abea0fe5287bf20e552a4d984af26406951be606a754859772ed9eb39eb68f3c

Sharing

Copy URL Twitter E-mail

General

Target
wp-admin.zip
Size 2.7MB
Sample260419-wtaaaads7w
SHA256 abea0fe5287bf20e552a4d984af26406951be606a754859772ed9eb39eb68f3c
MD5 fdb63380716ff92b3f624df62592fe16
SHA1 ecf1a46f1c53cb9c2d60a25d01b774fca95779fa
SHA512 e0bc59d82d4ad36c68eeee0667c9339d68a1bd8901490ed401fe9d97e6e92a8b729527c9b7d89c349231cc5524d096f8810a1eb123d0b7f25c6bad5a85be0e17
SSDEEP 49152:PxPcqXf0RV1IBjCIUodoEkDLkEBzhz4Fv6jZtYO6nsoyF2f:PRcOf4wBjl/d8DwszOR6jZW88f
TLSH
T1F6D52379EFF502E1E92E5A749C9D623544AB826E70097C1F1AD68A94CB4F3CB3E31704
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Language

Source

URLs

exe.dropper
http://api.wordpress.org/plugins/info/1.2/

Targets

- Target
  wp-admin/about.php
- Size 13KB
- SHA256 45d69d0c1d84dd550faaca7b608b14cb1b2ae05a935577e62bb660afebf96de6
- MD5 4dc4cc968282547acc3cc7de732a11e5
- SHA1 eabfd2f8219fad04617c93698ced0de76ebc916c
- SHA512 499d5aa52b8de06976ba6bda10596fc05747bee1772c448764ef7107a472ac3186bbd0bbcdb9199d77212499bdc910b1719a7e530721724f5abf832dbdeb101c
- SSDEEP 384:Czw0BdzagBiSTCpOqiZ77U7pIsAF0dnMC2E2c8P6:C0gdzagBiSWTqZWRM56
- TLSH
  T10952A306E19C0B3F0185179B206926EA71DF8C7CB272C8EAB977C15973458698E3B6DC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  wp-admin/admin-header.php
- Size 8KB
- SHA256 53888fe38d46737d1defd6b83a39c01a9430bcefbcfb7316d35b1de149677acb
- MD5 e645babcc31bedf2a3b27f4c76d701bf
- SHA1 23c14088f8d200a00ac783396975bf0a96e635aa
- SHA512 a009b96eea9ed614dcc58710df265f2d9bd2a961487635d56c7147341a598fc8d26d6669e70699f0bbd746c7e5160c8a5bafa7cc4e43d656602fc1f1cf03de64
- SSDEEP 192:h/H4uT//m4fxUIddqqQxY65ifPEbWoAXZPXt/VC46q:94uT//m4ytd5iEC/VCXq
- TLSH
  T1070296451CF2677388A22ED166D1D278722B420BF3962854ACF641F89B4136C8DFBFC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  wp-admin/async-upload.php
- Size 3KB
- SHA256 8698df9c16aae71a27916262e39bed2667babb068de943a174f5c809b0760d01
- MD5 e1b95d740d3bfdd942b9e920efde5dc3
- SHA1 34c6afe14d8153f3776f365d15b9fc657ff57ce4
- SHA512 bd22e8987f3d4c71c24558b9bbf7e5a5c7dd1cd23add3b5c39c6f92717d4be20a30d0569f405ba041ed36d65939566dc5196797f53478dc81987370d89a1ac4d
- TLSH
  T1CB8178F5A7EC6396117370C49A49842CA49DC413B480AD999C1CF4E0DA8497FE4FAEFB
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  wp-admin/edit-form-advanced.php
- Size 28KB
- SHA256 4b69bb8c505c945b50f9159e4856e5377dcc76be91cb2b4cba383900e5974c58
- MD5 2d6750182210140993502b506792a868
- SHA1 fb42982602a92c4046a703522c459ce9c59f9867
- SHA512 395510d2b520435b7613a2b94b9c1109e3b31e03b9ab4e9ec79a2f222e7507ada07eea0101d792190840579da18325ab67bcfaf2509ce42828669a89be67993c
- SSDEEP 768:HDVb77oFwo5ufsX3EfqKb1Scvu5a8gIL+t2Oa6QEmbWZnStmB:jVb77Kwogf83Efq61ScR8gIL+t2Oa6QC
- TLSH
  T1A6D20856F1F4126159131682F8C4927CEEBD8455338158EEECBE94ECF783272463AFA8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  wp-admin/edit-form-blocks.php
- Size 15KB
- SHA256 585eade5e0bdb59475b33455b583b0dad861d9beef17388b859c74f1b4a572b0
- MD5 578c340082da621c6ff7fc9f4b337bb1
- SHA1 e4ba4aaf1e40735a0d12e647035b65c6f0ec4b08
