Overview

overview

1

Static

static

wordfence/...er.ps1

windows7-x64

1

wordfence/...er.ps1

windows10-2004-x64

1

wordfence/...al.ps1

windows7-x64

1

wordfence/...al.ps1

windows10-2004-x64

1

wordfence/...dom.js

windows7-x64

1

wordfence/...dom.js

windows10-2004-x64

1

wordfence/...net.js

windows7-x64

1

wordfence/...net.js

windows10-2004-x64

1

wordfence/...dom.js

windows7-x64

1

wordfence/...dom.js

windows10-2004-x64

1

wordfence/...ium.js

windows7-x64

1

wordfence/...ium.js

windows10-2004-x64

1

wordfence/...acy.js

windows7-x64

1

wordfence/...acy.js

windows10-2004-x64

1

wordfence/...ypt.js

windows7-x64

1

wordfence/...ypt.js

windows10-2004-x64

1

wordfence/...int.js

windows7-x64

1

wordfence/...int.js

windows10-2004-x64

1

wordfence/...pat.js

windows7-x64

1

wordfence/...pat.js

windows10-2004-x64

1

wordfence/...pat.js

windows7-x64

1

wordfence/...pat.js

windows10-2004-x64

1

wordfence/...pat.js

windows7-x64

1

wordfence/...pat.js

windows10-2004-x64

1

wordfence/...519.js

windows7-x64

1

wordfence/...519.js

windows10-2004-x64

1

wordfence/...a20.js

windows7-x64

1

wordfence/...a20.js

windows10-2004-x64

1

wordfence/...Fe.ps1

windows7-x64

1

wordfence/...Fe.ps1

windows10-2004-x64

1

wordfence/...519.js

windows7-x64

1

wordfence/...519.js

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    53020f6d730c48b02753db607b67ddab05cb406028bd96acf14af8774e5747ba

  • Size

    5.5MB

  • Sample

    221006-mzvczahbc2

  • MD5

    b60bc7a1368902b90e37c2069b74bd2d

  • SHA1

    d20e4a38d2109b8476445cb16871f1c9bf80df7a

  • SHA256

    53020f6d730c48b02753db607b67ddab05cb406028bd96acf14af8774e5747ba

  • SHA512

    969c4d4d6c3815d30c47fbc985abb38c1eb704ef399ce5fe242f18c43d1911574a7d1bb6661f52e4ca20cb2177f0add103ff0794b8461cd6f5b28d9f52605e1e

  • SSDEEP

    98304:xIVj3KKW9olg7neB16ei7VmEIUmzGTpL6UUMBQkmX1esoS5fnogZYJRs/G8/:xQj3KFwg7SceWV/IUmqNpXBQfhflog+U

Score
1/10

Malware Config

Targets

    • Target

      wordfence/crypto/vendor/composer/ClassLoader.php

    • Size

      13KB

    • MD5

      92fe79b147d64dfa1421651d7839c9d9

    • SHA1

      f16a84d9abd7d61ba44d025ade55e5cec1273823

    • SHA256

      ae5f9cac4d65c0bfbc5d6301b4f0aafe26b54adaa99057909673d15344a50e6e

    • SHA512

      e95f90be793a521568a3bbe14f724e47f58173b8ed8c7907f799932fd9ef483ac4b9e741b572a0867a1afdba0c96fe7eb919980df240e158313286e4979cc66a

    • SSDEEP

      384:bRMAJdEE8VVa8j5QDnGtewQbuUNN7dJbZ:bjL6NyX

    Score
    1/10
    behavioral1behavioral2

    • Target

      wordfence/crypto/vendor/composer/autoload_real.php

    • Size

      2KB

    • MD5

      1eebf5ab9dc4650e79d5e7cb4206bf4a

    • SHA1

      0d7f80029b127cff0f4897e7dd1c019565b0ac9a

    • SHA256

      9571614c8965b983f4998f1a8f7703299beec9c44f5c7980b002444ae998bd25

    • SHA512

      2fe13425d631c7db301166bb8628884aac96521ad67502db922522ca2acd575446646359aa99d0875c6d3e25b1ccbf3fd1a65ac229c819e5ebc3a883e8c00b51

