c7effeb509ec71c379c9
ARCHIVE_SHA256:
4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbdeb76db46b62eda7f / vF.
ARCHIVE_CREATED:
Fri Aug 30 07:32:13.502 2024
ARCHIVE_MODIFIED:
Sun Sep 26 14:39:51.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:26:04.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x43\x57\x67\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x73\x69\x6c\x77\x4b\x63\x61\x4b\x4e\x36\x77\x53\x4d\x4e\x64\x31\x57\x67\x51\x39\x2b\x48\x52\x71\x51\x45\x6b\x44\x30\x6b\x43\x54\x56\x74\x74\x72\x61\x7a"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 155

Aug 30 08:32:25 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshkey\testdata\dsa_1
EXT:
TYPE:
Certificate PEM
SIZE:
672
MD5:
aebcad00ac7fb84f1a7de01322c99be3
SHA1:
a9a0e1cf84bee8c27802295819b399833e5d4d08
SHA256:
b7f7c2bb695b28e585951a2da4ad2d6c933c440afe118798c6e2363e17da2b93
FIRSTBYTES:
2d2d2d2d2d424547494e20445341205052495641 / -----BEGIN DSA PRIVA
MODIFIED:
Sun Sep 26 14:03:19.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1815060
ARCHIVE_MD5:
8ce5f390958baeeab635aafd0ef41453
ARCHIVE_SHA1:
1eb964897a4372f6fb96c7effeb509ec71c379c9
ARCHIVE_SHA256:
4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbdeb76db46b62eda7f / vF.
ARCHIVE_CREATED:
Fri Aug 30 07:32:13.502 2024
ARCHIVE_MODIFIED:
Sun Sep 26 14:39:51.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:26:04.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x44\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x42\x76\x41\x49\x42\x41\x41\x4b\x42\x67\x51" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x44\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x42\x76\x41\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x36\x6b\x75\x74\x4e\x46\x52\x73\x48\x54\x77\x45\x41\x76\x36\x64\x33\x39\x4c\x68\x73\x71\x79\x31\x61\x70\x64\x48\x42\x5a\x39\x63\x32\x48\x66\x79\x52\x72\x37\x57\x6d\x79\x70\x79\x47\x49\x79\x32\x6d"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 156

Aug 30 08:32:25 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshkey\testdata\dsa_n
EXT:
TYPE:
Certificate PEM
SIZE:
1361
MD5:
6fcf088f9850b2f2213186cee4dc4811
SHA1:
a04d604886c6a7c2217df9b7eea5c998da91d561
SHA256:
db691de6aa454ec8aa45c84c58022a54611427f6f44c20d152ac05e0ea2284ba
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Sun Sep 26 14:03:19.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1815060
ARCHIVE_MD5:
8ce5f390958baeeab635aafd0ef41453
ARCHIVE_SHA1:
1eb964897a4372f6fb96c7effeb509ec71c379c9
ARCHIVE_SHA256:
4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbdeb76db46b62eda7f / vF.
ARCHIVE_CREATED:
Fri Aug 30 07:32:13.502 2024
ARCHIVE_MODIFIED:
Sun Sep 26 14:39:51.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:26:04.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x42\x73\x77\x41\x41\x41\x41\x64\x7a\x63\x32\x67\x74\x5a\x48\x0a\x4e\x7a\x41\x41\x41\x41\x67\x51\x44\x36"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 157

Aug 30 08:32:25 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshkey\testdata\ecdsa_1
EXT:
TYPE:
Certificate PEM
SIZE:
227
MD5:
610b43e1fd8e09f2794aba398c6950eb
SHA1:
c7e5b5ff84b30ff8880e4d75942a600d012516b6
SHA256:
42a90746ef5975c6ef98c6d56305dad0bc698a1b05c83518bc90584c83935d5c
FIRSTBYTES:
2d2d2d2d2d424547494e20454320505249564154 / -----BEGIN EC PRIVAT
MODIFIED:
Sun Sep 26 14:03:19.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1815060
ARCHIVE_MD5:
8ce5f390958baeeab635aafd0ef41453
ARCHIVE_SHA1:
1eb964897a4372f6fb96c7effeb509ec71c379c9
ARCHIVE_SHA256:
4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbdeb76db46b62eda7f / vF.
ARCHIVE_CREATED:
Fri Aug 30 07:32:13.502 2024
ARCHIVE_MODIFIED:
Sun Sep 26 14:39:51.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:26:04.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x48\x63\x43\x41\x51\x45\x45\x49\x50\x50\x4e\x79\x55\x41\x6e\x6a\x76\x46\x72\x2b\x65\x54\x2f\x37\x74\x2f\x49\x79\x6a\x75\x51\x51\x64\x2f\x61\x4c\x46\x69\x54\x59\x39\x32\x4c\x42\x39\x67\x49\x6a\x79\x72"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 158

Aug 30 08:32:25 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshkey\testdata\ecdsa_2
EXT:
TYPE:
Certificate PEM
SIZE:
365
MD5:
0346ad9a21f23d98cb3abe4845df078d
SHA1:
07091af93e22c676e03e6f96e9d0e53c9b53d775
SHA256:
320396e36bd5ecc12089f26849f8e7b6e0ab3c037f0492dee978cef6646d5826
FIRSTBYTES:
2d2d2d2d2d424547494e20454320505249564154 / -----BEGIN EC PRIVAT
MODIFIED:
Sun Sep 26 14:03:19.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1815060
ARCHIVE_MD5:
8ce5f390958baeeab635aafd0ef41453
ARCHIVE_SHA1:
1eb964897a4372f6fb96c7effeb509ec71c379c9
ARCHIVE_SHA256:
4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbdeb76db46b62eda7f / vF.
ARCHIVE_CREATED:
Fri Aug 30 07:32:13.502 2024
ARCHIVE_MODIFIED:
Sun Sep 26 14:39:51.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:26:04.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x48\x63\x41\x67\x45\x42\x42\x45\x49\x42\x71\x42\x74\x4e\x37\x65\x36\x45\x73\x73\x64\x33\x64\x6c\x73\x67\x49\x53\x56\x69\x50\x43\x58\x58\x43\x30\x61\x74\x6c\x4e\x6b\x47\x74\x6f\x4d\x67\x53\x51\x64"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 159

Aug 30 08:32:25 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshkey\testdata\ecdsa_n
EXT:
TYPE:
Certificate PEM
SIZE:
492
MD5:
0ffc5b7197ecb4b69f503d4f3cc24c8c
SHA1:
c2c7fd9527d9cc84781346a3ac8e2100d4d20ad3
SHA256:
1cccaa23aca49238099494fc7b49b550311719c9ac6bb138797e1077f4d7973d
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Sun Sep 26 14:03:19.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1815060
ARCHIVE_MD5:
8ce5f390958baeeab635aafd0ef41453
ARCHIVE_SHA1:
1eb964897a4372f6fb96c7effeb509ec71c379c9
ARCHIVE_SHA256:
4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbdeb76db46b62eda7f / vF.
ARCHIVE_CREATED:
Fri Aug 30 07:32:13.502 2024
ARCHIVE_MODIFIED:
Sun Sep 26 14:39:51.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:26:04.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x61\x41\x41\x41\x41\x42\x4e\x6c\x59\x32\x52\x7a\x59\x53\x0a\x31\x7a\x61\x47\x45\x79\x4c\x57\x35\x70"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 160

Aug 30 08:32:25 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshkey\testdata\ecdsa_sk1
EXT:
TYPE:
Certificate PEM
SIZE:
849
MD5:
97206cfa158fdda5a45c6eb542f739c0
SHA1:
e55ec614db8cea92d7269d5f903cf72baca36454
SHA256:
e4df7ea4ca133a7457069be073203c556166c65635ed6fb6c12b9a84f027346e
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Sun Sep 26 14:03:19.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1815060
ARCHIVE_MD5:
8ce5f390958baeeab635aafd0ef41453
ARCHIVE_SHA1:
1eb964897a4372f6fb96c7effeb509ec71c379c9
ARCHIVE_SHA256:
4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbdeb76db46b62eda7f / vF.
ARCHIVE_CREATED:
Fri Aug 30 07:32:13.502 2024
ARCHIVE_MODIFIED:
Sun Sep 26 14:39:51.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:26:04.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x66\x77\x41\x41\x41\x43\x4a\x7a\x61\x79\x31\x6c\x59\x32\x0a\x52\x7a\x59\x53\x31\x7a\x61\x47\x45\x79"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 161

Aug 30 08:32:25 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshkey\testdata\ecdsa_sk2
EXT:
TYPE:
Certificate PEM
SIZE:
849
MD5:
14ecb7595ee296b15d413ae395454a4c
SHA1:
909379299593aeebc79f44df0ec22578123acce7
SHA256:
de6f60d862f799ca088bd4611865e24bb0635d81097bb9496f0178aefa4acbae
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Sun Sep 26 14:03:19.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1815060
ARCHIVE_MD5:
8ce5f390958baeeab635aafd0ef41453
ARCHIVE_SHA1:
1eb964897a4372f6fb96c7effeb509ec71c379c9
ARCHIVE_SHA256:
4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbdeb76db46b62eda7f / vF.
ARCHIVE_CREATED:
Fri Aug 30 07:32:13.502 2024
ARCHIVE_MODIFIED:
Sun Sep 26 14:39:51.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:26:04.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x66\x77\x41\x41\x41\x43\x4a\x7a\x61\x79\x31\x6c\x59\x32\x0a\x52\x7a\x59\x53\x31\x7a\x61\x47\x45\x79"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 162

Aug 30 08:32:25 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshkey\testdata\ed25519_1
EXT:
TYPE:
Certificate PEM
SIZE:
411
MD5:
514e8e39c48edb2b8934ef78a5030042
SHA1:
a7a368a6f3d09bc2cfc1315f6e0899bde0574ffd
SHA256:
74f95c1990e3512af471cf6fb58d08a8078bbab597e7ee86a7ccd233f6855fd1
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Sun Sep 26 14:03:19.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1815060
ARCHIVE_MD5:
8ce5f390958baeeab635aafd0ef41453
ARCHIVE_SHA1:
1eb964897a4372f6fb96c7effeb509ec71c379c9
ARCHIVE_SHA256:
4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbdeb76db46b62eda7f / vF.
ARCHIVE_CREATED:
Fri Aug 30 07:32:13.502 2024
ARCHIVE_MODIFIED:
Sun Sep 26 14:39:51.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:26:04.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 163

