Benign windows Download

vcluster

Legitimate vcluster Kubernetes tool

GitHub release URL piped to shellAmplification chr() payload suffix

SHA-256bbf87a5b0c3679b4a062f3606b9a849623a1a3b604d5fe76a3f37dd560a00bbe

URLhttps://github.com/loft-sh/vcluster/releases/download/v0.37.1/vcluster-windows-amd64.exe#/vcluster.exe

MaleculeK₃(Li₄McTe₂)O₉(C₇As₃Ca₂Dy₂Er₂Eu₃I₄PS)H₉(Cm₃₂Cr₁₂Db₉F₇HfMg₂Os₁₅Po₁₁U)Md₆(Bi₃BkPt)

Evidence

Large PE with elevated code entropy 0x5c0–0x870

⋯3 more rows
0x5f000000000000000000000000000000000................
0x600ff20476f206275696c642049443a2022. Go build ID: "
0x6104979573946734646553061373452785aIyW9FsFFU0a74RxZ
0x620414446632f66586248627447614e6455ADFc/fXbHbtGaNdU
0x6306f746d336d434e6e682f79326e4e354dotm3mCNnh/y2nN5M
0x6404756566a6b584c6f5a36737a73612f36GVVjkXLoZ6szsa/6
0x650504f6b364c6f5675776e6473654e7241POk6LoVuwndseNrA
0x66048496b220a20ffccccccccccccccccccHIk". ..........
0x670cccccccccccccccccccccccccccccccc................
0x680493b6610763d554889e54883ec104889I;f.v=UH..H...H.
0x69044242048895c2428e843050000488b44D$ H.\$(.C...H.D
0x6a02420488b5c2428e834000000488b159d$ H.\$(.4...H...
0x6b0700e064885d27405488b02ffd04883c4p..H..t.H....H..
0x6c0105dc3488944240848895c2410e8ae08.].H.D$.H.\$....
0x6d00900488b442408488b5c2410eba2cccc..H.D$.H.\$.....
0x6e04c8d6424f84d3b66100f86cb04000055L.d$.M;f.......U
0x6f04889e54883c480488984249000000090H..H...H..$.....
0x700eb064889fb4889d04885db0f84590200..H..H..H....Y..
0x7100031c9eb0348ffc14839d97d0b0fb614.1...H..H9.}....
0x7200880fa2c75efeb0748c7c1ffffffff48...,u...H......H
0x73085c97d0c4889d931ff31d2eb300f1f00..}.H..1.1..0...
0x7404839d90f876b040000488d51014839d3H9...k...H.Q.H9.
0x7500f82590400004829cb488d73ff4889f7..Y...H).H.s.H..
0x76048f7de48c1fe3f4821f24801c24883f9H..H..?H!.H..H..
0x770047c8f81386370752e758731dbeb0348.|..8cpu.u.1...H
0x780ffc34839cb7d0c0fb634184080fe3d75..H9.}...4.@..=u
0x790eeeb0748c7c3ffffffff48897c245048...H......H.|$PH
0x7a0895424704885db0f8c670100004839cb.T$pH....g...H9.
0x7b00f87f4030000660f1f84000000000090......f.........
0x7c04883fb040f82db030000488d73fc4989H.........H.s.I.
0x7d0f048f7de48c1fe3f83e6044c8d4b014c.H..H..?...L.K.L
0x7e08d14304c39c90f82b30300004c894424..0L9.......L.D$
0x7f0484c895424604829d94c8d59ff4c895cHL.T$`H).L.Y.L.\
0x80024204d89dc49f7db49c1fb3f4d21d94e$ M..I..I..?M!.N
0x8108d1c084c895c24584883f9037513460f...L.\$XH...u.F.
0x820b70c08664181f96f6e757a4883f903eb...fA..onuzH....
0x830274883f904756e460fb72c080f1f4000'H...unF..,...@.
0x840664181fd6f66755d460fb64c08024180fA..ofu]F..L..A.
0x850f96675514883f903410f94c10f1f4000.fuQH...A.....@.
0x8604883fb077526440fb71c30664181fb61H...u&D...0fA..a
0x8706c75190fb67430024080fe6c750e488b[email protected].