    Score
    1/10
    behavioral3behavioral4

    • Target

      wordfence/crypto/vendor/paragonie/random_compat/lib/random.php

    • Size

      7KB

    • MD5

      ad7f6e4800f775847d922060a4e8f3cf

    • SHA1

      ad2e39f541216b0f91e656eb196881f55cb57bd2

    • SHA256

      3783e4a576bd8db099f2cfd92d3c831e58dba07bcd716ec123d8b26b29350588

    • SHA512

      c0fdfb9978009497ac12e4f6e380d82f05a68f384e1d71feb832b49e019051286bc841bafc70fbaa10b699a769b59f8296ad2ebc7b50b37dd9603f207cc97901

    • SSDEEP

      192:jJwaYMQHRXA2rgSrZBxof6sCylCpHGasTkMZmxCH50mV1nlQkpoFOrTxTnbP1w0K:jJwUEZcShQFkyXTnGeBHJmZ

    Score
    1/10
    behavioral5behavioral6

    • Target

      wordfence/crypto/vendor/paragonie/random_compat/lib/random_bytes_com_dotnet.php

    • Size

      3KB

    • MD5

      4020f64dcfbcb3565fa169a609c2ef17

    • SHA1

      200149bc0b2def81b2cba6b9384d184e02dc0dc4

    • SHA256

      819fb071b3de0a7ae762f4f608a79f75660010afcedc93985f5c9561dee10e8d

    • SHA512

      09041b4229a21079b2072d86c99127654d3667b2019c8fbd4a0ddad867f13365579c45f0188e727387ddd806b432f415eadc8e311a0ba5ccae710a75a01b3c3a

    Score
    1/10
    behavioral7behavioral8

    • Target

      wordfence/crypto/vendor/paragonie/random_compat/lib/random_bytes_dev_urandom.php

    • Size

      5KB

    • MD5

      d40347c972f586bee59c105dc4e92fbb

    • SHA1

      6aa8c640bcd7ee63720af99977b46b3319d492d8

    • SHA256

      b52fdd1946a764d87df5055c6ca57b51b431d3933002b779b1cfcc83c1cdffb6

    • SHA512

      0b47be77bf1af9af5256678db2846684745389dd3fed613a63b9f24821b5afc8ede92d683f83305c8a2aee36e45aa557d3c614536af68f79a1f8bd17225ec385

    • SSDEEP

      96:jbXrgtkoQHqEorFZZgkFZZbbX2emZgvnHr62mfgFZZCCFZZCCJja6/FHsVHmSLSP:jbkkoQHRorgSrbbX2NZIL9mf2rCorCCh

    Score
    1/10
    behavioral9behavioral10

    • Target

      wordfence/crypto/vendor/paragonie/random_compat/lib/random_bytes_libsodium.php

    • Size

      2KB

    • MD5

      9f86775520e1e604db90364d865cbd38

    • SHA1

      579e371db7da795b13f9ebad607817ed40b5893b

    • SHA256

      310bfc681001fba40ac842299f6ecad03f699c8415e3a9ce789558b30442b53f

    • SHA512

      bec413bad4e3a891578cee90f88493656ba9fcc5f77e40bb2ca72479abeb03a18810442f89f11fe72db30da5c6ebffd142e84cb2dfa8de5d18fe2c239c3a2764

    Score
    1/10
    behavioral11behavioral12

    • Target

      wordfence/crypto/vendor/paragonie/random_compat/lib/random_bytes_libsodium_legacy.php

    • Size

      2KB

    • MD5

      43ef0e8b1c010220835a0e38e5077422

    • SHA1

      5fcab46bb8963027f16d6afddd8a32006ded7a88

    • SHA256

      5aec8b4462272a3ff979b1436714adc0716ea750c9ef0533c81dd915634341a2

    • SHA512

      68039c638b4ecf275b74c129505ea402cc5f5f25e98865e9d4d46eac48c38f06d452c057d1325c0b8fbe8184e77a09d4d7d74357e4053e57f763fdb50205dedc