Aug 30 08:32:25 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshkey\testdata\ed25519_2
EXT:
TYPE:
Certificate PEM
SIZE:
411
MD5:
bfc2ac8495dbc6070241303ec50a6dc2
SHA1:
53e388e7c836c6ba874e852d71a6e1e708611d25
SHA256:
31689f4706b3bdad29ee21b05af62e9f2257399d07092089944514ed5edb131d
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Sun Sep 26 14:03:19.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1815060
ARCHIVE_MD5:
8ce5f390958baeeab635aafd0ef41453
ARCHIVE_SHA1:
1eb964897a4372f6fb96c7effeb509ec71c379c9
ARCHIVE_SHA256:
4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbdeb76db46b62eda7f / vF.
ARCHIVE_CREATED:
Fri Aug 30 07:32:13.502 2024
ARCHIVE_MODIFIED:
Sun Sep 26 14:39:51.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:26:04.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 164

Aug 30 08:32:25 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshkey\testdata\ed25519_sk1
EXT:
TYPE:
Certificate PEM
SIZE:
484
MD5:
ab9dcdbff00763217a3f85069a9c2f67
SHA1:
05396ad046c37370093f48c0bdb2510b8894aa76
SHA256:
45c058d08280c4ca36a9d020478504cd550e7c5752c207d182363c3edf669ce8
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Sun Sep 26 14:03:19.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1815060
ARCHIVE_MD5:
8ce5f390958baeeab635aafd0ef41453
ARCHIVE_SHA1:
1eb964897a4372f6fb96c7effeb509ec71c379c9
ARCHIVE_SHA256:
4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbdeb76db46b62eda7f / vF.
ARCHIVE_CREATED:
Fri Aug 30 07:32:13.502 2024
ARCHIVE_MODIFIED:
Sun Sep 26 14:39:51.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:26:04.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x53\x67\x41\x41\x41\x42\x70\x7a\x61\x79\x31\x7a\x63\x32\x0a\x67\x74\x5a\x57\x51\x79\x4e\x54\x55\x78"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 165

Aug 30 08:32:25 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshkey\testdata\ed25519_sk2
EXT:
TYPE:
Certificate PEM
SIZE:
484
MD5:
8a666562de41f71d57d47c5f6404293a
SHA1:
069c9341d4b0cd94669ff23feab92853b6a42540
SHA256:
b862e169114ee63ae5e8497110075a9e67c4e3f24bad01e7c06951d268a3ec0f
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Sun Sep 26 14:03:19.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1815060
ARCHIVE_MD5:
8ce5f390958baeeab635aafd0ef41453
ARCHIVE_SHA1:
1eb964897a4372f6fb96c7effeb509ec71c379c9
ARCHIVE_SHA256:
4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbdeb76db46b62eda7f / vF.
ARCHIVE_CREATED:
Fri Aug 30 07:32:13.502 2024
ARCHIVE_MODIFIED:
Sun Sep 26 14:39:51.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:26:04.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x53\x67\x41\x41\x41\x42\x70\x7a\x61\x79\x31\x7a\x63\x32\x0a\x67\x74\x5a\x57\x51\x79\x4e\x54\x55\x78"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 166

Aug 30 08:32:25 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshkey\testdata\rsa_1
EXT:
TYPE:
Certificate PEM
SIZE:
887
MD5:
197f14927e89c5c573213416bde709cb
SHA1:
2f5cfafbddd00c351ce72e2f140458fb5ac7b60a
SHA256:
07586a53bef4dd9daf59c473399fca5fcb39891bed0d2c2f8a88249e02392ac5
FIRSTBYTES:
2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA
MODIFIED:
Sun Sep 26 14:03:19.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1815060
ARCHIVE_MD5:
8ce5f390958baeeab635aafd0ef41453
ARCHIVE_SHA1:
1eb964897a4372f6fb96c7effeb509ec71c379c9
ARCHIVE_SHA256:
4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbdeb76db46b62eda7f / vF.
ARCHIVE_CREATED:
Fri Aug 30 07:32:13.502 2024
ARCHIVE_MODIFIED:
Sun Sep 26 14:39:51.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:26:04.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x43\x58\x41\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x4c\x56\x35\x6c\x55\x54\x74\x37\x46\x72\x41\x44\x73\x65\x42\x2f\x43\x47\x68\x45\x5a\x7a\x70\x6f\x6f\x6a\x6a\x45\x57\x35\x79\x38\x2b\x65\x50\x76\x4c\x70"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 167

Aug 30 08:32:25 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshkey\testdata\rsa_1_sha1
EXT:
TYPE:
Certificate PEM
SIZE:
887
MD5:
197f14927e89c5c573213416bde709cb
SHA1:
2f5cfafbddd00c351ce72e2f140458fb5ac7b60a
SHA256:
07586a53bef4dd9daf59c473399fca5fcb39891bed0d2c2f8a88249e02392ac5
FIRSTBYTES:
2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA
MODIFIED:
Sun Sep 26 14:03:19.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1815060
ARCHIVE_MD5:
8ce5f390958baeeab635aafd0ef41453
ARCHIVE_SHA1:
1eb964897a4372f6fb96c7effeb509ec71c379c9
ARCHIVE_SHA256:
4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbdeb76db46b62eda7f / vF.
ARCHIVE_CREATED:
Fri Aug 30 07:32:13.502 2024
ARCHIVE_MODIFIED:
Sun Sep 26 14:39:51.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:26:04.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x43\x58\x41\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x4c\x56\x35\x6c\x55\x54\x74\x37\x46\x72\x41\x44\x73\x65\x42\x2f\x43\x47\x68\x45\x5a\x7a\x70\x6f\x6f\x6a\x6a\x45\x57\x35\x79\x38\x2b\x65\x50\x76\x4c\x70"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 168

Aug 30 08:32:25 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshkey\testdata\rsa_1_sha512
EXT:
TYPE:
Certificate PEM
SIZE:
887
MD5:
197f14927e89c5c573213416bde709cb
SHA1:
2f5cfafbddd00c351ce72e2f140458fb5ac7b60a
SHA256:
07586a53bef4dd9daf59c473399fca5fcb39891bed0d2c2f8a88249e02392ac5
FIRSTBYTES:
2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA
MODIFIED:
Sun Sep 26 14:03:19.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1815060
ARCHIVE_MD5:
8ce5f390958baeeab635aafd0ef41453
ARCHIVE_SHA1:
1eb964897a4372f6fb96c7effeb509ec71c379c9
ARCHIVE_SHA256:
4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbdeb76db46b62eda7f / vF.
ARCHIVE_CREATED:
Fri Aug 30 07:32:13.502 2024
ARCHIVE_MODIFIED:
Sun Sep 26 14:39:51.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:26:04.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x43\x58\x41\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x4c\x56\x35\x6c\x55\x54\x74\x37\x46\x72\x41\x44\x73\x65\x42\x2f\x43\x47\x68\x45\x5a\x7a\x70\x6f\x6f\x6a\x6a\x45\x57\x35\x79\x38\x2b\x65\x50\x76\x4c\x70"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 169

Aug 30 08:32:25 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshkey\testdata\rsa_2
EXT:
TYPE:
Certificate PEM
SIZE:
1679
MD5:
c8860a2d208d222eade1e9866449ccbc
SHA1:
64133ddc79d593e467c864c429e3793c69e4dc22
SHA256:
e42925e663a7215e19cdc89bd9fe018903eeb013f131b188d3c87f0ef01c5a24
FIRSTBYTES:
2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA
MODIFIED:
Sun Sep 26 14:03:19.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1815060
ARCHIVE_MD5:
8ce5f390958baeeab635aafd0ef41453
ARCHIVE_SHA1:
1eb964897a4372f6fb96c7effeb509ec71c379c9
ARCHIVE_SHA256:
4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbdeb76db46b62eda7f / vF.
ARCHIVE_CREATED:
Fri Aug 30 07:32:13.502 2024
ARCHIVE_MODIFIED:
Sun Sep 26 14:39:51.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:26:04.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x45\x70\x41\x49\x42\x41\x41\x4b\x43\x41\x51\x45\x41\x39\x4e\x45\x55\x58\x70\x37\x38\x53\x41\x6b\x6d\x4c\x34\x2b\x65\x41\x6a\x34\x6d\x42\x7a\x50\x4f\x6a\x6b\x2b\x63\x63\x43\x50\x56\x7a\x6b\x54\x52\x2b"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 170

Aug 30 08:32:25 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshkey\testdata\rsa_n
EXT:
TYPE:
Certificate PEM
SIZE:
1020
MD5:
d60f55c106077131ba136f02e9b9ba88
SHA1:
d6a3a8961cb40e8a4ff03dbfd5983c9fc5dfeb39
SHA256:
0ad47d17d5f21f350c26c4c94564bf41b6fd28ab55187166b4f46b1b35daed6d
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Sun Sep 26 14:03:19.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1815060
ARCHIVE_MD5:
8ce5f390958baeeab635aafd0ef41453
ARCHIVE_SHA1:
1eb964897a4372f6fb96c7effeb509ec71c379c9
ARCHIVE_SHA256:
4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbdeb76db46b62eda7f / vF.
ARCHIVE_CREATED:
Fri Aug 30 07:32:13.502 2024
ARCHIVE_MODIFIED:
Sun Sep 26 14:39:51.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:26:04.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x6c\x77\x41\x41\x41\x41\x64\x7a\x63\x32\x67\x74\x63\x6e\x0a\x4e\x68\x41\x41\x41\x41\x41\x77\x45\x41"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 171

Aug 30 08:32:25 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshsig\testdata\ecdsa
EXT:
TYPE:
Certificate PEM
SIZE:
227
MD5:
53f2aa69e4e8d05ea1c0848c4a946b71
SHA1:
69a4f47fbbb55eb5dea9adea057509384a32bb69
SHA256:
585957bd0a19fcff2d22cd8af7ffb13b68cc30c9dc13dfefb57271b03f3a999f
FIRSTBYTES:
2d2d2d2d2d424547494e20454320505249564154 / -----BEGIN EC PRIVAT
MODIFIED:
Sun Sep 26 14:03:19.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1815060
ARCHIVE_MD5:
8ce5f390958baeeab635aafd0ef41453
ARCHIVE_SHA1:
1eb964897a4372f6fb96c7effeb509ec71c379c9
ARCHIVE_SHA256:
4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbdeb76db46b62eda7f / vF.
ARCHIVE_CREATED:
Fri Aug 30 07:32:13.502 2024
ARCHIVE_MODIFIED:
Sun Sep 26 14:39:51.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:26:04.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x48\x63\x43\x41\x51\x45\x45\x49\x46\x67\x30\x5a\x43\x53\x45\x42\x35\x4c\x4e\x65\x4c\x73\x58\x59\x4c\x32\x35\x67\x33\x6b\x71\x45\x57\x73\x71\x68\x35\x32\x44\x52\x2b\x79\x4e\x4f\x6a\x79\x51\x4a\x71\x79"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 172