Immediate process-information class value 30 0x25639d–0x25645d

0x25639d89442470488b8424a0000000488d1d7a.D$pH..$....H..z
0x2563ad0d3903b902000000e8067aefff488b84.9........z..H..
0x2563bd24a0000000488d1d630d3903b9020000$....H..c.9.....
0x2563cd00e8ed79efff488b5c24504885db750a...y..H.\$PH..u.
0x2563ddba1e000000e9af010000488b8424a800..........H..$..
0x2563ed0000488d0d3aca7103bf010000000f1f..H..:.q........
0x2563fd440000e89bf2dbff4885c07c1b488b84D.......H..|.H..
0x25640d24a0000000488d1d150d3903b9020000$....H....9.....
0x25641d006690e89b79efff488b8424a8000000.f...y..H..$....
0x25642d488b5c2450488d0d77ca7103bf010000H.\$PH..w.q.....
0x25643d006690e85bf2dbff4885c07c1b488b84.f..[...H..|.H..
0x25644d24a0000000488d1dd70c3903b9020000$....H....9.....
0x25645d006690e85b79efff488b8424a800    .f..[y..H..$..  

ChaCha quarter-round rotation schedule 0x333746–0x333806

0x3337462c44895c2450807879000f857c010000,D.\$P.xy...|...
0x3337564c898c24300100004c89842428010000L..$0...L..$(...
0x3337664889b424200100004889bc2418010000H..$ ...H..$....
0x33377648899c24080100008d9a6e64203331cbH..$......nd 31.
0x333786c1c310418d4c1d00894c247c31d1c1c1...A.L...L$|1...
0x3337960c448d2c0a458dad6e6420334431ebc1.D.,.E..nd 3D1..
0x3337a6c3088b54247c01da31d1c1c107418db2...T$|..1....A..
0x3337b6322d62794431e6c1c610458d243744892-byD1....E.$7D.
0x3337c66424784531d441c1c40c478d3c22458dd$xE1.A...G.<"E.
0x3337d6bf322d62794431fec1c608448b542478.2-byD1....D.T$x
0x3337e64101f24531d441c1c4078b7c2440448dA..E1.A....|$@D.
0x3337f6877465206b4531d841c1c010448b5c24.te kE1.A...D.\$
0x3338065c4501c344895c24744131          \E..D.\$tA1     

Immediate process-information class value 31 0x20c9606–0x20c96c6

0x20c9606ffff4d3b66100f8635040000554889e5..M;f...5...UH..
0x20c96164881ecd0010000488984240002000048H......H..$....H
0x20c962689bc24180200004c898c243002000048..$....L..$0...H
0x20c963683fb2075120f1f4400004983fa407507.. u...D..I..@u.
0x20c9646ba1f000000eb1331c04881c4d0010000.......1.H......
0x20c96565dc348ffca0f1f4400004885d27e1945].H....D..H..~.E
0x20c96660fb65411204c8d250e58e703450fb62c..T. L.%.X..E..,
0x20c9676144538d574dceb074c8d25fb57e70348.E8.t...L.%.W..H
0x20c968683fa200f83ab030000450fb654112041.. ......E..T. A
0x20c96960fb614144438d276ae48898424000200....D8.v.H..$...
0x20c96a6004c899c24400200004c898c24300200[email protected]..$0..
0x20c96b6004889b424200200004889bc24180200.H..$ ...H..$...
0x20c96c6004c8984242802000048899c2408    .L..$(...H..$.  

GitHub release URL piped to shell 0x374086d–0x37409cd

⋯3 more rows
0x374089d20262620627265616b3b20736c656570 && break; sleep
0x37408ad20302e353b20646f6e653b206375726c 0.5; done; curl
0x37408bd202d73664c6b202268747470733a2f2f -sfLk "https://
0x37408cd6769746875622e636f6d2f6c6f66742dgithub.com/loft-
0x37408dd73682f76636c75737465722f72656c65sh/vcluster/rele
0x37408ed617365732f646f776e6c6f61642f7625ases/download/v%
0x37408fd732f696e7374616c6c2d7374616e6461s/install-standa
0x374090d6c6f6e652e736822207c207368202d73lone.sh" | sh -s
0x374091d202d2d202d2d736b69702d646f776e6c -- --skip-downl
⋯11 more rows