- SHA512 6d3bf320e9dc28f9dcd86bff346813ec72811ac495bee3425ca4a1ffe3abee9528b01f03aff0ba29feacd8c3ee6b4b1d5fe75953bbe2770a7686290bab3384b0
- SSDEEP 192:CDK1YA7aJAXNhcK+2XmT66dJnrZP3E3+DFLOO3ceHPCVgn4YnU2A+:+K1YA7aJAVH67x68OYCa4YnO+
- TLSH
  T1B362F92364BCA33950222999EC1C907CAD584406775292E2FDFFBD586B4B1E94232FF5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  wp-admin/edit-form-comment.php
- Size 7KB
- SHA256 766c56740aa650c9efdfe12a1f7e9c11b5e4c0b694efb5f6c388a54a1785bf08
- MD5 b241cbbc14dc970d695e6f347ed1fe7f
- SHA1 6291714d522e670cff127be05f6912de4c3b406a
- SHA512 b0584e0c6b6d638723189fe12dfead8808dd4d80dec8b2fb16826a1f73b5e27cead6fac29ba0a2df213ec4a62f44fedeee42840a4487659b9a61cee1e1c89775
- SSDEEP 192:yosxqDLsvTQtuBkvalbNBNRjmyV9p/4it+P0MLexXLtkYyPyVKL:yosxqDLqTQtIkylHjHtO08rPyc
- TLSH
  T175F16593A0D44770C0E33CD16D9866B939C88709E2492C9CAABD84D86F50FF56D2ABDC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  wp-admin/edit-tag-form.php
- Size 9KB
- SHA256 dd47018d05ae54ee57563cda79c71184e81e91fdaabfb652e8a6305635e210b7
- MD5 b3d908df9c3890e0e9a3135ddeee9961
- SHA1 3ed24f66c46aed792acf9a99cdbe4e99f5d1ab4a
- SHA512 43bdc95ef4f8854d06f895e4b6103fbd39ae88969a20bdd53d16442ef109f0c0c20c386469788af6f668fe0218e9ddf99f8eec267b789af25af8732157a6ec7a
- SSDEEP 96:T4qPBKi8HRzkgVVaEEDb4NNve7JiysaImxdT+g79Hn3VIx7t558fFuFbC9q+ibej:sqZaklDb4Nvyxz9H+RtlG91KI
- TLSH
  T1342273F7A9DCA63045531EC03DD6734A3FADDE2976011CB5FA4ED89897209A2493BF80
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  wp-admin/edit-tags.php
- Size 21KB
- SHA256 4bf0c8309be6c0c9d30b1fd70283555d5d1b7cd6f1e5624658b424d9bc68f868
- MD5 458738f5a5fe4b02e9ee075048ae3e48
- SHA1 69b046a8bd133b1640b676ec9605b4c300ffe752
- SHA512 46f295d16bc08094dc3ec40652d22e8b7247b2d9708c78af7d2f4d975f7406c71adf706fa6cc46f70caaeec6d2c7ceab3bd1232a114779b19d776288398d2554
- SSDEEP 384:KQifrwOFN39fXg+qMQr/grJI1SMIeboLrAND8:KQAbplqMQr/grUkLrAB8
- TLSH
  T1C7A2D6EAAA9C527113131D80BDD8F25B7E7CC93436411CFA7A9CD458FB506A60B3AF84
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  wp-admin/export.php
- Size 10KB
- SHA256 37d8068176b5bf4f19819636b8314000db6766498b9412dcbe7cf7b761d0074c
- MD5 91b788ce5a07c722950d0deeb4809d04
- SHA1 7ce18d5fa6d6646f577756ef3bf50a26255d97fc
- SHA512 64d8b5fe716845cb6dda2c076b30f965db05494a84d33781bf7d6b9770e08ec87f5d9c9d32acba262d7a4d10ed3f527d8bc3516a3aefb6c1de2448785600d04c
- SSDEEP 192:f2hQfgBMvCqjyoZgHLnvKhwzkeBs31B8ToFriOGHXspIEm/F0R:ehQfgCv4o8KhJMoBZg2md0R
- TLSH
  T1A73285A3F5E88B31849B28D516A496F12AEC890591012CC6F41D46ECA7D1D6DCC3FEEA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  wp-admin/images/about-badge.svg
- Size 6KB
- SHA256 6c0cfc4519b0c06d8b9205927718996890393e426f6976af1c5687e670eee9ef
- MD5 f76edaa29755d71bdfd2f4fbca044dec
- SHA1 a1c48c0c96eda796acd94812ee976846653223ae
- SHA512 23ae29664799bf331a55f460f686eb331b412645d584651553c220e45356c5f186c5be28f50a76041e00cc79654f4d12d1ab89381d0741d87af520b89f68a0b8
- SSDEEP 192:VmCrxQS3nl8WCxpvVAC8ADTnlS0ZPVKaS9QIK:VmCrxz3nl8xxVWuTjZMa0VK
- TLSH
  T152D152D66731DBCC64AA4D6CEF2F7594190EB0FAAF771484C296CB0E48D3AD8B645C04
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral19 behavioral20
- Target
  wp-admin/images/about-color-palette-vert.svg
