Extracted

Extracted

• • Target
    Avada/0 - READ ME FIRST.rtf
  • Size 10KB
  • SHA256 ddb565a6e347837a96280327f3325f6eda1dcb6f0ea0516d288ec0d1da19881f
  • MD5 1f03de1792c92e8a15c6648ad1684177
  • SHA1 7ab644db01ef7d22690dd965d8499de535fe7060
  • SHA512 e65940d8e8e5be75b6ea20368ae5717ed44df0c4702fb145c7622fd4d664ae315ae71f046131f0767a787a90cd8e6016d63bc64fdba42dc0f282ba756da88b3a
  • SSDEEP 192:eHx7E5y5ElE05L5EjbE05D5E4EDEIEAE5EtaC:eRi
  • TLSH
    T18022AE278C9769D56849FFC658A0D898DB76E10D302CF3D61B0240A5F8BFE5E252EEC4
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral1behavioral2
• • Target
    Avada/assets/admin/js/avada-admin-notices.js
  • Size 1KB
  • SHA256 df3f2f4991aa82dd184d7b4f5620c1d35bd4372ab43c1d51e2b6b9a278c6cf84
  • MD5 8de052ea3c8588fae87534f606525a5d
  • SHA1 70ee342bef64e9b75dd627892b748bdde949efbf
  • SHA512 bfffa06fe2b05a8582d9b5dbced932e1918e2917f47e46b0fd3b9ac89a5b4278ac90af943b4e3ab86333cd43cb5bc529a9f568aea60a2914c83d7962a237b98c
  • TLSH
    T180312D2DE2AC5346597220B9F2FFC2C578BF4247BA041B119F4E2781E54F854479EF60
  • MD5 SHA1 SHA512 TLSH

  Score

  3^/10

  execution
  behavioral3behavioral4
• • Target
    Avada/assets/admin/js/avada-admin.js
  • Size 30KB
  • SHA256 5c48d3e1d796a65722a30f6d85aece38e3286a740d3cdf986c8b8623755e95cf
  • MD5 0a6600707076f279ed2399e5952422e5
  • SHA1 104074ba1ee69099a1987a066e2bbaddeb7bce02
  • SHA512 7a8254bca2afb7a6f6b0df72300a2306459a7184b17b7aafce504d95cd51720187251737533dfca1ccb5ac261cb29c35fabf7f8f96d90c2aa020ef84fc551852
  • SSDEEP 384:103sls+k0zR9446FLHEuckW/l/IorFEERV7EMkzGUoc4WvNlUE4FJaK1Jy68mZUD:+3sJRwMueyUbCSCJfw+
  • TLSH
    T127E283AAB75C10FCB1B93191E93EC2F9363F44B072002A29BE4F566497C81541AE7F79
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral5behavioral6
• • Target
    Avada/assets/admin/js/avada-beta-testing.js
  • Size 1KB
  • SHA256 df646d111111b543ba01832f348d4a6327586d71f9e6b80569df7600e05840bd
  • MD5 aeaee86cba4baab6d06b810722a5654f
  • SHA1 9ce843aac3979801647efd8e30df07a39601a0c6
  • SHA512 4521455dc1f8a676b0f1e4952c56f0b872a6706f8c55360cb96ac788a995222e62dec0b1f415619a22613ed0b912419690ea2e0255c2e699675decc004140c6d
  • TLSH
    T1BC21C16A369E90F7F03B630CE2BAE2E037FB0651300196057E4FE224DAE422F5361D94
  • MD5 SHA1 SHA512 TLSH

  Score

  8^/10

  executionadwarepersistenceransomwarespyware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral7behavioral8
• • Target
    Avada/assets/admin/js/avada-fusion-options.js
  • Size 31KB
  • SHA256 ac7eea26b19038ed219b8461ed1d8cbda88826fd9008f2a38173c37dcb3e7f00
  • MD5 a34e2052ecb44af997c1249ee2419504
  • SHA1 cf29f5f1f8244d1af7bd9a471bd90721ac1b92ac
  • SHA512 3bed891c8458c677d667b5e22fb1b935c26f66bd2e19e4dddd6664d4a4fa048c6d4fffd351a11d83875ee959b002ec837c97426595d1196e55853b34df072e28
  • SSDEEP 768:uwkeH7re2cLZkF3ZiXeaAsIb1Jdrov8DSbovdRCEBAD1eAcVYSYEHZsjjBrjauuS:uOe0F3SeaAsINDS+UuAE0N
  • TLSH
    T1C3E28684FB9C10D590BF3099EDBDC0EA743F8675B400567DFE4D89E4A6C48285396F2A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  adwareexecutionpersistenceransomwarespyware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral10behavioral9
• • Target
    Avada/assets/admin/js/avada-tax-meta.js
  • Size 11KB
  • SHA256 8d4758861e30f5aeeb941a58fd3c5eaf73e321f19dea34bd9c9a62bcc934e18e
  • MD5 87ef6111ead59dc12eed622ea09e5074
  • SHA1 417d5419118f7d23949711bd59746d93c7941e79
  • SHA512 581cfcc8f9ff59ca6071af20d9c1ee427194cb0fb76a99f515552843ec3b06d3664a69d52bd10c26987688dcd4791453a787b22749680b9a8573d898171035b2
  • SSDEEP 192:zBHpbb/YhfwSkHJ18YxTg+u2NfZJX3fosZwwu6haW5BiQ7iXeaAsKcvZv6wJ:1Jbb/YOSkHDr3ZfJXAj/6ha07iXeaAsn
  • TLSH
    T12532A495F7DC1059A13E305EDB6ED1E97A3F8E33B0047B2AFD5A947098A443812A8F15
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral11behavioral12
• • Target
    Avada/assets/admin/js/avada-theme-options-menu-mod.js
  • Size 1KB
  • SHA256 95fc635f86d4db07cfd1e620a51640625ffaf4f2b2650cf7287e8ee85dd9f2c8
  • MD5 29988d7bdb15439971fe659fd6026f60
  • SHA1 39d1f0e9e3c025e8676c7f8a9c317a5a0875474a
  • SHA512 a8f3e01e6ed15b5c71027e8665f518f7fa03df501bc03d4fc71dc30b928290bd4d17575f0861c86c282301647d925c4aad6582e548625bf7c55c738e1117af38
  • TLSH
    T1C441A1D0632C90FCB0F7B77CE5BED278B4379F79A105055969280A989646368D2C3B0F
  • MD5 SHA1 SHA512 TLSH

