29c2f6ea6ffeb42feeca6658cbabbb291a5b6ed8cb90451a1884fa6d00685757

Sharing

Copy URL Twitter E-mail

General

Target
areia-portfolio-and-agency-wordpress-theme.zip
Size 1.9MB
Sample260422-pp7xesfs2q
SHA256 29c2f6ea6ffeb42feeca6658cbabbb291a5b6ed8cb90451a1884fa6d00685757
MD5 aa4a7c91af53c1014bd9f0ca9b593477
SHA1 ff3706f62c01c0d469ed29afcc0ba9ba8bc47145
SHA512 66a5d34026e533b96434db0bec76114a59b1b0d359e4eff3c60b711b81923426d4a2ea8101ea80f7fa16b67b4861590239734a068347cdac08c5829bb6eb8ec6
SSDEEP 49152:yLoy1h67qJw5brX376ECoMpPhwcNscYpwL7AMM:Wt107rrXeEMpP+cNpLW
TLSH
T15A9533B0C74015E2DB2B0DF18AADDF29E1A4A5319E07844F777A97403A4E6CBD83934E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

Malware Config

Targets

- Target
  theme/js/customizer.js
- Size 1010B
- SHA256 8dcf18a79305a9f435a234489665efecfda708136368129d7087ef27b34817b3
- MD5 ed1d032eb17653b74df209db5d18b10a
- SHA1 2d51b16a46374fb49ba54ed7d118cc63d3a0dd79
- SHA512 cca03a5cd3ca8cc8b01df6b9fd4cc3c16c9c252fc8bbbaf67ac19257180bc372dd0197ce3adf9ba9302eb0f1392eb7b72153b2058e13f860fb8aae970331e4a7
- TLSH
  T12411CEE9EF2C3272002F31449EAF84CD207E031EFC66461A6C83427C49659F98D06F58
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  theme/js/navigation.js
- Size 2KB
- SHA256 62e43e72fe01698a0bd6dca388f3fb3eabeb02f6ae8106f568ba43c707b87439
- MD5 b788376139fd03117cff611a4d363bf2
- SHA1 de60b2d1fc43876eba51868fed548f4d936bfabf
- SHA512 7756e07f1c0d91c11e5211f6a7e4bf82dd58ca0ce4c8ec67c49224ce7d3eb08aac565e5bfc06612fefc1a00755eae08f6bc2b8b28916bd934d05ba099e6fca7d
- TLSH
  T1A85123E7ABCD333706F930E3A79961EA33384076A94465766C5AC919240086413FFFDD
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  theme/more-functions.php
- Size 12KB
- SHA256 63585a90d4bf25deb640b67c2d251402ceeb5da71fffbe3a39ce4a763774b3f8
- MD5 d268f6884e2b44d6d5269a6c0fb39233
- SHA1 c6fc48e407071b646ec2cc9eb46126670a51e7ec
- SHA512 b8f1719e70754cd82ef70794673eb4a4d2d4c3ec0241c8cae236fc362400dd2177af9d030db146124cb735fb83c96b2e94ad128d9f6bef3908a5d291c6c0ecf2
- SSDEEP 192:oPoh0bClAyWT5xsQpxvpuozS/UtDCRDCGa3yeiSZtXSBbiSr43ywCfCy2SCSCjGj:6qWzvpxLuayOtc8o
- TLSH
  T15F42432928DB685641B3B47EABAF54083175C9138648CD107EBC4AC86FD133CEAF6B57
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  theme/revolution/assets/js/custom.js
- Size 3KB
- SHA256 d66784ec9f0dcf14a1bf1efba284cc508eb52ed8a737f9b9d27770dcb2c93e99
- MD5 d7598283e9e7f1b953349f53935e2804
- SHA1 7a16a3d72f48fcfa6783f7d100a7fec64e8849ba
- SHA512 d8c3305c8689369ace6a7787a0170b3df10afd5846960ea4f2296bcc52b31504ca0242ef83bbd22c41e4005238f446be55c2e86637bddaa8a8d8a2b7a0da86d4
- TLSH
  T1AD711058B47410516CF7B73DBB7A9200FB79212B84028251BCAE47952F7137A236AFCD