Aug 30 08:32:25 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshsig\testdata\ecdsa_sk
EXT:
TYPE:
Certificate PEM
SIZE:
837
MD5:
36948c6f96600caa24052b4d8322cbd9
SHA1:
b7bf9e701f8da5d50f61064849d052e04fb77c3f
SHA256:
f81b969ccd3e85f02b71465ba38fb51b5adf6f11b09f2e9e82ed6b2ab31f2356
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Sun Sep 26 14:03:19.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1815060
ARCHIVE_MD5:
8ce5f390958baeeab635aafd0ef41453
ARCHIVE_SHA1:
1eb964897a4372f6fb96c7effeb509ec71c379c9
ARCHIVE_SHA256:
4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbdeb76db46b62eda7f / vF.
ARCHIVE_CREATED:
Fri Aug 30 07:32:13.502 2024
ARCHIVE_MODIFIED:
Sun Sep 26 14:39:51.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:26:04.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x66\x77\x41\x41\x41\x43\x4a\x7a\x61\x79\x31\x6c\x59\x32\x0a\x52\x7a\x59\x53\x31\x7a\x61\x47\x45\x79"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 173

Aug 30 08:32:25 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshsig\testdata\ed25519
EXT:
TYPE:
Certificate PEM
SIZE:
411
MD5:
8bb197113a031c8f6d76de369316d0eb
SHA1:
40847760b4f753f2b17156d3f6f9cdcc7c0b91d4
SHA256:
c4683c666d6394fc5e8f3455b5379304979e0b41502560ddef20c824fa9fb66b
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Sun Sep 26 14:03:19.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1815060
ARCHIVE_MD5:
8ce5f390958baeeab635aafd0ef41453
ARCHIVE_SHA1:
1eb964897a4372f6fb96c7effeb509ec71c379c9
ARCHIVE_SHA256:
4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbdeb76db46b62eda7f / vF.
ARCHIVE_CREATED:
Fri Aug 30 07:32:13.502 2024
ARCHIVE_MODIFIED:
Sun Sep 26 14:39:51.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:26:04.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 174

Aug 30 08:32:25 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshsig\testdata\ed25519_sk
EXT:
TYPE:
Certificate PEM
SIZE:
484
MD5:
85bc2e18e08c06aa85cf023e7a97a585
SHA1:
95ea85c4709baf47e7cc2573ceac480cc35bde67
SHA256:
0e2221a7c8e8cea4fb6e9d2666b1d05166a3b0f5876c54433f0c35b564f22025
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
MODIFIED:
Sun Sep 26 14:03:19.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1815060
ARCHIVE_MD5:
8ce5f390958baeeab635aafd0ef41453
ARCHIVE_SHA1:
1eb964897a4372f6fb96c7effeb509ec71c379c9
ARCHIVE_SHA256:
4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbdeb76db46b62eda7f / vF.
ARCHIVE_CREATED:
Fri Aug 30 07:32:13.502 2024
ARCHIVE_MODIFIED:
Sun Sep 26 14:39:51.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:26:04.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x53\x67\x41\x41\x41\x42\x70\x7a\x61\x79\x31\x7a\x63\x32\x0a\x67\x74\x5a\x57\x51\x79\x4e\x54\x55\x78"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 175

Aug 30 08:32:25 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz\openssh-8.8p1\regress\unittests\sshsig\testdata\rsa
EXT:
TYPE:
Certificate PEM
SIZE:
2455
MD5:
efe804ccdc63abc29233f3a1e11e173b
SHA1:
481c1773197aabc2d9d87336ad84f44410251ed4
SHA256:
d7eb37f534b846bb582bcdcf78232bdb33932e34fb72d6bfa130a8fd699b10b6
FIRSTBYTES:
2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA
MODIFIED:
Sun Sep 26 14:03:19.000 2021
PERMISSIONS:
ARCHIVE_FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1.tar.gz
ARCHIVE_TYPE:
GZIP
ARCHIVE_SIZE:
1815060
ARCHIVE_MD5:
8ce5f390958baeeab635aafd0ef41453
ARCHIVE_SHA1:
1eb964897a4372f6fb96c7effeb509ec71c379c9
ARCHIVE_SHA256:
4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9
ARCHIVE_FIRSTBYTES:
1f8b0800000000000003ecbdeb76db46b62eda7f / vF.
ARCHIVE_CREATED:
Fri Aug 30 07:32:13.502 2024
ARCHIVE_MODIFIED:
Sun Sep 26 14:39:51.000 2021
ARCHIVE_ACCESSED:
Tue May 14 16:26:04.000 2024
ARCHIVE_PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
ARCHIVE_OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x47\x34\x77\x49\x42\x41\x41\x4b\x43\x41\x59\x45\x41\x33\x38\x36\x6c\x6d\x6a\x52\x48\x74\x4a\x70\x79\x6a\x38\x37\x42\x72\x53\x2b\x73\x73\x4d\x6d\x74\x76\x63\x2f\x31\x53\x50\x4e\x30\x67\x58\x54\x50\x73"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 176

Aug 30 08:32:26 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
40
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\smtp.pcap
EXT:
.pcap
TYPE:
WINPCAP
SIZE:
28256
MD5:
8e435e4a69aa549f04f2d04073ab3061
SHA1:
874b25c64a8fdb78a2ece4be8b0520299e74122d
SHA256:
50852b1041256763e9233e88c18d1ec3505820bc3df4d3045f87ee2ef7a89fe2
FIRSTBYTES:
d4c3b2a102000400000000000000000000000400 / ò
CREATED:
Fri Aug 30 07:32:13.607 2024
MODIFIED:
Thu Feb 11 15:04:38.000 2021
ACCESSED:
Tue May 14 16:15:54.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule SUSP_WinPCap_Nov21 / WinPCap file found
SUBSCORE_1:
40
REF_1:
Internal Research
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- (none)

RULEDATE_1:
2021-11-12
TAGS_1:
EXTVAR, FILE, METARULE, SUSP
RULENAME_1:
SUSP_WinPCap_Nov21
AUTHOR_1:
Max Altgelt
REASONS_COUNT:
1

Notice 177

Aug 30 08:34:23 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1\regress\rsa_openssh.prv
EXT:
.prv
TYPE:
Certificate PEM
SIZE:
883
MD5:
a6b110f820948e73bbde7b948744b3c5
SHA1:
614e6d353be614ded246a12ed6e14af20f063710
SHA256:
79b8783d0b10a3f65b9b3e349a1daa692cc27be08028131ff5a9a08799035f46
FIRSTBYTES:
2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA
CREATED:
Fri Aug 30 07:33:06.031 2024
MODIFIED:
Tue Mar 2 10:31:47.000 2021
ACCESSED:
Tue May 14 16:23:57.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x43\x57\x67\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x73\x69\x6c\x77\x4b\x63\x61\x4b\x4e\x36\x77\x53\x4d\x4e\x64\x31\x57\x67\x51\x39\x2b\x48\x52\x71\x51\x45\x6b\x44\x30\x6b\x43\x54\x56\x74\x74\x72\x61\x7a"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 178

Aug 30 08:34:23 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1\regress\misc\fuzz-harness\testdata\id_dsa
EXT:
TYPE:
Certificate PEM
SIZE:
1361
MD5:
a9521c2825fbf778b6b82b1dcda95d72
SHA1:
29bc6d9b491473450487aad65a659675154b8fb8
SHA256:
a6fa247970fe3fe15b9647e9ae301495d10ea278dbe9516abdf70e69b1849744
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Fri Aug 30 07:33:06.014 2024
MODIFIED:
Tue Mar 2 10:31:47.000 2021
ACCESSED:
Tue May 14 16:19:37.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x42\x73\x67\x41\x41\x41\x41\x64\x7a\x63\x32\x67\x74\x5a\x48\x0a\x4e\x7a\x41\x41\x41\x41\x67\x51\x43\x73"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 179

Aug 30 08:34:23 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1\regress\misc\fuzz-harness\testdata\id_ecdsa
EXT:
TYPE:
Certificate PEM
SIZE:
492
MD5:
b14d14c4a2eb3a89c43be1d828fe2604
SHA1:
56c94a39972cc4c2ab982f6b206702cf3b558bde
SHA256:
00120fd3e06a2c9a2debabe94c75cb9a8fb313d17b3a114dda6264874ae56c60
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Fri Aug 30 07:33:06.015 2024
MODIFIED:
Tue Mar 2 10:31:47.000 2021
ACCESSED:
Tue May 14 16:19:54.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x61\x41\x41\x41\x41\x42\x4e\x6c\x59\x32\x52\x7a\x59\x53\x0a\x31\x7a\x61\x47\x45\x79\x4c\x57\x35\x70"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 180

Aug 30 08:34:23 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1\regress\misc\fuzz-harness\testdata\id_ecdsa_sk
EXT:
TYPE:
Certificate PEM
SIZE:
858
MD5:
c87bc24fa8b257e7af7374511f44d2c5
SHA1:
2c1d6e64ad0052837b53739841f6acfc60a191ed
SHA256:
50e6649901ffdf7bc4d85dd0f45937b9d99bdd85e472c112f8586bd3e35beb58
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Fri Aug 30 07:33:06.016 2024
MODIFIED:
Tue Mar 2 10:31:47.000 2021
ACCESSED:
Tue May 14 16:20:12.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x66\x77\x41\x41\x41\x43\x4a\x7a\x61\x79\x31\x6c\x59\x32\x0a\x52\x7a\x59\x53\x31\x7a\x61\x47\x45\x79"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 181

Aug 30 08:34:23 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1\regress\misc\fuzz-harness\testdata\id_ed25519
EXT:
TYPE:
Certificate PEM
SIZE:
387
MD5:
904e0a369a7fbe86bcb4e0bc1363c539
SHA1:
1074da4383390925d414ad562a0818a88e116208
SHA256:
6efecdbb70364afc9cf004e325a9a1d2673d86e85a6238e1126d6d105cea56c1
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Fri Aug 30 07:33:06.018 2024
MODIFIED:
Tue Mar 2 10:31:47.000 2021
ACCESSED:
Tue May 14 16:20:29.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 182

Aug 30 08:34:23 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1\regress\misc\fuzz-harness\testdata\id_ed25519_sk
EXT:
TYPE:
Certificate PEM
SIZE:
496
MD5:
c3c7cad31e9edf76f806848501011568
SHA1:
f936a6c0f3b1250ef7fd0cbf4ea5a5d3c9c63507
SHA256:
5fd315701b14a13467331e1d0819a8016abdf5888ab695f068fce488bd37169d
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Fri Aug 30 07:33:06.019 2024
MODIFIED:
Tue Mar 2 10:31:47.000 2021
ACCESSED:
Tue May 14 16:20:45.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x53\x67\x41\x41\x41\x42\x70\x7a\x61\x79\x31\x7a\x63\x32\x0a\x67\x74\x5a\x57\x51\x79\x4e\x54\x55\x78"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 183