    Score
    1/10
    behavioral13behavioral14

    • Target

      wordfence/crypto/vendor/paragonie/random_compat/lib/random_bytes_mcrypt.php

    • Size

      2KB

    • MD5

      e13d6f6e7e5a83841cd2544f51964265

    • SHA1

      a530295fbfb2f5abd69904040875eb1185480540

    • SHA256

      f9d5d756c04a96dbe73b60781a9f6b511bec54dac97b00fb521e34b493acda8d

    • SHA512

      e5fcf1db06d4cfcef46208094c5c0cc69bf804d930e94c8658ec33ba00d83c5bbba6487ef7070efbc296ca043137f91bf4e09c62c8c81db21262d57be16ada49

    Score
    1/10
    behavioral15behavioral16

    • Target

      wordfence/crypto/vendor/paragonie/random_compat/lib/random_int.php

    • Size

      6KB

    • MD5

      f8cc1daed94a0e987381d306c799f942

    • SHA1

      f925cdcb9ff25373c0f87e017e729902693754b2

    • SHA256

      a1b898ef135fcf829908e2096a5609483793dc9baba70b67c9078a9c440a5a09

    • SHA512

      d4fa2830973ef2888edc0039571079890486cd65bae2003b7d24d5c5dfabda1de7ae66aa6b3278ae9b62dccfca964e8f5ac4686b7040774cfb481cebe55fc252

    • SSDEEP

      192:QlvMQHhWAoEQSDiGHGdI0eJslx8yyV7/CVN2BqzzvmB:QlE0j+QCDvmB

    Score
    1/10
    behavioral17behavioral18

    • Target

      wordfence/crypto/vendor/paragonie/sodium_compat/lib/php72compat.php

    • Size

      40KB

    • MD5

      efaca89101727a057f1bbaa00cdf64da

    • SHA1

      a862998a237223e9c151599f46a2610f197dee5f

    • SHA256

      c8f20a30ca7eaf5f76f825e9073d4c89d3c81965b4c55dd8d25bbd746ff8f7ed

    • SHA512

      ce60be0e26bb65bf5ab2c2ae6ecf3e653a25f9dc462aa847cbb88247bc6760418ee34a070e981ae7fa0ef96f6c2df82ca5734ce35fee9bbe926ab16fdfe28ebe

    • SSDEEP

      768:NVR33H3APx1skpqn2Y2m2A2f2E2q2u2j2U2u262X272z272U2z2d2x2g2t292j2n:NVB3H3APx1skpqnV9dupnjeP/BQcikzs

    Score
    1/10
    behavioral19behavioral20

    • Target

      wordfence/crypto/vendor/paragonie/sodium_compat/lib/sodium_compat.php

    • Size

      24KB

    • MD5

      f682638a7afbdb0c708903f6fc288a2c

    • SHA1

      c981470c74b777c554998c1e94a2373180ad8499

    • SHA256

      4f4457f8b228866b3fd584dc43c13c623e0969057c46eced5f589fae9c753031

    • SHA512

      c7fc619eaf80fde22ed7956ee03ac93f47f08e7c923e8387fde6c5e08f84db1f6758f68775ada94d08b0805c8a37ca3e21c6cd817820613e33dbfb4a105d6cf0

    • SSDEEP

      768:k373mPj1VkFqI2Y2A2A2b2E2y2u20272X272q2z2v2x2KYTsE:k373mPj1VkFqIVpdcpBjvc8kPoOqjYTr

    Score
    1/10
    behavioral21behavioral22

    • Target

      wordfence/crypto/vendor/paragonie/sodium_compat/src/Compat.php

    • Size

      131KB

    • MD5

      5190e4880452eb4e1a62384df2679e7c

    • SHA1

      e2ba6ff0c4e266a1585bab7796bd3f213257aa22

    • SHA256

      9937e7b3acd90b55363ec966e50e2e38f7bf5ef095cd54f6780ebfa7930e6d76

    • SHA512

      cf9d0872e5799526e196ca8ec199eed4fd8ab47169bea1ad981c1b9cdd67a947857fe263eeda20c7e81bb94119e79e941f440a5ec3b9f2011a7237815d47f3ec

