995ec144bc4cb6e3cfee9ed28cf3bc22b231dfe193b3eb82d741273c6dfb0ad4

Sharing

Copy URL Twitter E-mail

General

Target
wordpress-6.2.zip
Size 12.6MB
Sample260422-pl8dsabt8z
SHA256 995ec144bc4cb6e3cfee9ed28cf3bc22b231dfe193b3eb82d741273c6dfb0ad4
MD5 a90213ab774907c2099c71025b21f5ac
SHA1 71b63effa42965247cb57b98b5e43e34fd0d04b5
SHA512 7747483e5b45172dc2dc1081a20dcbbfbb384cfa79c5c943d6ce438332fb52c6ad898cf33a4a321983edaf8b3f70f674c7c4e671719dabdf1154ce255dd1825d
SSDEEP 393216:hu28G8Rr5GmGLeuwR+YUCxlqQuCJXlY8Lv53Jgo:hp8G8p5GmGCuwR+3CHqQuCJVt5go
TLSH
T199D62318F27D0520D7E79BB82CDB4E16E16DA1165722B31B8FBC9180AC9A2CE1F03757
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Language

Source

URLs

exe.dropper
http://api.wordpress.org/plugins/info/1.2/

Targets

- Target
  readme.html
- Size 7KB
- SHA256 94d15828ce2cb0d491b579106af13fa12aa79591b58f2b554e873717efd0c1f5
- MD5 5e408385ba5baad561f45380dba623aa
- SHA1 82028329e5779f21700ca6c68c74f8ede0012b10
- SHA512 23068223ec118cc249cdae9f07e54c18fb0f4b7d1488a48afbebbd1a3fae7a7936368aad9cb88a9f366a17600434fc0864dcef4250d13f0c486b82bfe5a1206a
- SSDEEP 96:4UK8pz1E/4kF5kyJ0ifN8uueKQeth4wtcwYKuID9kKCZxjD+9+25tdLwGg1IZz6+:68/SVPmui3C/Da7d0euCidI
- TLSH
  T12DE1846BB540537A135143B1600621BEB33300BEB79D4646549BE62EBBA23B4AF7F0DD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
behavioral1 behavioral2
- Target
  wp-admin/admin-header.php
- Size 8KB
- SHA256 7edf2bd80117c1cbda7ec2d0dd8850c68a2ed4634286404afef202a832e370ff
- MD5 6cf9030deced5093707fb0ed5f135aca
- SHA1 12d23dda690e9ea73d31286d0ef83f8d8fc879d5
- SHA512 7ea967fbe847fcab5e3fb207b94ab104673510fbf2670641b2b31bcac9a799fd9b8a7b3aa137bd848ecb6add3e606f193573a23e9d3ea6e73e0c0087c5c3699e
- SSDEEP 192:h/H43xQB/m4TxUIddqqQsY65ifPyWoAXZPXt/VC46q:943xQB/myyYd5iD/VCXq
- TLSH
  T1B70266451CF2673388A22DD166D1D278762B410BB3D52855BCF941F89B4136C8DFAFC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  wp-admin/async-upload.php
- Size 4KB
- SHA256 7dfab663df16c2d8d25834b7368b9632001abcfe6662478e6205a7cc5614d739
- MD5 f051354b8265bfc5b95c542372ea8a00
- SHA1 fc73711b93b0255b263f031d85a52f664ebb00c2
- SHA512 e686eace9c55e5825751e0d04d86d3e60e191b011f4cd7e76ff60cba709744eafc616fa828b3e9a5eb0847389f7454b656d739e2ec2b81e6c68c27dc312365f8
- SSDEEP 96:tKikv2f2NpGSrpPaxACeP8M4RoOqg754Vo6vngDnVovMmDhscCJgjE0ZDW9QgM:t7Vf2gx4P8HCil+f+QE0ZD9
- TLSH
  T1BFA175F1A2EC6766513371C45609842C649DCC37F490AC99BC2EE0E0D680D6EF4FAEA7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  wp-admin/edit-form-advanced.php
- Size 28KB
- SHA256 2ccc534f00501e630149b75560d7859a9d3e91e222bd72575831dbb3e68546d5
- MD5 587d688ef00a2b4650b87553561aaab9
- SHA1 c3f96e41edf22d938402e5771e302f070d3b5f95
- SHA512 90d2ddcd70655cc4c4961ff85b5bd184beb842effcea65b017c70f8b7781c82e9191a5b39215be41adcadb5854ce7a87018596e34527b7f2004c36293016b54a
- SSDEEP 768:D9VrD7o895VXfsX3EeqKb1Scvu568gIL+t2Oa6QEmbWZnSjmB:xVrD7195Zf83Eeq61Scz8gIL+t2Oa6Q4
- TLSH
  T17CD21856F1F4136159131682F8C4927CEEBD8455338158EAECBE94ECB7C3272463AFA8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  wp-admin/edit-form-blocks.php
- Size 10KB
- SHA256 cb74ffb58b537b5fe8d3707fe80397a8a6b1c8229eae0ee8fc1773183c738bc0
- MD5 70000f1efd8cf24e5bdb60804a2af6c0
- SHA1 3e064622e7a1e8e67cac06d4470211ca63de82a4
- SHA512 f1bc7c5df7fd35a6c4f5a3a3a1032a393f28a70e2eefd8ef38a558cbdb7c1b125e0bd30ba5b8791ad32c3e746b247811e6ca5d8386bb8bebb448d01b756cbd67
- SSDEEP 192:M0DKaZp9AVx+2BjZH3f3DOBaGbJF+0x23nU2A+:rKaZp9AVxPDOFrKnO+
- TLSH
  T136321A07A4BCA37940222695DC1CC5BDAC31098A3741A0E1F9FEDD885B4B1D68B30FF6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  wp-admin/edit-form-comment.php
- Size 8KB
- SHA256 b994079a3e1cbdb637866dc7f22f9c1c645f4186633ea91822bde117e9b78e3a
- MD5 05a28a3e49baaa396a40730b08e76ff9
- SHA1 f30c37b3481833953d5ed7647930bb879fcfde8a
- SHA512 625402537ace95e3d1fe167009e47d3b60ee0c8db8eb16e06ab9e7c49f625678f879a66e898b1759a811167a0e0441929313a6ad680e50e3ed4d8031e1b6bfaa
- SSDEEP 192:TosxqDLyvTQ/fuBU/albNBNRj8yV9p/4iCtoW0MLexXLtkYyPyVKL:TosxqDLsTQ/fIUilHjBCSW08rPyc
- TLSH
  T17D02769390E44721C0A33CD12D9867B939C88709E2491C8CAABCC5D86F50FA66D36B9D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  wp-admin/edit-tag-form.php
- Size 10KB