Aug 30 08:34:23 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1\regress\misc\fuzz-harness\testdata\id_rsa
EXT:
TYPE:
Certificate PEM
SIZE:
1799
MD5:
0e4d9d0e310d6dc6a5c2d33660f70542
SHA1:
7bef427ad9067a465009d543787063fdaceef3e5
SHA256:
83822e39fb2ee059431a45c3c48cffcda3fb869273a364a45898ce9abad09e84
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Fri Aug 30 07:33:06.021 2024
MODIFIED:
Tue Mar 2 10:31:47.000 2021
ACCESSED:
Tue May 14 16:21:03.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x42\x46\x77\x41\x41\x41\x41\x64\x7a\x63\x32\x67\x74\x63\x6e\x0a\x4e\x68\x41\x41\x41\x41\x41\x77\x45\x41"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 184

Aug 30 08:34:24 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1\regress\unittests\sshkey\testdata\dsa_1
EXT:
TYPE:
Certificate PEM
SIZE:
672
MD5:
aebcad00ac7fb84f1a7de01322c99be3
SHA1:
a9a0e1cf84bee8c27802295819b399833e5d4d08
SHA256:
b7f7c2bb695b28e585951a2da4ad2d6c933c440afe118798c6e2363e17da2b93
FIRSTBYTES:
2d2d2d2d2d424547494e20445341205052495641 / -----BEGIN DSA PRIVA
CREATED:
Fri Aug 30 07:33:06.106 2024
MODIFIED:
Tue Mar 2 10:31:47.000 2021
ACCESSED:
Tue May 14 16:23:16.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x44\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x42\x76\x41\x49\x42\x41\x41\x4b\x42\x67\x51" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x44\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x42\x76\x41\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x36\x6b\x75\x74\x4e\x46\x52\x73\x48\x54\x77\x45\x41\x76\x36\x64\x33\x39\x4c\x68\x73\x71\x79\x31\x61\x70\x64\x48\x42\x5a\x39\x63\x32\x48\x66\x79\x52\x72\x37\x57\x6d\x79\x70\x79\x47\x49\x79\x32\x6d"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 185

Aug 30 08:34:24 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1\regress\unittests\sshkey\testdata\dsa_n
EXT:
TYPE:
Certificate PEM
SIZE:
1361
MD5:
6fcf088f9850b2f2213186cee4dc4811
SHA1:
a04d604886c6a7c2217df9b7eea5c998da91d561
SHA256:
db691de6aa454ec8aa45c84c58022a54611427f6f44c20d152ac05e0ea2284ba
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Fri Aug 30 07:33:06.123 2024
MODIFIED:
Tue Mar 2 10:31:47.000 2021
ACCESSED:
Tue May 14 16:25:22.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x42\x73\x77\x41\x41\x41\x41\x64\x7a\x63\x32\x67\x74\x5a\x48\x0a\x4e\x7a\x41\x41\x41\x41\x67\x51\x44\x36"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 186

Aug 30 08:34:24 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1\regress\unittests\sshkey\testdata\ecdsa_1
EXT:
TYPE:
Certificate PEM
SIZE:
227
MD5:
610b43e1fd8e09f2794aba398c6950eb
SHA1:
c7e5b5ff84b30ff8880e4d75942a600d012516b6
SHA256:
42a90746ef5975c6ef98c6d56305dad0bc698a1b05c83518bc90584c83935d5c
FIRSTBYTES:
2d2d2d2d2d424547494e20454320505249564154 / -----BEGIN EC PRIVAT
CREATED:
Fri Aug 30 07:33:06.124 2024
MODIFIED:
Tue Mar 2 10:31:47.000 2021
ACCESSED:
Tue May 14 16:25:39.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x48\x63\x43\x41\x51\x45\x45\x49\x50\x50\x4e\x79\x55\x41\x6e\x6a\x76\x46\x72\x2b\x65\x54\x2f\x37\x74\x2f\x49\x79\x6a\x75\x51\x51\x64\x2f\x61\x4c\x46\x69\x54\x59\x39\x32\x4c\x42\x39\x67\x49\x6a\x79\x72"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 187

Aug 30 08:34:24 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1\regress\unittests\sshkey\testdata\ecdsa_2
EXT:
TYPE:
Certificate PEM
SIZE:
365
MD5:
0346ad9a21f23d98cb3abe4845df078d
SHA1:
07091af93e22c676e03e6f96e9d0e53c9b53d775
SHA256:
320396e36bd5ecc12089f26849f8e7b6e0ab3c037f0492dee978cef6646d5826
FIRSTBYTES:
2d2d2d2d2d424547494e20454320505249564154 / -----BEGIN EC PRIVAT
CREATED:
Fri Aug 30 07:33:06.126 2024
MODIFIED:
Tue Mar 2 10:31:47.000 2021
ACCESSED:
Tue May 14 16:27:24.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x48\x63\x41\x67\x45\x42\x42\x45\x49\x42\x71\x42\x74\x4e\x37\x65\x36\x45\x73\x73\x64\x33\x64\x6c\x73\x67\x49\x53\x56\x69\x50\x43\x58\x58\x43\x30\x61\x74\x6c\x4e\x6b\x47\x74\x6f\x4d\x67\x53\x51\x64"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 188

Aug 30 08:34:24 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1\regress\unittests\sshkey\testdata\ecdsa_n
EXT:
TYPE:
Certificate PEM
SIZE:
492
MD5:
0ffc5b7197ecb4b69f503d4f3cc24c8c
SHA1:
c2c7fd9527d9cc84781346a3ac8e2100d4d20ad3
SHA256:
1cccaa23aca49238099494fc7b49b550311719c9ac6bb138797e1077f4d7973d
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Fri Aug 30 07:33:06.130 2024
MODIFIED:
Tue Mar 2 10:31:47.000 2021
ACCESSED:
Tue May 14 16:11:55.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x61\x41\x41\x41\x41\x42\x4e\x6c\x59\x32\x52\x7a\x59\x53\x0a\x31\x7a\x61\x47\x45\x79\x4c\x57\x35\x70"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 189

Aug 30 08:34:24 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1\regress\unittests\sshkey\testdata\ecdsa_sk1
EXT:
TYPE:
Certificate PEM
SIZE:
849
MD5:
97206cfa158fdda5a45c6eb542f739c0
SHA1:
e55ec614db8cea92d7269d5f903cf72baca36454
SHA256:
e4df7ea4ca133a7457069be073203c556166c65635ed6fb6c12b9a84f027346e
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Fri Aug 30 07:33:06.131 2024
MODIFIED:
Tue Mar 2 10:31:47.000 2021
ACCESSED:
Tue May 14 16:12:16.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x66\x77\x41\x41\x41\x43\x4a\x7a\x61\x79\x31\x6c\x59\x32\x0a\x52\x7a\x59\x53\x31\x7a\x61\x47\x45\x79"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 190

Aug 30 08:34:24 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1\regress\unittests\sshkey\testdata\ecdsa_sk2
EXT:
TYPE:
Certificate PEM
SIZE:
849
MD5:
14ecb7595ee296b15d413ae395454a4c
SHA1:
909379299593aeebc79f44df0ec22578123acce7
SHA256:
de6f60d862f799ca088bd4611865e24bb0635d81097bb9496f0178aefa4acbae
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Fri Aug 30 07:33:06.133 2024
MODIFIED:
Tue Mar 2 10:31:47.000 2021
ACCESSED:
Tue May 14 16:13:14.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x66\x77\x41\x41\x41\x43\x4a\x7a\x61\x79\x31\x6c\x59\x32\x0a\x52\x7a\x59\x53\x31\x7a\x61\x47\x45\x79"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 191

Aug 30 08:34:24 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1\regress\unittests\sshkey\testdata\ed25519_1
EXT:
TYPE:
Certificate PEM
SIZE:
411
MD5:
514e8e39c48edb2b8934ef78a5030042
SHA1:
a7a368a6f3d09bc2cfc1315f6e0899bde0574ffd
SHA256:
74f95c1990e3512af471cf6fb58d08a8078bbab597e7ee86a7ccd233f6855fd1
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Fri Aug 30 07:33:06.134 2024
MODIFIED:
Tue Mar 2 10:31:47.000 2021
ACCESSED:
Tue May 14 16:13:47.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 192

Aug 30 08:34:24 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1\regress\unittests\sshkey\testdata\ed25519_2
EXT:
TYPE:
Certificate PEM
SIZE:
411
MD5:
bfc2ac8495dbc6070241303ec50a6dc2
SHA1:
53e388e7c836c6ba874e852d71a6e1e708611d25
SHA256:
31689f4706b3bdad29ee21b05af62e9f2257399d07092089944514ed5edb131d
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Fri Aug 30 07:33:06.137 2024
MODIFIED:
Tue Mar 2 10:31:47.000 2021
ACCESSED:
Tue May 14 16:14:42.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 193

Aug 30 08:34:24 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1\regress\unittests\sshkey\testdata\ed25519_sk1
EXT:
TYPE:
Certificate PEM
SIZE:
484
MD5:
ab9dcdbff00763217a3f85069a9c2f67
SHA1:
05396ad046c37370093f48c0bdb2510b8894aa76
SHA256:
45c058d08280c4ca36a9d020478504cd550e7c5752c207d182363c3edf669ce8
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Fri Aug 30 07:33:06.146 2024
MODIFIED:
Tue Mar 2 10:31:47.000 2021
ACCESSED:
Tue May 14 16:15:14.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x53\x67\x41\x41\x41\x42\x70\x7a\x61\x79\x31\x7a\x63\x32\x0a\x67\x74\x5a\x57\x51\x79\x4e\x54\x55\x78"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 194

Aug 30 08:34:24 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1\regress\unittests\sshkey\testdata\ed25519_sk2
EXT:
TYPE:
Certificate PEM
SIZE:
484
MD5:
8a666562de41f71d57d47c5f6404293a
SHA1:
069c9341d4b0cd94669ff23feab92853b6a42540
SHA256:
b862e169114ee63ae5e8497110075a9e67c4e3f24bad01e7c06951d268a3ec0f
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Fri Aug 30 07:33:06.149 2024
MODIFIED:
Tue Mar 2 10:31:47.000 2021
ACCESSED:
Tue May 14 16:16:20.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x53\x67\x41\x41\x41\x42\x70\x7a\x61\x79\x31\x7a\x63\x32\x0a\x67\x74\x5a\x57\x51\x79\x4e\x54\x55\x78"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 195

Aug 30 08:34:24 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1\regress\unittests\sshkey\testdata\rsa_1
EXT:
TYPE:
Certificate PEM
SIZE:
887
MD5:
197f14927e89c5c573213416bde709cb
SHA1:
2f5cfafbddd00c351ce72e2f140458fb5ac7b60a
SHA256:
07586a53bef4dd9daf59c473399fca5fcb39891bed0d2c2f8a88249e02392ac5
FIRSTBYTES:
2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA
CREATED:
Fri Aug 30 07:33:06.150 2024
MODIFIED:
Tue Mar 2 10:31:47.000 2021
ACCESSED:
Tue May 14 16:17:05.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x43\x58\x41\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x4c\x56\x35\x6c\x55\x54\x74\x37\x46\x72\x41\x44\x73\x65\x42\x2f\x43\x47\x68\x45\x5a\x7a\x70\x6f\x6f\x6a\x6a\x45\x57\x35\x79\x38\x2b\x65\x50\x76\x4c\x70"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 196