- Size 3KB
- SHA256 2174da56fa96cbe556a43cbcbfd4f1c255cd72ccbba077ed75f1e698ffbead7a
- MD5 7b8541ecff36c415bc9771ba5dd9fa1e
- SHA1 ea6fd9016bcab16982a0dfe025367f0a92f28217
- SHA512 435fad0dfce04342c1aac560ff86b927db23ac97d646af08a92e2e328c36a18b38fcd701d255d01d84eb8b0c717ef8f177465ab906f06c78622079e844c632f9
- TLSH
  T1DC717BA2629C922DD7015E2A439D9AF652DB7218933F4108B5803748D9165FFECF874F
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral21 behavioral22
- Target
  wp-admin/images/about-color-palette.svg
- Size 3KB
- SHA256 ad2741460e847309b877868437710868729acf9390ab87fb5a1225be2b7b00bb
- MD5 8bd04287b18269e5680aeb5b76f2c5e9
- SHA1 cdf12bfb2ec911d14ef80c05ced421eb732820dc
- SHA512 07ae6733779bd1b347b2d8e49f2cbc39390884bb78ca21a40970e95f14593223794a820a0d7c39d3efb5dac7f03eee5ffce74e360dd5baf7b2ece4c079b83dac
- TLSH
  T1B0615C92629CA20DAB415F6A839DA6F75197B118537F410CF6407308E42A6FBACF874F
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral23 behavioral24
- Target
  wp-admin/images/about-header-brushes.svg
- Size 136KB
- SHA256 7fca7ab387e65e721a273f643839ac6c3981aa3c84a133a294c34f217773f0fc
- MD5 97067f0a8d3a5503792de79bdcb41023
- SHA1 9fef2d606a1b2c49454c1f675a32a09f38204be1
- SHA512 64ea058af0b4287422eb6a02133835cb2130ceb4da09e3c9a99ae6b80ad2d7a74d8471914a74eef6edad0f26913b3c3aeb2bce0e2536df9555709f89e109f50e
- SSDEEP 1536:Skjq66RaJkVG4bKD+/DtjPA6sDK4Tza9vZrQVfBWhPwKVjLa7ErpTHD:SFKoDELl7s
- TLSH
  T124D3B3DD0370E3809ECAF95EFF12ADA9512690FE99A656C181DFEA4D58C3DD5FA08C00
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral25 behavioral26
- Target
  wp-admin/images/wordpress-logo-white.svg
- Size 1KB
- SHA256 a069a75b57617e5a262c71466627b5f05a67d4e70646efe72dda4e1ad6130b41
- MD5 19bdd97150fb43aa862d53500c44e6f7
- SHA1 b288b88784b040847db124ece3bf332e4a4173a9
- SHA512 7c963de397dc51317d5ed7283322ef3a34896a6a4981d55278f3c550c85d27ddd4eaddf91912a535934017709e8aab38d65c4ba72af3225b30ba8a9926763d39
- TLSH
  T108311476D6085394BAA38A58DE338061370F7CFC579E63B12262C37379816D4E4C4D6C
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral27 behavioral28
- Target
  wp-admin/images/wordpress-logo.svg
- Size 1KB
- SHA256 a0bbefd626f1e76f9245ec6c6101b679ba27412b71b32fc43eccda9db40f394b
- MD5 f34ef6259364f7ef0ccf67cd1dddc970
- SHA1 18b563726b3d24a73552791fff91f61077ae1ec5
- SHA512 c4ef2a19b114946484a6fadbe9bcfd80111779a5bfce8fa1d38bc09915a6e660978435f7796b34a7c71668d97c0e87186188ee5ba1704aafa592c22754e63651
- TLSH
  T1D131008D873958FC68A693E4AF30B8A3262C95DA5171D988931D993169D0CC9EB44CD8
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral29 behavioral30
- Target
  wp-admin/import.php
- Size 7KB
- SHA256 b26d07a78e0105edcae3f841c8436548887e71cee5115623148df9127594f37b
- MD5 22d1d69211e7d079a044d091c61e2397
- SHA1 588725622fde60d3646e0500ed1f2bab1a09c5cd
- SHA512 9e8d71431969a3948c7c40e2173200f2846ee2316fbeaa5f0273a5e8e927463cb72b881ca8015a06922c3fae66d8b9b04cf2676751f0e9d95ceab3e4605dfd41
- SSDEEP 192:Prgb3a4fPHNqdiDOPzAwWF2VpflBd5AKscX8:TgjRlzoALIVZgK7X8
- TLSH
  T187F18463E7DC21370572EAC81A9801F521FE81B1730199AAB8AF07747FA7178A97690D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32