    • SSDEEP

      1536:ukXg2cWrBy6gH5bAAR3q8N7oCR5mQ2PO+eTHw1s05hrtAeXFkVsXzS2BYqn11jsX:IAFkVsXzS2BY2sefP7cL

    Score
    1/10
    behavioral23behavioral24

    • Target

      wordfence/crypto/vendor/paragonie/sodium_compat/src/Core/Ed25519.php

    • Size

      15KB

    • MD5

      7c1dc7b128b98d0f9872c0d771d6a723

    • SHA1

      1c3fb7ebb4c6e85edefc933d65975ed806315ecf

    • SHA256

      85db00a3dff51a90dbb1ff0d82671ece83210a0cbca60a13f46ba9b5c4d0b070

    • SHA512

      89c2a45ed26a89439785a72ec1be2eb4358363270f245b1fc7e30caa6e9761c4d70b2813ce7f031327d7128e96c694190786b188b61224256422362fb4bfc71e

    • SSDEEP

      192:ZYgguNMzF+pngd3SAl60+deU6i0bODVF3t7SelGFEG4LVtVVk7tTKy/:HFKCIXRi0bOBGFOtVVk7tP

    Score
    1/10
    behavioral25behavioral26

    • Target

      wordfence/crypto/vendor/paragonie/sodium_compat/src/Core/Salsa20.php

    • Size

      8KB

    • MD5

      43a3bc554f9ef51adfa0a1787448170c

    • SHA1

      8e1ce3694e9192e4f9f9f3629f35a45a9fc49cbf

    • SHA256

      17ebb1be9dfa8f08c95197c512523e7a134d554dd151fce0317a4321e89f87c2

    • SHA512

      66c75d32ce47d08f19d74ef51697d529903ca0bf7b98131f949bf81b9251addf43ec42cf8c6992021200db9047a671e3cccca835c3290d730a8d0639ef262ffe

    • SSDEEP

      192:j+JlY9RltY4w2l63KpPggMWG2AcsRTyzRXQ87D/Kq7h:j1zfnYGuMWqrRd

    Score
    1/10
    behavioral27behavioral28

    • Target

      wordfence/crypto/vendor/paragonie/sodium_compat/src/Core32/Curve25519/Fe.php

    • Size

      5KB

    • MD5

      4ee9560f6c7e1cf286136d5b25577404

    • SHA1

      eee8979d82214f83ee0e661f4da8078adebdf974

    • SHA256

      2a7d14c8eda6480e513b6ab6caba7c6f9605fd01042813a5b84b1d8be1934797

    • SHA512

      8ab5a8bf1fcca779bfb042f36a727a649511d0eb2b74ead34d23e8242409ae407f09f53304c465c4500e2a87deffda5639141d93caa29deffda431546dd60df7

    • SSDEEP

      96:t65S1PE16r8VgkBx5tUJtyuJmgk5seVOyu/XD2P4fSoEhyw4pp7oBGhTI163MJe+:E2E164WgDUTym1JeVOyiXD20TEsjTMB/

    Score
    1/10
    behavioral29behavioral30

    • Target

      wordfence/crypto/vendor/paragonie/sodium_compat/src/Core32/Ed25519.php

    • Size

      15KB

    • MD5

      0f2749e2cb9e036146747a5c04c4c7ae

    • SHA1

      a2f58e8aaa022f310297f4fc7460594cdf3a4e9d

    • SHA256

      19c2ca9061ff637926b6578c18c3c061b9a1a07820da795a8961da2bd9c767cc

    • SHA512

      078e69b8a32374c0135fb31071a2e0ebaf5150dc52d429f30c335b8f0a2964332da6d46552fbd98348e150fa9ce139914b2dc657e283dfab56e915c5dbd873ba

    • SSDEEP

      192:ctgguNMIF+pngd3Wl60+deU6i0bODVF3t7Se0GmEG0zEtVVk7tMKy/:/2KmXRi0bOQGmPtVVk7tm

    Score
    1/10
    behavioral31behavioral32

MITRE ATT&CK Matrix

Tasks