Aug 30 08:34:24 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1\regress\unittests\sshkey\testdata\rsa_1_sha1
EXT:
TYPE:
Certificate PEM
SIZE:
887
MD5:
197f14927e89c5c573213416bde709cb
SHA1:
2f5cfafbddd00c351ce72e2f140458fb5ac7b60a
SHA256:
07586a53bef4dd9daf59c473399fca5fcb39891bed0d2c2f8a88249e02392ac5
FIRSTBYTES:
2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA
CREATED:
Fri Aug 30 07:33:06.153 2024
MODIFIED:
Tue Mar 2 10:31:47.000 2021
ACCESSED:
Tue May 14 16:18:14.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x43\x58\x41\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x4c\x56\x35\x6c\x55\x54\x74\x37\x46\x72\x41\x44\x73\x65\x42\x2f\x43\x47\x68\x45\x5a\x7a\x70\x6f\x6f\x6a\x6a\x45\x57\x35\x79\x38\x2b\x65\x50\x76\x4c\x70"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 197

Aug 30 08:34:24 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1\regress\unittests\sshkey\testdata\rsa_1_sha512
EXT:
TYPE:
Certificate PEM
SIZE:
887
MD5:
197f14927e89c5c573213416bde709cb
SHA1:
2f5cfafbddd00c351ce72e2f140458fb5ac7b60a
SHA256:
07586a53bef4dd9daf59c473399fca5fcb39891bed0d2c2f8a88249e02392ac5
FIRSTBYTES:
2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA
CREATED:
Fri Aug 30 07:33:06.154 2024
MODIFIED:
Tue Mar 2 10:31:47.000 2021
ACCESSED:
Tue May 14 16:18:40.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x43\x58\x41\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x4c\x56\x35\x6c\x55\x54\x74\x37\x46\x72\x41\x44\x73\x65\x42\x2f\x43\x47\x68\x45\x5a\x7a\x70\x6f\x6f\x6a\x6a\x45\x57\x35\x79\x38\x2b\x65\x50\x76\x4c\x70"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 198

Aug 30 08:34:24 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1\regress\unittests\sshkey\testdata\rsa_2
EXT:
TYPE:
Certificate PEM
SIZE:
1679
MD5:
c8860a2d208d222eade1e9866449ccbc
SHA1:
64133ddc79d593e467c864c429e3793c69e4dc22
SHA256:
e42925e663a7215e19cdc89bd9fe018903eeb013f131b188d3c87f0ef01c5a24
FIRSTBYTES:
2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA
CREATED:
Fri Aug 30 07:33:06.156 2024
MODIFIED:
Tue Mar 2 10:31:47.000 2021
ACCESSED:
Tue May 14 16:19:10.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x45\x70\x41\x49\x42\x41\x41\x4b\x43\x41\x51\x45\x41\x39\x4e\x45\x55\x58\x70\x37\x38\x53\x41\x6b\x6d\x4c\x34\x2b\x65\x41\x6a\x34\x6d\x42\x7a\x50\x4f\x6a\x6b\x2b\x63\x63\x43\x50\x56\x7a\x6b\x54\x52\x2b"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 199

Aug 30 08:34:24 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1\regress\unittests\sshkey\testdata\rsa_n
EXT:
TYPE:
Certificate PEM
SIZE:
1020
MD5:
d60f55c106077131ba136f02e9b9ba88
SHA1:
d6a3a8961cb40e8a4ff03dbfd5983c9fc5dfeb39
SHA256:
0ad47d17d5f21f350c26c4c94564bf41b6fd28ab55187166b4f46b1b35daed6d
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Fri Aug 30 07:33:06.158 2024
MODIFIED:
Tue Mar 2 10:31:47.000 2021
ACCESSED:
Tue May 14 16:20:03.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x6c\x77\x41\x41\x41\x41\x64\x7a\x63\x32\x67\x74\x63\x6e\x0a\x4e\x68\x41\x41\x41\x41\x41\x77\x45\x41"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 200

Aug 30 08:34:25 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1\regress\unittests\sshsig\testdata\ecdsa
EXT:
TYPE:
Certificate PEM
SIZE:
227
MD5:
53f2aa69e4e8d05ea1c0848c4a946b71
SHA1:
69a4f47fbbb55eb5dea9adea057509384a32bb69
SHA256:
585957bd0a19fcff2d22cd8af7ffb13b68cc30c9dc13dfefb57271b03f3a999f
FIRSTBYTES:
2d2d2d2d2d424547494e20454320505249564154 / -----BEGIN EC PRIVAT
CREATED:
Fri Aug 30 07:33:06.161 2024
MODIFIED:
Tue Mar 2 10:31:47.000 2021
ACCESSED:
Tue May 14 16:20:51.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x48\x63\x43\x41\x51\x45\x45\x49\x46\x67\x30\x5a\x43\x53\x45\x42\x35\x4c\x4e\x65\x4c\x73\x58\x59\x4c\x32\x35\x67\x33\x6b\x71\x45\x57\x73\x71\x68\x35\x32\x44\x52\x2b\x79\x4e\x4f\x6a\x79\x51\x4a\x71\x79"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 201

Aug 30 08:34:25 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1\regress\unittests\sshsig\testdata\ecdsa_sk
EXT:
TYPE:
Certificate PEM
SIZE:
837
MD5:
36948c6f96600caa24052b4d8322cbd9
SHA1:
b7bf9e701f8da5d50f61064849d052e04fb77c3f
SHA256:
f81b969ccd3e85f02b71465ba38fb51b5adf6f11b09f2e9e82ed6b2ab31f2356
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Fri Aug 30 07:33:06.162 2024
MODIFIED:
Tue Mar 2 10:31:47.000 2021
ACCESSED:
Tue May 14 16:21:09.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x66\x77\x41\x41\x41\x43\x4a\x7a\x61\x79\x31\x6c\x59\x32\x0a\x52\x7a\x59\x53\x31\x7a\x61\x47\x45\x79"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 202

Aug 30 08:34:25 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1\regress\unittests\sshsig\testdata\ed25519
EXT:
TYPE:
Certificate PEM
SIZE:
411
MD5:
8bb197113a031c8f6d76de369316d0eb
SHA1:
40847760b4f753f2b17156d3f6f9cdcc7c0b91d4
SHA256:
c4683c666d6394fc5e8f3455b5379304979e0b41502560ddef20c824fa9fb66b
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Fri Aug 30 07:33:06.166 2024
MODIFIED:
Tue Mar 2 10:31:47.000 2021
ACCESSED:
Tue May 14 16:21:45.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 203

Aug 30 08:34:25 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1\regress\unittests\sshsig\testdata\ed25519_sk
EXT:
TYPE:
Certificate PEM
SIZE:
484
MD5:
85bc2e18e08c06aa85cf023e7a97a585
SHA1:
95ea85c4709baf47e7cc2573ceac480cc35bde67
SHA256:
0e2221a7c8e8cea4fb6e9d2666b1d05166a3b0f5876c54433f0c35b564f22025
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Fri Aug 30 07:33:06.167 2024
MODIFIED:
Tue Mar 2 10:31:47.000 2021
ACCESSED:
Tue May 14 16:22:04.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x53\x67\x41\x41\x41\x42\x70\x7a\x61\x79\x31\x7a\x63\x32\x0a\x67\x74\x5a\x57\x51\x79\x4e\x54\x55\x78"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 204

Aug 30 08:34:25 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.5p1\regress\unittests\sshsig\testdata\rsa
EXT:
TYPE:
Certificate PEM
SIZE:
2455
MD5:
efe804ccdc63abc29233f3a1e11e173b
SHA1:
481c1773197aabc2d9d87336ad84f44410251ed4
SHA256:
d7eb37f534b846bb582bcdcf78232bdb33932e34fb72d6bfa130a8fd699b10b6
FIRSTBYTES:
2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA
CREATED:
Fri Aug 30 07:33:06.169 2024
MODIFIED:
Tue Mar 2 10:31:47.000 2021
ACCESSED:
Tue May 14 16:22:29.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x47\x34\x77\x49\x42\x41\x41\x4b\x43\x41\x59\x45\x41\x33\x38\x36\x6c\x6d\x6a\x52\x48\x74\x4a\x70\x79\x6a\x38\x37\x42\x72\x53\x2b\x73\x73\x4d\x6d\x74\x76\x63\x2f\x31\x53\x50\x4e\x30\x67\x58\x54\x50\x73"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 205

Aug 30 08:34:27 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1\regress\ed25519_openssh.prv
EXT:
.prv
TYPE:
Certificate PEM
SIZE:
419
MD5:
c1d6034878b590c80805ad1e66039091
SHA1:
9127798b0fadd4539c81ee4f294287e8262eddb0
SHA256:
11bab46497954bd367ea5c2541cb3bad4814515481aee687fcdddc5680ee642d
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Fri Aug 30 07:33:07.473 2024
MODIFIED:
Sun Sep 26 14:03:19.000 2021
ACCESSED:
Tue May 14 16:18:06.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 206

Aug 30 08:34:28 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1\regress\rsa_openssh.prv
EXT:
.prv
TYPE:
Certificate PEM
SIZE:
883
MD5:
a6b110f820948e73bbde7b948744b3c5
SHA1:
614e6d353be614ded246a12ed6e14af20f063710
SHA256:
79b8783d0b10a3f65b9b3e349a1daa692cc27be08028131ff5a9a08799035f46
FIRSTBYTES:
2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA
CREATED:
Fri Aug 30 07:33:07.565 2024
MODIFIED:
Sun Sep 26 14:03:19.000 2021
ACCESSED:
Tue May 14 16:13:26.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x43\x57\x67\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x73\x69\x6c\x77\x4b\x63\x61\x4b\x4e\x36\x77\x53\x4d\x4e\x64\x31\x57\x67\x51\x39\x2b\x48\x52\x71\x51\x45\x6b\x44\x30\x6b\x43\x54\x56\x74\x74\x72\x61\x7a"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 207

Aug 30 08:34:28 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1\regress\misc\fuzz-harness\testdata\id_dsa
EXT:
TYPE:
Certificate PEM
SIZE:
1361
MD5:
a9521c2825fbf778b6b82b1dcda95d72
SHA1:
29bc6d9b491473450487aad65a659675154b8fb8
SHA256:
a6fa247970fe3fe15b9647e9ae301495d10ea278dbe9516abdf70e69b1849744
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Fri Aug 30 07:33:07.518 2024
MODIFIED:
Sun Sep 26 14:03:19.000 2021
ACCESSED:
Tue May 14 16:24:05.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x42\x73\x67\x41\x41\x41\x41\x64\x7a\x63\x32\x67\x74\x5a\x48\x0a\x4e\x7a\x41\x41\x41\x41\x67\x51\x43\x73"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 208

