18f151e6f0c93e9966c568688b98269d003de14c7940394f846f75b224c96b9f

Sharing

Copy URL Twitter E-mail

General

Target
wordpress-4.3.1.zip
Size 6.8MB
Sample260702-g6ecfabt7m
SHA256 18f151e6f0c93e9966c568688b98269d003de14c7940394f846f75b224c96b9f
MD5 00508b83cabc79c7d890ad9a905a989b
SHA1 c9a52e9bf4ab0f6b9899b8d9b1e079fe5aeb6a20
SHA512 aa9bd1f89262eda90defea7373e0c0130d5384b5713d152daeb0e19efc78880a1ae95d425b6cffcdb0de1de1a0cf53c6bd9ff5a373955dee4d7fd885ba97194b
SSDEEP 196608:qWpOzPIp2YI2a+VknOyh4QwnuPUeB5rWums5Q:qWpO0PafnZ+Z2QuvQ
TLSH
T1ED6612B5F61E4B52C35D8E74CBCC6180D1A9513BE20A5A496F3A1F868BFC19E3E32705
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  wordpress/readme.html
- Size 7KB
- SHA256 f55a56a065ab9ca9ed4820944e60dbffbc2d30172b908c5b91f551bc856079d9
- MD5 29c26e3150a452ccea556ee308935691
- SHA1 90cf89ce1e796b9769d07083e9e214707e6817e7
- SHA512 ba6e0a0b5b41a46ab3120d28b1c058140c3ff5ad8a85627f4bc41052dbeb974bec5dafd937eb52c32cfc3f5e08732be4f4906fc69b8010bb5b3bd9967161d846
- SSDEEP 96:QXUcLA1z1z/4kd5kyJuObif98uueKQJucpxk4vzKCZUjD+9dv5tdYGgrNZz4V+lx:ILArTtAOqWueCwDaldY/idI
- TLSH
  T1CEE1C65BB540537A07115371A007117A733300BEA39C465654EBD62DBBA23B0AF7F4DD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral1 behavioral2
- Target
  wordpress/wp-admin/admin-header.php
- Size 6KB
- SHA256 79d428ed12e732dab6299e4515615aa102cca3f0094bca443c5aa712fd109a44
- MD5 e59419f76c64a6ba6018ffe48a25382f
- SHA1 e1db2b679a74446e505dbad62d134f6a839192f6
- SHA512 5e578517a69a695938eda2f356b0e8d3816d931195830e39ce41bc2ef556652be7eeb0cc7891538e1162c42dce6143cb3f14867d830d4eba87a7c34d9f838c1d
- SSDEEP 192:HUaZXPINIK/q6v1d8qqDoS0i5rvXZPX32PYYJx:tZXPKv/qOFzS0i32PYY7
- TLSH
  T181E173411CF2676388A30AD265E6D27835178A1BF38228909CF641F99E913588DF7EC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  wordpress/wp-admin/async-upload.php
- Size 4KB
- SHA256 730243c02a6bba632172334f2b0adac97536a8c6e4ea2dda3b84d0f327c3b21c
- MD5 f83c42723f64875427828b5a179c3058
- SHA1 4e93e47e281faebe13baa7ceb0a13ea828c38b48
- SHA512 05d5bd20f04638f80a98ba9f33c657a4124bc1326e0aec85432640f54fdfd82c62fa27a6f3fa3760f3c95940315a0bd62c1c90f74255551374d127d82739dbc0
- SSDEEP 96:tKzk2SabJRMDl+0F+kLhlKNabo6BDnbov/DnlC9z60WM:tEsKy1FVUJRmz9
- TLSH
  T1E98176F56AB8A776513370C84A4C802DA959C513B1809D5C5CACF0E0DB8496FE4FAEAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  wordpress/wp-admin/custom-header.php
- Size 42KB