- SHA256 1b842e7e8e3841c4976aed04c51465bf2be291efe9f4b043c4913883a8ad74b9
- MD5 5209d1229b274fb900b265e5b8da8dab
- SHA1 97c7058f13da9357cbdf1d78b59db6b9e00104c2
- SHA512 bc73627e54139c9d4c34372da70a75ad343907726df262c78090524554f3b756631b8d2d9bb226c3c84c88e54b7bcd0575f4cf67327b8eb0e6f1d2e4b57d7a83
- SSDEEP 96:T4qPBwi8wvRzkg+VaE2azn47Nve21Jiysa/xdT+g7KA5HK3EIx7a558ZF8C9q+iM:sqZnkbzn47kyBzJqVRaw91YI
- TLSH
  T1F12284F769ACA63054530EC03DD277493FBDDE1976010CA5FA4FD8989721AE2492BE40
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  wp-admin/edit-tags.php
- Size 21KB
- SHA256 65c6a6838612191ee6cdb66f2a2872a07e6ac79e7b7d904fac8e3cd1adf6ded1
- MD5 b357ecc6a9ef40bbed68de561cdd03ba
- SHA1 1924ce50caac66b744156bf9c874fd8cb676d98d
- SHA512 29f585723d30bf78947c2c24f03e79695acad65c97300d4603dc2a63eb9275678a97802484236cf901e33450b365a50348950e0a892d789b5a56e72b0128aab6
- SSDEEP 384:KQifr45FN3CfXgsqlcrxgrZU46rPhkaLrANi8:KQ7bU1qlcrxgr2VLrAQ8
- TLSH
  T14AA2F7EAAA9C527013131E80BDD8F35A7E7CC92472411CFA799CD458FB506A64B3AF84
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  wp-admin/export.php
- Size 10KB
- SHA256 f95e4487f40a7d0054785bf4b9483e773d33ae32b57f1a8ecf203d46100ebf42
- MD5 1a45cc3f77ff0e16789d3da8530c52db
- SHA1 018fcaa072038f23acca9927ad5d92584e25ca35
- SHA512 37686b7a8df2633b5f97cd6bd39dbec89f7839f2490e84fcb1d0198db88bae6495abcbe630a59e48737c5a796d4bba05c104960e5eecb00a3ed615c199161519
- SSDEEP 192:f2I9QVgBMvCqjyoZgHLnvhhIzkeBs3QB8ToFriOG1XspIEm/P0R:eqQVgCv4o8hhxM3BZg4m30R
- TLSH
  T1593296A3F5E84B31849B28D415A497F13BEC890591012CC6F81D46ECA7D1D6D8C3FEEA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  wp-admin/images/about-header-about.svg
- Size 4KB
- SHA256 b6892c056e6d7c508e33426a29dc8e8f5020c679ff15079879321c8721f3a543
- MD5 f30741dfd3211b992a26db8d55b40cb9
- SHA1 e76160258260b571c0734752c2b1423d5300a62f
- SHA512 b5e4f6fa27443f0d77a138fec7dbefa30a6577a3da709552763abc00caa74b6f94227f7ee753ce2ccd81c7fe97c66b823b919f5e031c94fd2d94fca51e4c8667
- SSDEEP 96:5XUUfEjXPv9bP968eU8syo/C8Vv+0bOSOuRtKjxjbf11qq:5XUUfEj/v9bPQH9847SfSFj7f9
- TLSH
  T17DA186FCF734A7E8CD485EEFB3250CA4396A74BA78B20718C098D6243463956D9538ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral19 behavioral20
- Target
  wp-admin/images/about-header-credits.svg
- Size 2KB
- SHA256 2b5909f206072c286071f46720ca621ef09a2ff3f14abb67c054c4de7b9a77aa
- MD5 c45d92dd4d2fdcac217e2881a91b5965
- SHA1 570ceefd22a68fef0f54da187de14cd79966a355
- SHA512 d4a4068ef5ef113181427a31c56fb18536b4ce75e817eea5b2a7bac6c78c16582c1ca147ea73fe5a2760477103524e8fc5b31cf0e77b010b05bd726301bcfbd4
- TLSH
  T1F3513B7CDC2932F8A2CD534773349DE9B46E7056A8B2989C241C9774B303989DF62BC9
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral21 behavioral22
- Target
  wp-admin/images/about-header-freedoms.svg
- Size 1KB
- SHA256 25d90f4e4634e4d8b312afa64aa738ba03c1fd3537912c490f51ecdbac03af8b
- MD5 05e40582de52ad4f8b32125e805ad34f
- SHA1 4907e6bec73ff362754f35778b2d64c99d8e4afc
- SHA512 284c5206941eec15ca8b665b6b2fe91717ef38537efb784c8b9a4e6c4930524c0749d5fd6d3cb1de39f4496d0d383fd9ed89a21143fb4cab4dea02ddb7900487
- TLSH
  T12E11606CA61931B4E19C0346B7386CE4317E3091D6B628CD781C6670B21B5A9DE73BD9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral23 behavioral24
- Target
  wp-admin/images/about-header-privacy.svg
- Size 1KB
- SHA256 4446890adf53c2f3f7ab2f954146b6b48f3b6b4828628ae63718bc2df80178b1
- MD5 9b750a59836b1cd4d02a258d1345a9d3
- SHA1 6199190439eaf179c796403b717a8a7d224b03bc
- SHA512 ac595690aab36ffe517c98e0fabb5517c4f14bbdf288ad67417ab0ae080c1f66c1d511ae7828f9eff8a84b0ba8fdcffe81e4693d7c2b2e409bbbb741dabeefe7
- TLSH
  T101110B55921C3478F1684369E73C786431BE64E0836B34CE6C15A530A31E5EACCB79EA
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral25 behavioral26
- Target
  wp-admin/images/dashboard-background.svg
- Size 3KB
- SHA256 9dc42bc9d31cdf15d8fbc876ce6515938101086748f41e9f6fb91c6564e43b61
- MD5 965e2305f2201cd9f1fbed06331250af
- SHA1 c143a2f8d135797e3e969e79e8280bc075266d39
- SHA512 62f194f1234a649b44eb2f18d458c200b06d8982a84f3f0bd5ca3ae3d89970382f851928bb3f89a1745af1185e4185bef2397410f0f5115c4e2f8494fbf013e8
- TLSH
  T1398134ED767187F8DCC5C3CFFB344A88791A60AE64658A7DD12C8BA82243D7C89055CE
- MD5 SHA1 SHA512 TLSH
Score