Aug 30 08:34:28 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1\regress\misc\fuzz-harness\testdata\id_ecdsa
EXT:
TYPE:
Certificate PEM
SIZE:
492
MD5:
b14d14c4a2eb3a89c43be1d828fe2604
SHA1:
56c94a39972cc4c2ab982f6b206702cf3b558bde
SHA256:
00120fd3e06a2c9a2debabe94c75cb9a8fb313d17b3a114dda6264874ae56c60
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Fri Aug 30 07:33:07.520 2024
MODIFIED:
Sun Sep 26 14:03:19.000 2021
ACCESSED:
Tue May 14 16:24:25.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x61\x41\x41\x41\x41\x42\x4e\x6c\x59\x32\x52\x7a\x59\x53\x0a\x31\x7a\x61\x47\x45\x79\x4c\x57\x35\x70"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 209

Aug 30 08:34:28 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1\regress\misc\fuzz-harness\testdata\id_ecdsa_sk
EXT:
TYPE:
Certificate PEM
SIZE:
858
MD5:
c87bc24fa8b257e7af7374511f44d2c5
SHA1:
2c1d6e64ad0052837b53739841f6acfc60a191ed
SHA256:
50e6649901ffdf7bc4d85dd0f45937b9d99bdd85e472c112f8586bd3e35beb58
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Fri Aug 30 07:33:07.522 2024
MODIFIED:
Sun Sep 26 14:03:19.000 2021
ACCESSED:
Tue May 14 16:24:49.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x66\x77\x41\x41\x41\x43\x4a\x7a\x61\x79\x31\x6c\x59\x32\x0a\x52\x7a\x59\x53\x31\x7a\x61\x47\x45\x79"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 210

Aug 30 08:34:28 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1\regress\misc\fuzz-harness\testdata\id_ed25519
EXT:
TYPE:
Certificate PEM
SIZE:
387
MD5:
904e0a369a7fbe86bcb4e0bc1363c539
SHA1:
1074da4383390925d414ad562a0818a88e116208
SHA256:
6efecdbb70364afc9cf004e325a9a1d2673d86e85a6238e1126d6d105cea56c1
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Fri Aug 30 07:33:07.524 2024
MODIFIED:
Sun Sep 26 14:03:19.000 2021
ACCESSED:
Tue May 14 16:25:23.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 211

Aug 30 08:34:28 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1\regress\misc\fuzz-harness\testdata\id_ed25519_sk
EXT:
TYPE:
Certificate PEM
SIZE:
496
MD5:
c3c7cad31e9edf76f806848501011568
SHA1:
f936a6c0f3b1250ef7fd0cbf4ea5a5d3c9c63507
SHA256:
5fd315701b14a13467331e1d0819a8016abdf5888ab695f068fce488bd37169d
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Fri Aug 30 07:33:07.525 2024
MODIFIED:
Sun Sep 26 14:03:19.000 2021
ACCESSED:
Tue May 14 16:25:49.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x53\x67\x41\x41\x41\x42\x70\x7a\x61\x79\x31\x7a\x63\x32\x0a\x67\x74\x5a\x57\x51\x79\x4e\x54\x55\x78"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 212

Aug 30 08:34:28 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1\regress\misc\fuzz-harness\testdata\id_rsa
EXT:
TYPE:
Certificate PEM
SIZE:
1799
MD5:
0e4d9d0e310d6dc6a5c2d33660f70542
SHA1:
7bef427ad9067a465009d543787063fdaceef3e5
SHA256:
83822e39fb2ee059431a45c3c48cffcda3fb869273a364a45898ce9abad09e84
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Fri Aug 30 07:33:07.527 2024
MODIFIED:
Sun Sep 26 14:03:19.000 2021
ACCESSED:
Tue May 14 16:26:10.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x42\x46\x77\x41\x41\x41\x41\x64\x7a\x63\x32\x67\x74\x63\x6e\x0a\x4e\x68\x41\x41\x41\x41\x41\x77\x45\x41"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 213

Aug 30 08:34:29 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1\regress\unittests\sshkey\testdata\dsa_1
EXT:
TYPE:
Certificate PEM
SIZE:
672
MD5:
aebcad00ac7fb84f1a7de01322c99be3
SHA1:
a9a0e1cf84bee8c27802295819b399833e5d4d08
SHA256:
b7f7c2bb695b28e585951a2da4ad2d6c933c440afe118798c6e2363e17da2b93
FIRSTBYTES:
2d2d2d2d2d424547494e20445341205052495641 / -----BEGIN DSA PRIVA
CREATED:
Fri Aug 30 07:33:07.987 2024
MODIFIED:
Sun Sep 26 14:03:19.000 2021
ACCESSED:
Tue May 14 16:15:29.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x44\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x42\x76\x41\x49\x42\x41\x41\x4b\x42\x67\x51" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x44\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x42\x76\x41\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x36\x6b\x75\x74\x4e\x46\x52\x73\x48\x54\x77\x45\x41\x76\x36\x64\x33\x39\x4c\x68\x73\x71\x79\x31\x61\x70\x64\x48\x42\x5a\x39\x63\x32\x48\x66\x79\x52\x72\x37\x57\x6d\x79\x70\x79\x47\x49\x79\x32\x6d"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 214

Aug 30 08:34:29 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1\regress\unittests\sshkey\testdata\dsa_n
EXT:
TYPE:
Certificate PEM
SIZE:
1361
MD5:
6fcf088f9850b2f2213186cee4dc4811
SHA1:
a04d604886c6a7c2217df9b7eea5c998da91d561
SHA256:
db691de6aa454ec8aa45c84c58022a54611427f6f44c20d152ac05e0ea2284ba
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Fri Aug 30 07:33:07.994 2024
MODIFIED:
Sun Sep 26 14:03:19.000 2021
ACCESSED:
Tue May 14 16:17:10.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x42\x73\x77\x41\x41\x41\x41\x64\x7a\x63\x32\x67\x74\x5a\x48\x0a\x4e\x7a\x41\x41\x41\x41\x67\x51\x44\x36"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 215

Aug 30 08:34:29 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1\regress\unittests\sshkey\testdata\ecdsa_1
EXT:
TYPE:
Certificate PEM
SIZE:
227
MD5:
610b43e1fd8e09f2794aba398c6950eb
SHA1:
c7e5b5ff84b30ff8880e4d75942a600d012516b6
SHA256:
42a90746ef5975c6ef98c6d56305dad0bc698a1b05c83518bc90584c83935d5c
FIRSTBYTES:
2d2d2d2d2d424547494e20454320505249564154 / -----BEGIN EC PRIVAT
CREATED:
Fri Aug 30 07:33:07.995 2024
MODIFIED:
Sun Sep 26 14:03:19.000 2021
ACCESSED:
Tue May 14 16:17:25.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x48\x63\x43\x41\x51\x45\x45\x49\x50\x50\x4e\x79\x55\x41\x6e\x6a\x76\x46\x72\x2b\x65\x54\x2f\x37\x74\x2f\x49\x79\x6a\x75\x51\x51\x64\x2f\x61\x4c\x46\x69\x54\x59\x39\x32\x4c\x42\x39\x67\x49\x6a\x79\x72"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 216

Aug 30 08:34:29 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1\regress\unittests\sshkey\testdata\ecdsa_2
EXT:
TYPE:
Certificate PEM
SIZE:
365
MD5:
0346ad9a21f23d98cb3abe4845df078d
SHA1:
07091af93e22c676e03e6f96e9d0e53c9b53d775
SHA256:
320396e36bd5ecc12089f26849f8e7b6e0ab3c037f0492dee978cef6646d5826
FIRSTBYTES:
2d2d2d2d2d424547494e20454320505249564154 / -----BEGIN EC PRIVAT
CREATED:
Fri Aug 30 07:33:07.902 2024
MODIFIED:
Sun Sep 26 14:03:19.000 2021
ACCESSED:
Tue May 14 16:18:58.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x48\x63\x41\x67\x45\x42\x42\x45\x49\x42\x71\x42\x74\x4e\x37\x65\x36\x45\x73\x73\x64\x33\x64\x6c\x73\x67\x49\x53\x56\x69\x50\x43\x58\x58\x43\x30\x61\x74\x6c\x4e\x6b\x47\x74\x6f\x4d\x67\x53\x51\x64"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 217

Aug 30 08:34:29 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1\regress\unittests\sshkey\testdata\ecdsa_n
EXT:
TYPE:
Certificate PEM
SIZE:
492
MD5:
0ffc5b7197ecb4b69f503d4f3cc24c8c
SHA1:
c2c7fd9527d9cc84781346a3ac8e2100d4d20ad3
SHA256:
1cccaa23aca49238099494fc7b49b550311719c9ac6bb138797e1077f4d7973d
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Fri Aug 30 07:33:07.920 2024
MODIFIED:
Sun Sep 26 14:03:19.000 2021
ACCESSED:
Tue May 14 16:19:58.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x61\x41\x41\x41\x41\x42\x4e\x6c\x59\x32\x52\x7a\x59\x53\x0a\x31\x7a\x61\x47\x45\x79\x4c\x57\x35\x70"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 218

Aug 30 08:34:29 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1\regress\unittests\sshkey\testdata\ecdsa_sk1
EXT:
TYPE:
Certificate PEM
SIZE:
849
MD5:
97206cfa158fdda5a45c6eb542f739c0
SHA1:
e55ec614db8cea92d7269d5f903cf72baca36454
SHA256:
e4df7ea4ca133a7457069be073203c556166c65635ed6fb6c12b9a84f027346e
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Fri Aug 30 07:33:07.921 2024
MODIFIED:
Sun Sep 26 14:03:19.000 2021
ACCESSED:
Tue May 14 16:20:16.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x66\x77\x41\x41\x41\x43\x4a\x7a\x61\x79\x31\x6c\x59\x32\x0a\x52\x7a\x59\x53\x31\x7a\x61\x47\x45\x79"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 219

Aug 30 08:34:29 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1\regress\unittests\sshkey\testdata\ecdsa_sk2
EXT:
TYPE:
Certificate PEM
SIZE:
849
MD5:
14ecb7595ee296b15d413ae395454a4c
SHA1:
909379299593aeebc79f44df0ec22578123acce7
SHA256:
de6f60d862f799ca088bd4611865e24bb0635d81097bb9496f0178aefa4acbae
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Fri Aug 30 07:33:07.929 2024
MODIFIED:
Sun Sep 26 14:03:19.000 2021
ACCESSED:
Tue May 14 16:21:18.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x66\x77\x41\x41\x41\x43\x4a\x7a\x61\x79\x31\x6c\x59\x32\x0a\x52\x7a\x59\x53\x31\x7a\x61\x47\x45\x79"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 220