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  theme/revolution/assets/js/customize-controls.js
- Size 321B
- SHA256 910c220bb16b14d91b1df0cf16c7bea7832847203af1cf7fb21c8fa47f13fd39
- MD5 83844f820b1ba6794de9273800d50aa5
- SHA1 5ab8b6c697ad2e5d3b93af3f45f9f5f5f6a3e15a
- SHA512 6575dfc475587721c3bd1915149a27a6b6629ab3e4966b2f7eefa597688055436577dcf1345ae2878d6079abef75c5cc85360f3739b7fccafba90ea612d7a9f4
- TLSH
  T1C5E02614B2AAB13982073533AA0F01CA813084032829649A607A04680FF883E012398F
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  theme/revolution/assets/js/owl.carousel.js
- Size 87KB
- SHA256 db9d6cf3c1c4b047c62f646e7d9991c06a212931c362bf53f9a2406b30f09466
- MD5 ccdf893e7d8b26933af0c336bcc3943e
- SHA1 ac575ba3377f95ef22bad865ec35b0b3dcb0dfe0
- SHA512 818db99c2eb775d1342dc2cf871509185c5ad86a08c80e452f29b8509a870c43078e9f11113e999ff487a35b25b6ddd6b95b6a7f2c4408fdfcfdd69473f59510
- SSDEEP 1536:owLoreUC7AuLMjvNlP8GNMBJ6IcIhKJQIOybQOoiYM9OJ0QQKOv:oUMNlPBqJTuOGQOotEhKOv
- TLSH
  T1BF9393C5F36C261B422631785EAE23CE723D402AD911186F7CA8E9DC29D546C436EFF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  theme/revolution/assets/vendors/font-awesome-5/webfonts/fa-brands-400.svg
- Size 734KB
- SHA256 9b3a8965284abe4e3b7089ee9d525fa3b03b9daf6cce4020ecae377a2b0baf6c
- MD5 0c12ff655da379ab518f8afe0b3ffe15
- SHA1 b7fd3035e83c23c720c9f5957af31d7e288fb4eb
- SHA512 48f8f13f7743c2947464fcbdfe79b997f88965e19c565f71ebfc7ab13a74bee8ab4fe7557fc99ab6bbbcb8775b3dd56ea36f5f1d757f763bf285dba97e3c9cbd
- SSDEEP 3072:y3S5sUQ1ZmSqx7Ob4E0aj5vduucqmzKvPNK74HiI1qJsGMAC8VxOw2f3G+Isk7mP:L4GuufMf3z9
- TLSH
  T11CF4105CD3A0C2B8FBDA4EE9893A7ED6366B31FF39103254C278A56028727784C4D59D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral13 behavioral14
- Target
  theme/revolution/assets/vendors/font-awesome-5/webfonts/fa-regular-400.svg
- Size 142KB
- SHA256 62f1f2b91663c306c7fbd35c720341eb713db51d2341d96d94824dc044b197de
- MD5 7b18e1bf54898a45b78a1a36806a4bc8
- SHA1 229deca2465fa9efc8c03d0ebeb9a01c1559822e
- SHA512 1b1a2a29dc2ac6957200f4da82d80f5cf24ca4a3526bdc2ca5af2f34ef76972306738950cd1b1e480b5637541257db2bec549145ecfd68bb54e0f78b187efa81
- SSDEEP 1536:Wskr+byNTRbWAn96fA0qBaQlwZPyVvD6UvDnP7qAkymy+fY+fYuqiwsJVPpn4v9R:wSmtOqe1U+bpJZqe/C
- TLSH
  T13FE32059E750D6BCFBDB4BD5863A7E94226A72FF35113260C778A1A0283273C8C9F548
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral15 behavioral16
- Target
  theme/revolution/assets/vendors/font-awesome-5/webfonts/fa-solid-900.svg
- Size 902KB
- SHA256 25630646b1fbe9832bd3ef2b215fce2d553315f59f1c7b56f0196b0584d52c5e
- MD5 b45a634efe8a9e0a3938a86c5e216417
- SHA1 023bb481b65dd8cdeb8c424ca900f3866292bfb0