- SHA256 4deb866fab6a04779aef4fea2e16e7c3c67e496d97fa0aa19ab983714c77190f
- MD5 f5c924d5a5ee6b31e3f17744463eeb53
- SHA1 f58d02437420492fd4575ab0d9ce45f5ef8bd731
- SHA512 b802d3cbe361005595d8be4e2c82dc37e7e6e233231c34a304d0101f7c211ec53aa2d3b82f69555769daabe5f010c49e3e37ee9df5cf7552b477909e06dbc375
- SSDEEP 768:b4owQYR2WiBDPLGaoB0jlmhNtje/RpEO/TmtLgnFiQvTuz1nAt:b4tQYRniBDPLKBolmhNtjeJpEO/TgAuW
- TLSH
  T1F613D664F7BDF737403328A4E60EAC0E55AEC5145242ABDABD8C90EE59C0D2CE974F85
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  wordpress/wp-admin/edit-form-advanced.php
- Size 30KB
- SHA256 14b3db97354c54e303dd8b8aef6b2542d5524754590006205efdd383298dff14
- MD5 ad60e10f95cecfe7e4e3c7c8a96d97aa
- SHA1 baff0ea1946de0704d7bd31b3cc54ed1d6548021
- SHA512 aa6e0928b0deeb2ba63004b6647b9c651040df067ccff2e7db91edd805ed2be7071f06b1ead27c3be432fc73898d5f8a434769cc9befcad09dbef86f5c159270
- SSDEEP 768:NU2gcA1c+X+hV/TuK0C93RPD6X2BuwaxnLL+t9dYAQkfwU0/uaQfI:C2gcA1c+X+LLuKp3xD6X20xnLL+t9dYl
- TLSH
  T1B2D20912A0F8162254234781F980D27DDF7D8891739124A5EDFDA4F8ABD72B34935FE8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  wordpress/wp-admin/edit-form-comment.php
- Size 7KB
- SHA256 d60b86be445c6f71cc8f640fee878d7c8a67442d970318949e69ec27fd9559db
- MD5 f2a834facad34d4ea3ec24b2da50a295
- SHA1 cfb3d6f4a0232120632054b37a20c4a400264508
- SHA512 0e3b1066d1e8ffa1e0ada9a62460124a2c4a3cfdaae228384dfd57018a58a6fb8f276e75d5de4e930035e82ec36004212b6a0df06c8418203de6427824e041ea
- SSDEEP 192:qxsxqDLoOT5sOkvub2tNJmatlHCo+70MLj4LO3YJXjyByMVA:qxsxqDLRT5rkm21n80eYxjyB0
- TLSH
  T14CE17582B0D4873090A37CE17EA4A67939C8C708E6451C4CA6FCD0D85F50FA69D2ABED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  wordpress/wp-admin/edit-tag-form.php
- Size 7KB
- SHA256 8a4e71787d9b09ec9e42c970113533c1bd27d7c85847594650d222e11bb4551a
- MD5 1e50779c851b5f301403e308b55b0049
- SHA1 fce7a9929e883c8463d54061fcf90769353b0bc9
- SHA512 93ce3fb5b40c9a3d9420c0221a9210ccf32c44b297d61918398905069a8e93e8dc5625a0cdc33ecf559a3adbb33633f6a2681ca7d183f2f344594986fc1f85db
- SSDEEP 96:aFHUJ1L8WRhaEC1j4QxxajrYp+Gh5Hn3DIxB558fFYPF1zMNLHPN28Lpz8wvGmz:aWJk1j4QMc5HMzH5kjnGA
- TLSH
  T1FEF1A8F769ACF57005520ED07CE3B7467FFD9E247A410CA9BA8FD89493218614A3BD84
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  wordpress/wp-admin/edit-tags.php
- Size 20KB
- SHA256 23c5e213732ea49ce9a74ed16d0b69bf74cd79d7534e968fa31a9ebddc15b1b8
- MD5 d1c6f9e0018015e9f7b9404b7e06df06
- SHA1 d3adf8575c0130810b2af9d1c2d1c1c51a59223d