Aug 30 08:34:29 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1\regress\unittests\sshkey\testdata\ed25519_1
EXT:
TYPE:
Certificate PEM
SIZE:
411
MD5:
514e8e39c48edb2b8934ef78a5030042
SHA1:
a7a368a6f3d09bc2cfc1315f6e0899bde0574ffd
SHA256:
74f95c1990e3512af471cf6fb58d08a8078bbab597e7ee86a7ccd233f6855fd1
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Fri Aug 30 07:33:07.933 2024
MODIFIED:
Sun Sep 26 14:03:19.000 2021
ACCESSED:
Tue May 14 16:21:48.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 221

Aug 30 08:34:29 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1\regress\unittests\sshkey\testdata\ed25519_2
EXT:
TYPE:
Certificate PEM
SIZE:
411
MD5:
bfc2ac8495dbc6070241303ec50a6dc2
SHA1:
53e388e7c836c6ba874e852d71a6e1e708611d25
SHA256:
31689f4706b3bdad29ee21b05af62e9f2257399d07092089944514ed5edb131d
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Fri Aug 30 07:33:07.939 2024
MODIFIED:
Sun Sep 26 14:03:19.000 2021
ACCESSED:
Tue May 14 16:22:36.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 222

Aug 30 08:34:29 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1\regress\unittests\sshkey\testdata\ed25519_sk1
EXT:
TYPE:
Certificate PEM
SIZE:
484
MD5:
ab9dcdbff00763217a3f85069a9c2f67
SHA1:
05396ad046c37370093f48c0bdb2510b8894aa76
SHA256:
45c058d08280c4ca36a9d020478504cd550e7c5752c207d182363c3edf669ce8
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Fri Aug 30 07:33:07.942 2024
MODIFIED:
Sun Sep 26 14:03:19.000 2021
ACCESSED:
Tue May 14 16:23:06.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x53\x67\x41\x41\x41\x42\x70\x7a\x61\x79\x31\x7a\x63\x32\x0a\x67\x74\x5a\x57\x51\x79\x4e\x54\x55\x78"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 223

Aug 30 08:34:29 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1\regress\unittests\sshkey\testdata\ed25519_sk2
EXT:
TYPE:
Certificate PEM
SIZE:
484
MD5:
8a666562de41f71d57d47c5f6404293a
SHA1:
069c9341d4b0cd94669ff23feab92853b6a42540
SHA256:
b862e169114ee63ae5e8497110075a9e67c4e3f24bad01e7c06951d268a3ec0f
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Fri Aug 30 07:33:07.946 2024
MODIFIED:
Sun Sep 26 14:03:19.000 2021
ACCESSED:
Tue May 14 16:23:57.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x53\x67\x41\x41\x41\x42\x70\x7a\x61\x79\x31\x7a\x63\x32\x0a\x67\x74\x5a\x57\x51\x79\x4e\x54\x55\x78"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 224

Aug 30 08:34:29 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1\regress\unittests\sshkey\testdata\rsa_1
EXT:
TYPE:
Certificate PEM
SIZE:
887
MD5:
197f14927e89c5c573213416bde709cb
SHA1:
2f5cfafbddd00c351ce72e2f140458fb5ac7b60a
SHA256:
07586a53bef4dd9daf59c473399fca5fcb39891bed0d2c2f8a88249e02392ac5
FIRSTBYTES:
2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA
CREATED:
Fri Aug 30 07:33:07.948 2024
MODIFIED:
Sun Sep 26 14:03:19.000 2021
ACCESSED:
Tue May 14 16:24:26.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x43\x58\x41\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x4c\x56\x35\x6c\x55\x54\x74\x37\x46\x72\x41\x44\x73\x65\x42\x2f\x43\x47\x68\x45\x5a\x7a\x70\x6f\x6f\x6a\x6a\x45\x57\x35\x79\x38\x2b\x65\x50\x76\x4c\x70"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 225

Aug 30 08:34:30 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1\regress\unittests\sshkey\testdata\rsa_1_sha1
EXT:
TYPE:
Certificate PEM
SIZE:
887
MD5:
197f14927e89c5c573213416bde709cb
SHA1:
2f5cfafbddd00c351ce72e2f140458fb5ac7b60a
SHA256:
07586a53bef4dd9daf59c473399fca5fcb39891bed0d2c2f8a88249e02392ac5
FIRSTBYTES:
2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA
CREATED:
Fri Aug 30 07:33:07.976 2024
MODIFIED:
Sun Sep 26 14:03:19.000 2021
ACCESSED:
Tue May 14 16:25:48.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x43\x58\x41\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x4c\x56\x35\x6c\x55\x54\x74\x37\x46\x72\x41\x44\x73\x65\x42\x2f\x43\x47\x68\x45\x5a\x7a\x70\x6f\x6f\x6a\x6a\x45\x57\x35\x79\x38\x2b\x65\x50\x76\x4c\x70"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 226

Aug 30 08:34:30 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1\regress\unittests\sshkey\testdata\rsa_1_sha512
EXT:
TYPE:
Certificate PEM
SIZE:
887
MD5:
197f14927e89c5c573213416bde709cb
SHA1:
2f5cfafbddd00c351ce72e2f140458fb5ac7b60a
SHA256:
07586a53bef4dd9daf59c473399fca5fcb39891bed0d2c2f8a88249e02392ac5
FIRSTBYTES:
2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA
CREATED:
Fri Aug 30 07:33:07.979 2024
MODIFIED:
Sun Sep 26 14:03:19.000 2021
ACCESSED:
Tue May 14 16:26:23.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x43\x58\x41\x49\x42\x41\x41\x4b\x42\x67\x51\x44\x4c\x56\x35\x6c\x55\x54\x74\x37\x46\x72\x41\x44\x73\x65\x42\x2f\x43\x47\x68\x45\x5a\x7a\x70\x6f\x6f\x6a\x6a\x45\x57\x35\x79\x38\x2b\x65\x50\x76\x4c\x70"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 227

Aug 30 08:34:30 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1\regress\unittests\sshkey\testdata\rsa_2
EXT:
TYPE:
Certificate PEM
SIZE:
1679
MD5:
c8860a2d208d222eade1e9866449ccbc
SHA1:
64133ddc79d593e467c864c429e3793c69e4dc22
SHA256:
e42925e663a7215e19cdc89bd9fe018903eeb013f131b188d3c87f0ef01c5a24
FIRSTBYTES:
2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA
CREATED:
Fri Aug 30 07:33:07.981 2024
MODIFIED:
Sun Sep 26 14:03:19.000 2021
ACCESSED:
Tue May 14 16:26:50.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x45\x70\x41\x49\x42\x41\x41\x4b\x43\x41\x51\x45\x41\x39\x4e\x45\x55\x58\x70\x37\x38\x53\x41\x6b\x6d\x4c\x34\x2b\x65\x41\x6a\x34\x6d\x42\x7a\x50\x4f\x6a\x6b\x2b\x63\x63\x43\x50\x56\x7a\x6b\x54\x52\x2b"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 228

Aug 30 08:34:30 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1\regress\unittests\sshkey\testdata\rsa_n
EXT:
TYPE:
Certificate PEM
SIZE:
1020
MD5:
d60f55c106077131ba136f02e9b9ba88
SHA1:
d6a3a8961cb40e8a4ff03dbfd5983c9fc5dfeb39
SHA256:
0ad47d17d5f21f350c26c4c94564bf41b6fd28ab55187166b4f46b1b35daed6d
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Fri Aug 30 07:33:07.986 2024
MODIFIED:
Sun Sep 26 14:03:19.000 2021
ACCESSED:
Tue May 14 16:11:10.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x6c\x77\x41\x41\x41\x41\x64\x7a\x63\x32\x67\x74\x63\x6e\x0a\x4e\x68\x41\x41\x41\x41\x41\x77\x45\x41"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 229

Aug 30 08:34:30 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1\regress\unittests\sshsig\testdata\ecdsa
EXT:
TYPE:
Certificate PEM
SIZE:
227
MD5:
53f2aa69e4e8d05ea1c0848c4a946b71
SHA1:
69a4f47fbbb55eb5dea9adea057509384a32bb69
SHA256:
585957bd0a19fcff2d22cd8af7ffb13b68cc30c9dc13dfefb57271b03f3a999f
FIRSTBYTES:
2d2d2d2d2d424547494e20454320505249564154 / -----BEGIN EC PRIVAT
CREATED:
Fri Aug 30 07:33:08.003 2024
MODIFIED:
Sun Sep 26 14:03:19.000 2021
ACCESSED:
Tue May 14 16:12:17.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x45\x43\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x48\x63\x43\x41\x51\x45\x45\x49\x46\x67\x30\x5a\x43\x53\x45\x42\x35\x4c\x4e\x65\x4c\x73\x58\x59\x4c\x32\x35\x67\x33\x6b\x71\x45\x57\x73\x71\x68\x35\x32\x44\x52\x2b\x79\x4e\x4f\x6a\x79\x51\x4a\x71\x79"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 230

Aug 30 08:34:30 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1\regress\unittests\sshsig\testdata\ecdsa_sk
EXT:
TYPE:
Certificate PEM
SIZE:
837
MD5:
36948c6f96600caa24052b4d8322cbd9
SHA1:
b7bf9e701f8da5d50f61064849d052e04fb77c3f
SHA256:
f81b969ccd3e85f02b71465ba38fb51b5adf6f11b09f2e9e82ed6b2ab31f2356
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Fri Aug 30 07:33:08.013 2024
MODIFIED:
Sun Sep 26 14:03:19.000 2021
ACCESSED:
Tue May 14 16:12:39.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x66\x77\x41\x41\x41\x43\x4a\x7a\x61\x79\x31\x6c\x59\x32\x0a\x52\x7a\x59\x53\x31\x7a\x61\x47\x45\x79"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 231

Aug 30 08:34:30 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1\regress\unittests\sshsig\testdata\ed25519
EXT:
TYPE:
Certificate PEM
SIZE:
411
MD5:
8bb197113a031c8f6d76de369316d0eb
SHA1:
40847760b4f753f2b17156d3f6f9cdcc7c0b91d4
SHA256:
c4683c666d6394fc5e8f3455b5379304979e0b41502560ddef20c824fa9fb66b
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Fri Aug 30 07:33:08.033 2024
MODIFIED:
Sun Sep 26 14:03:19.000 2021
ACCESSED:
Tue May 14 16:13:13.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x4d\x77\x41\x41\x41\x41\x74\x7a\x63\x32\x67\x74\x5a\x57\x0a\x51\x79\x4e\x54\x55\x78\x4f\x51\x41\x41"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 232