- SHA512 a081da14e4030594f6edf46a269e8bae8c576ff208a4c73e9f5068a88d7d84231c4922b6ef2144560ff023eae951527bd58b9788695b9cb63b964efffabdfdc8
- SSDEEP 3072:43fnf9sEdRqL8a13PlrYCuyikZ0dlQX5C+2hoF2rgDuP2wcYFg3/cPDyY1UURfbE:MhmCZrz0oS/
- TLSH
  T1AA15646CE36095F8EBC64BD58A367E5026AB65FF36213524C378B5A01C327BC4C8F598
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral17 behavioral18
- Target
  theme/revolution/functions-extended.php
- Size 16KB
- SHA256 42f67ed2aa3d6293ac26f70416640a72d727c936dcaaa2be50615b1aa4b39130
- MD5 948b96e2c0e32208cd7c0788d4a9c219
- SHA1 57c14a242c8679cc1d8b35a521f1c507db5a188d
- SHA512 0d57d21f98ae07f55f971cbde82c0a8b29e40edae365cc1e78f9dc17d81f928e0d71fd8ee2f44a660ef4716f641fec7abe26818ef9adc47ce8c857ae9c71f93d
- SSDEEP 192:kKtyVyhfjQyoZ3yXwCUYSCTTCwEtZY6vpxvpuozS/Ut+e/CEfC7a3yeiSZtXSBbY:kC3DOwIYEpxDFfyOtc8eu
- TLSH
  T1A9725569389BA4660173A47E6B9F98486269C9534648CD107E7C02C86FC133CFEF5B7A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  theme/revolution/inc/wptt-webfont-loader.php
- Size 17KB
- SHA256 f069cc07d37fc2757b1bfd12b51d51ecf50efc844c85effa3330b39235c23ed1
- MD5 e77f4f6022a52f4708576493d8492672
- SHA1 dbdde8e34972c32934968351926210dcc8cbd38c
- SHA512 60476f0fb7d630c01c5be8ab8b4ac04a7ee49f1bf0dfff4a8ad137a0a4533e5eacf9e33d887de39dd5a45ef72fceb2ed5fa2cb3cf0a7ad5871c587e3f7794291
- SSDEEP 384:rxfls3U/ipsGav+A1TDHylUamBVcpBjZkfpCZdUjjFXbW6mQCcAuo:1fls3U/ipsLGA1HHDB2p4/lW6mQ5no
- TLSH
  T1E98254C5B38F755B3AD023D0BB39A649D0ADD63482292894BCE6D848376426C42FDF7D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  theme/revolution/template-parts/content-video.php
- Size 6KB
- SHA256 b49d48818ef7d8bea345d41c70c5e8fa64b43d65b1c9986311628b5b86c476f4
- MD5 12f133e3d4caa030f19a3c59dd54971f
- SHA1 d61404af67c2140b61a6defbc63293b48a9e191f
- SHA512 523bf8864b840a6f3f4b59ca2efedd4225fae27c215a0d83dd645ee4d733b4ae1059df2d21eb6624f10da02af9f2f4e50f71c9d5a7e989ca8263f4c05d113989
- SSDEEP 96:Ozgtb5uT5toAo7gPQiI2ZJ27JG20oA2ro9bYuX7D9r2R/opL9r2R/oa8Y2A25QbT:eeultU7g4KwEoPol6W66lG
- TLSH
  T155D140A1D79C0E768080F88E6410510E6E5E9DB661895CD9FCBF4ADCA383B183DE3E75
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  theme/wp-theme-deployer.php
- Size 12KB
- SHA256 0d7ea24bbd307d34fcb6e7a792c9adaa52bcb3ae395f1055e4285df568dda85c
- MD5 4fcbf716109fe4608723655268d36903
- SHA1 f4bae7dc004af9d6de861f988f085facfcb147d7
- SHA512 b976ddd5317bf91cf2c4bc087aff31b1e1f07c69ff841b937d231ddee79bcbb02fc626def61bc8543bc742a728e7acf85873da2b2d24231672f782db5980543f
- SSDEEP 192:CHdYM6Xjp3nFmG9SCyO8qynbrnBnJjPltp7UwZUErzGn1F9q5qyigQfYhCRz:O3GkvFrze1FMMy38
- TLSH
  T17D42FD7930EB652631A3F8BC578F6428A529B423B1089908BD4C73D45FDC52C86B5FBD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26