N/A
behavioral27 behavioral28
- Target
  wp-admin/images/freedom-1.svg
- Size 1KB
- SHA256 c641e751bcfb5d44aa4609d9f94c3aa9297f1baf564196b292aff3ee4e90ff72
- MD5 0b28aa39660dddc94f4a1aa117a75db2
- SHA1 ca822ca083e29e2ff15e9be4b50b80ab31a8e2a6
- SHA512 6d6918b9d5a73db24593380dd228093ea5444d631598e73a4418f48db0c3c891b8b12ce6bc693d6ab9cd34eb8e27ad95c496adf34cfa21a4b434be47812abef2
- TLSH
  T12A319AA592BCFD2AD6A1C1EC532BF1E0306E20285356A75859305F3F696A4B33409BB6
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral29 behavioral30
- Target
  wp-admin/images/freedom-2.svg
- Size 7KB
- SHA256 59e2923003e08c636372d0a073fa51a7ec5be56e27a7e8456a98f1c65aad5eaf
- MD5 eccb22be2030bf67eb8c483e0389a044
- SHA1 d79e8a8f9d38db79520d395e203e4b0cf63d5eeb
- SHA512 16b170565e575e757778119c1318b48a63d80efb1d7771a4c5d8d12dba89af897111941abaa375570a41ad19ce0470446d99c778db0f5b0f442d14fa35c118fd
- SSDEEP 96:gJMZYjh0aRb/lo2t6xDymli9OYr0cY5lgBGOLbuGoKGQzwruihb55C:gV90aRbBQxDy9OYgcKlgB2equGHC
- TLSH
  T16BF1CBCCA72C81BCBD425FEE632A6410223E79BC31310D746DDD59A0A6E2E1DEE364C1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32