Aug 30 08:34:30 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1\regress\unittests\sshsig\testdata\ed25519_sk
EXT:
TYPE:
Certificate PEM
SIZE:
484
MD5:
85bc2e18e08c06aa85cf023e7a97a585
SHA1:
95ea85c4709baf47e7cc2573ceac480cc35bde67
SHA256:
0e2221a7c8e8cea4fb6e9d2666b1d05166a3b0f5876c54433f0c35b564f22025
FIRSTBYTES:
2d2d2d2d2d424547494e204f50454e5353482050 / -----BEGIN OPENSSH P
CREATED:
Fri Aug 30 07:33:08.035 2024
MODIFIED:
Sun Sep 26 14:03:19.000 2021
ACCESSED:
Tue May 14 16:13:41.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x4f\x50\x45\x4e\x53\x53\x48\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x62\x33\x42\x6c\x62\x6e\x4e\x7a\x61\x43\x31\x72\x5a\x58\x6b\x74\x64\x6a\x45\x41\x41\x41\x41\x41\x42\x47\x35\x76\x62\x6d\x55\x41\x41\x41\x41\x45\x62\x6d\x39\x75\x5a\x51\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x41\x41\x41\x41\x53\x67\x41\x41\x41\x42\x70\x7a\x61\x79\x31\x7a\x63\x32\x0a\x67\x74\x5a\x57\x51\x79\x4e\x54\x55\x78"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 233

Aug 30 08:34:30 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Filescan
MESSAGE:
Suspicious file found
SCORE:
45
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\root\openssh-8.8p1\regress\unittests\sshsig\testdata\rsa
EXT:
TYPE:
Certificate PEM
SIZE:
2455
MD5:
efe804ccdc63abc29233f3a1e11e173b
SHA1:
481c1773197aabc2d9d87336ad84f44410251ed4
SHA256:
d7eb37f534b846bb582bcdcf78232bdb33932e34fb72d6bfa130a8fd699b10b6
FIRSTBYTES:
2d2d2d2d2d424547494e20525341205052495641 / -----BEGIN RSA PRIVA
CREATED:
Fri Aug 30 07:33:08.038 2024
MODIFIED:
Sun Sep 26 14:03:19.000 2021
ACCESSED:
Tue May 14 16:14:16.000 2024
PERMISSIONS:
BUILTIN\Administrators:F / BUILTIN\Users:R / NT AUTHORITY\SYSTEM:F
OWNER:
BUILTIN\Administrators
REASON_1:
YARA rule EXT_VULN_Unencrypted_SSH_Private_Key / Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
SUBSCORE_1:
45
REF_1:
https://attack.mitre.org/techniques/T1552/004/
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49" at 0x0 in
  "\x2d\x2d\x2d\x2d\x2d\x42\x45\x47\x49\x4e\x20\x52\x53\x41\x20\x50\x52\x49\x56\x41\x54\x45\x20\x4b\x45\x59\x2d\x2d\x2d\x2d\x2d\x0a\x4d\x49\x49\x47\x34\x77\x49\x42\x41\x41\x4b\x43\x41\x59\x45\x41\x33\x38\x36\x6c\x6d\x6a\x52\x48\x74\x4a\x70\x79\x6a\x38\x37\x42\x72\x53\x2b\x73\x73\x4d\x6d\x74\x76\x63\x2f\x31\x53\x50\x4e\x30\x67\x58\x54\x50\x73"

RULEDATE_1:
2023-01-06
TAGS_1:
EXTVAR, T1021_004, T1552_004, T1572, VENDOR
RULENAME_1:
EXT_VULN_Unencrypted_SSH_Private_Key
AUTHOR_1:
Arnim Rupp
REASONS_COUNT:
1

Notice 234

Aug 30 08:34:58 WIN-LRTT94FA08M/10.100.5.12
MODULE:
LogScan
MESSAGE:
Notable Log Entry found
ENTRY:
2022.03.22 07:09:28.805 2253 INF CreateUrlMatcher: { applyToWholeDomainForEach: 0, masks: clients2.google.com, clients2.googleusercontent.com, ds.kaspersky.com, web.ucp.kaspersky.com, backend.ucp.kaspersky.com, rnd-infrastructure.ucp.kaspersky.com, management.azure.ucp.kaspersky.com, dis.azure.ucp.kaspersky.com, ns-dis.azure.ucp.kaspersky.com, test-activation.azure.ucp.kaspersky.com, activation.azure.ucp.kaspersky.com, uisucp.kaspersky.com, rdp.azure.ucp.kaspersky.com, svcuisucpit, monitoring.backend.it.ucp.kaspersky.com, backup.backend.it.ucp.kaspersky.com, logging.azure.ucp.kaspersky.com, services.ucp.kaspersky-labs.com, tpis.monitoring.azure.ucp.kaspersky.com, bis.monitoring.azure.ucp.kaspersky.com, korm.client.ucp.kaspersky-labs.com, pdc.client.ucp.kaspersky-labs.com, center.kaspersky-labs.com, *ucp-ntfy.kaspersky-labs.com, uis.kaspersky.com, register-account.kaspersky-labs.com, special.s.kaspersky-labs.com, ipm-klca.kaspersky.com, ksn-cp.kaspers[...]om, autoupdate.opera.com, kdc.uas.aol.com, secure.logmein.com, *.evernote.com, *.filezilla-project.org, gfe.nvi[...]ki.or.jp, upload*.mixcloud.com, certificado.sso.acesso.gov.br, sog-vault.avp.ru, vdi.kaspersky.com, *.tomtom.com, *.g*, *.googleapis.com, meetings.clients6.google.com, *, cloud.radar.imgsmail.ru, *.y*, *.y*, *, *, *mega*.nz, *.elster.de, *.de, *.starfinanz.de, *dropbox*.com, *dropbox*.com, *.surfeasy.*, *.opera-proxy.*, *.sec-tunnel.com, *, *, *, *.adobe.com, get.adobe.com, platformdl.adobe.com, fpdownload.adobe.com, *.branch.io, *.itau.com.br, gfwsl.geforce.com, gfwsl.geforce.com, www.autentapp.de, edge.activity.windows.com, activity.windows.com, enterprise.activity.windows.com, edge-enterprise.activity.windows.com, *.autodesk.com, mnsews.infocamere.it, webtelemaco.infocamere.it, r.manage.microsoft.com, *, *.*.*, *mail.ru, *.ya*, *.ya*, *.dropbox.com, *.de, gil.apple.com, *-keyvalueservice.icloud.com, *-setup.icloud.com, gateway.icloud.com, www.apple.com, *.mzstatic.com, api.apps.apple.com, bag.itunes.apple.com, *.push.apple.com, itunes.apple.com }
SCORE:
50
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\var\log\kaspersky\kesl\kesl.1040.2022-03-22T100924.log
LOG_MODIFIED:
Tue Mar 22 07:12:53 2022
LOG_ACCESSED:
Tue May 14 16:28:42 2024
LOG_CREATED:
Thu Aug 29 15:29:28 2024
REASON_1:
YARA rule yara_c2_logmein_com / Suspicious Domain Name / FQDN used by Remote Access Software 2023-09-16 https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md (SUSPICIOUS, REMOTE_CONTROL)
SUBSCORE_1:
50
REF_1:
not set
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- logmein.com

RULENAME_1:
yara_c2_logmein_com
AUTHOR_1:
unknown
REASONS_COUNT:
1
FILE_1:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\var\log\kaspersky\kesl\kesl.1040.2022-03-22T100924.log
EXISTS_1:
yes
TYPE_1:
UNKNOWN
SIZE_1:
6955786
MD5_1:
846abf2603bae2df835da6602dee4e01
SHA1_1:
9bf1cdc90a48e35a646a47d0b50e82f8191980de
SHA256_1:
cd083d280d410353e87987543a81b6767aef69c560daf8a34948231c4074acee
FIRSTBYTES_1:
4156502054524143452046494c45092020555443 / AVP TRACE FILE UTC
CREATED_1:
Thu Aug 29 15:29:28.919 2024
OWNER_1:
BUILTIN\Administrators

Notice 235

Aug 30 08:35:01 WIN-LRTT94FA08M/10.100.5.12
MODULE:
LogScan
MESSAGE:
Notable Log Entry found
ENTRY:
10.16.6.250 - - [06/May/2024:11:56:51 +0300] "GET /autodiscover/autodiscover.json?@test.com/owa/?&Email=autodiscover/autodiscover.json%3F@test.com HTTP/1.1" 403 199 "-" "-"
SCORE:
50
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\var\var\httpd\access_log
LOG_MODIFIED:
Tue May 7 07:55:38 2024
LOG_ACCESSED:
Tue May 14 16:36:08 2024
LOG_CREATED:
Fri Aug 30 07:36:47 2024
REASON_1:
YARA rule LOG_EXPL_Exchange_ProxyShell_Attempt_Aug21_1 / Detects ProxyShell exploitation attempts in log files
SUBSCORE_1:
50
REF_1:
https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- /autodiscover/autodiscover.json?@test.com/owa/?&Email=autodiscover/autodiscover.json%3F@

RULEDATE_1:
2021-08-09
TAGS_1:
EXPLOIT, LOG
RULENAME_1:
LOG_EXPL_Exchange_ProxyShell_Attempt_Aug21_1
AUTHOR_1:
Florian Roth
REASONS_COUNT:
1

Notice 236

Aug 30 08:35:02 WIN-LRTT94FA08M/10.100.5.12
MODULE:
LogScan
MESSAGE:
Notable Log Entry found
ENTRY:
10.16.6.250 - - [07/May/2024:10:31:56 +0300] "GET /autodiscover/autodiscover.json?@test.com/owa/?&Email=autodiscover/autodiscover.json%3F@test.com HTTP/1.1" 403 199 "-" "-"
SCORE:
50
FILE:
D:\CASES\Irkut\msk1-cas-1\msk1-cas-1\export_from_image\var\var\httpd\access_log
LOG_MODIFIED:
Tue May 7 07:55:38 2024
LOG_ACCESSED:
Tue May 14 16:36:08 2024
LOG_CREATED:
Fri Aug 30 07:36:47 2024
REASON_1:
YARA rule LOG_EXPL_Exchange_ProxyShell_Attempt_Aug21_1 / Detects ProxyShell exploitation attempts in log files
SUBSCORE_1:
50
REF_1:
https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html
SIGTYPE_1:
internal
SIGCLASS_1:
YARA Rule
MATCHED_1

- /autodiscover/autodiscover.json?@test.com/owa/?&Email=autodiscover/autodiscover.json%3F@

RULEDATE_1:
2021-08-09
TAGS_1:
EXPLOIT, LOG
RULENAME_1:
LOG_EXPL_Exchange_ProxyShell_Attempt_Aug21_1
AUTHOR_1:
Florian Roth
REASONS_COUNT:
1

Notice 237

Aug 30 08:35:02 WIN-LRTT94FA08M/10.100.5.12
MODULE:
Report
MESSAGE:
Thor Scan finished
END_TIME:
Fri Aug 30 08:35:02 2024
ALERTS:
9
WARNINGS:
8
NOTICES:
236
ERRORS:
0