- SHA512 06730b0e29e897578bc5fc0fa1f7370fa4c6288e556411426765f4f98e64258fcd1da3a370b71c9ae7081ac51054c45437faa3aa8fe946c520856b1b0fa24db9
- SSDEEP 384:Jdx/VPVSkUixCmXRfgg00ewitkLt/n6LWHEnYtUVw/fhcN:Jdx/VPVSkUixnmP0ewitkLt/qWHEYtxu
- TLSH
  T1A392F8F69998517502674ED1BDD8B21A7E388D3132410CFB3A9CE4A4F7516670A3BF88
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  wordpress/wp-admin/export.php
- Size 8KB
- SHA256 5795169dcab4bf36f81f0f77cba68357442745f04db92681cec47ab3549b15c5
- MD5 abb3a8bbbb0db448dd6a9666580fa25d
- SHA1 d2e0670135c4a3ac54f53c0a78fbd9097d012485
- SHA512 c6d6fd182e2b44eb25e5544da56084796596902f51c9ed4843316de51720841c88f94034cc5effe2bf91b391809b52480a935a558d0412fc6e72bdb6a7013cd4
- SSDEEP 192:fXbT/ODPvGR/iug0jEnF+rbwrs2AEOsUIEsnKq6:vbTWbvwigs+rcr9GgKq6
- TLSH
  T1B002A793A5FC8B6144D719D8166092F16EBCCE15A0022C86CC1D57FC67E0A6ACD3EEF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  wordpress/wp-admin/images/wordpress-logo-white.svg
- Size 1KB
- SHA256 e0658d46dae8331fc0bf524fe1bb1708e0c3b5de6d8ec2770fff3b89e3fa9492
- MD5 e1af633d59dcb5988cacff73b6dee9ff
- SHA1 fa9cf458a1d9c755ad61ef741efb9189c72dbcd4
- SHA512 38246e5731114aa38d965481ac4e59f3549735aef06610a571dc2ac2f73301eb4aa6b6b9eb27bd1c0711841dfb4e381093cd14101a60b21fc0ac0bc1569c8e58
- TLSH
  T1D031008D872954FC68A692E4AF30B8A3262C95DA5171D988931D99317AD0CC9EA44CD8
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral19 behavioral20
- Target
  wordpress/wp-admin/images/wordpress-logo.svg
- Size 1KB
- SHA256 a0bbefd626f1e76f9245ec6c6101b679ba27412b71b32fc43eccda9db40f394b
- MD5 f34ef6259364f7ef0ccf67cd1dddc970
- SHA1 18b563726b3d24a73552791fff91f61077ae1ec5
- SHA512 c4ef2a19b114946484a6fadbe9bcfd80111779a5bfce8fa1d38bc09915a6e660978435f7796b34a7c71668d97c0e87186188ee5ba1704aafa592c22754e63651
- TLSH
  T1D131008D873958FC68A693E4AF30B8A3262C95DA5171D988931D993169D0CC9EB44CD8
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral21 behavioral22
- Target
  wordpress/wp-admin/import.php
- Size 5KB
- SHA256 9496e0a2a6b30f02adefe54d790884818d4aaa758a6c4fbb54dcf1833aaa2a2b
- MD5 3d2669392c78b01c6277355e3b8f847b
- SHA1 e09d9cfb71c8cdf1968f8b0ecfcbe85eb2b72181
- SHA512 5516aa8624544800e6292480edb5041f1961ef2e8571a7fcddd7078e926a8cdd498e1430b37b86be97731db34eee324231efd07255c7cd1a60633637b96b367f
- SSDEEP 96:3u/GSOC3r40FfLi/nWnuIHdmT/TQ+ZN3tOrPJBA82pQ+mdof197eb06b0u6EJg9y:3u+S3r40xGkkDk+bdOrPzAB041MBl+YN
- TLSH
  T139B163B39BDC52320032EE9512A041F422FE86B17341995E7CAF43B05FB63799A73959
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  wordpress/wp-admin/includes/class-ftp.php
- Size 26KB
- SHA256 73fb5dd43a11e1f9362fe832d82f3f332f9d30f8dd6b34e30254405208bf2dda
- MD5 09469b0947fd67f17dbc7285e93f0876
- SHA1 0e08bb94db2c61fa2a0568c483c949e66388e877
- SHA512 7c52f68609acb37664a46735529a34811808c471421787e3aa7a9a5318a3e63c386b3c1bb552483ed44d186402dfe75a46ca42fe13f6f4b45d37448ef13cd9b6
- SSDEEP 768:P6q1jqhlXzMgIXGsObD5gseXAgzFK/oqw:SgKD5g5FK/oqw
- TLSH
  T10EC22EC7BF9FACD63592D0E94353509FE86CB531686A8C47BDD981303B9832D805E978
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  wordpress/wp-admin/includes/class-pclzip.php
- Size 191KB
- SHA256 7f4e7c8d97fe34aa9229e7b91d5daec7b8f94974f35f6e3fc45a2b4c3f6d3181
- MD5 834d22f8b68a2c5c01866a43eb24efc4
- SHA1 ccd23ef96a588840943fba081bfa6f88531c4abc
- SHA512 680eeacbb3c2846af6f5afad377d5f1560d4b7f778f8b9f3d0fa404b4f42671e31c3e13ec80573c3b3b07a075f895b99eb1d6ff2bdc00e71784c9cce8b55bb8c
- SSDEEP 3072:IdItMRpT6v5sll1TC6RRbxWJdZK3+EUZz55w:IdKv5slrTC6RRbxWXZK3+EUZz56
- TLSH
  T1B9144345BC8601726AE3D2FEA7CBF44ED164C6370A4DD816396D43C82F60564C6EEACB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  wordpress/wp-admin/includes/class-wp-filesystem-ftpsockets.php
- Size 9KB
- SHA256 1e21df90efe63135a092f5933ec11989a2509fb902c00a9fdaae5c3aae6d65c8
- MD5 52903bd88f231efadb6fffb53809eeb2
- SHA1 8bfafda62d818723028e6ac5b144cd7b33d3e2da
- SHA512 7054e1e1b59d0f5e82b27ef91e23bd0408818113baa804f27e98e6bc1f843fc5d7be866166581ebd31f689fe1fe13355b0da0329b9f850bb010423e446f7354f
- SSDEEP 96:NZ6nXLUBAuUrocpUYIhUrT4ZhsNhsBZC+R+yfjh7IKIHB95xa3PWswo0drOGjMCM:NwUJUVUDhU9bdREMfDWr
- TLSH
  T1B52263D1EBEDACB6132032FC1FC3A01A71BDA931D1594999EC8A9690349033C86FDD76
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  wordpress/wp-admin/includes/class-wp-list-table.php
- Size 35KB
- SHA256 2eb83da3af2cfe8d50912278beda02b0127b57c93df7ee7854b144acc3d2caf7
- MD5 460ead7b7cbc562944c0da7236a44217
- SHA1 dca4f8123c019f81a8a0ce64fe5e5e7a470d39d8
- SHA512 c8e7d5a10a5e308e3093ef707e624aabd5e29122f486600702ccf525cbd29750d2e0be7c72743e6f78c03e6eb9907e090970f69b77e95a927d3a83c8587443b6
- SSDEEP 768:y8ua+FdESBK41WVjRZfZn10dmMM7Fv74ud47YC:ca+FdEuR1WVjRZfZn10dOv74ud47YC
- TLSH
  T13AF2C3C6E7CD76A6805370E99DCEBB5560BC0122E1802CDDBDDDE4681B51A3EC239C79
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32