  Score

  3^/10

  execution
  behavioral13behavioral14
• • Target
    Avada/assets/admin/js/awb-setup-wizard.js
  • Size 74KB
  • SHA256 2a03ca3074dd891d756e3e17caabe890e5dcfdd61d45def2236640d645d62bcd
  • MD5 4be26678352defb5c225089bfb4a3ece
  • SHA1 c6dfda53c8a1b12926bb916149179c827c85895e
  • SHA512 939e02478d28ce413270a9a23fcbb0ec6c96f6dd87b26ed8ecc3d98d13baebdb051fc47e8a694c1a1cbd631881a806f370fcfa49a0a56d65121e9a7d02693169
  • SSDEEP 1536:wgj/WEavMtDV0BAvCvG+f1ce2oG9GuKk39p1sjcioC7xoyVrbuyohPhYrxgbDoS4:wm7MkpfsI7SGyllgYSX+EQh/5PtO1NN8
  • TLSH
    T1CE73E8D9E38D206A80B7309E5D1EF2C9743EE5B271048DAFBE3E11741AD84285766F39
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral15behavioral16
• • Target
    Avada/assets/admin/js/awb-studio-modal.js
  • Size 15KB
  • SHA256 9e527c355ecef3f2cd7ed47e0f5ea2c75deeb3a776cb7cd3f81cb762a0dc9ca0
  • MD5 0b828746ddd781e0cd6d82882ea81ac2
  • SHA1 fef315f3a1ef0c2c5b5c4b49871b07abc014a1f2
  • SHA512 1ee00bb20c2c88bebd2b6706ff90d5619bfd8a451402aa7abcc2252a2ee7fbc9b09bc75664fa20c0bc4274ebed82a409b38b4e9b1bfbcd65eb59cc71349bacea
  • SSDEEP 384:lB/sBo6YLI9Xp63SI4ci7hnSIIc9SSxcLCojyAZDWUR:7VJs03SHhnSfSxcGolZ9R
  • TLSH
    T1F672B7E4F39C116AC1733195BCAEB249383D9E13F5486A3F7C7A507852E181827A6F78
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral17behavioral18
• • Target
    Avada/assets/admin/js/awb-studio.js
  • Size 19KB
  • SHA256 24e7333cd0c127a60123e5e957aacd6df11ed710be8efe5ef4b0fa25d710c364
  • MD5 5a39485e01879e91897b6586b9f6fb62
  • SHA1 929b2842f8cc4476ed74e9fda9565ce7fc2dba06
  • SHA512 23ce2701ec9f89188009d02e9b586435666872bd575553cf2c42eca35bcc615c2a717695a7254ecd01e1c3706817ded5dea3b1d5eb38f5d6a5b9397b21c3d8ed
  • SSDEEP 384:9ea46pdlog/Fr7ASleQwBep7jXfV/WsMPi7yxzwunSrIc9SSx68NixgJcaYLI9l:g6nlouFr7ASlp7hMPi7ySunSUSx63meq
  • TLSH
    T19192C7E4F3AC115E807730A5BD6FB289363D6D62F6086F3E7C2E94A813D11242695F74
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  executionadwarepersistenceransomwarespyware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral19behavioral20
• • Target
    Avada/assets/admin/js/awb-wizard.js
  • Size 23KB
  • SHA256 ee609288f5ae00ebfba31c1ed2593d32aca39730f2ac01385f7c21f24627659f
  • MD5 687a70061cbcd17fa2de2e4df35bed87
  • SHA1 8c287ce3139019fda5df9ecb8d9562a225098144
  • SHA512 5b45d91d8e99fdf8266041f6d79bbb6f8aaaab5acb1555e4ede76f65e87158be0412ee93366742c046908193e2fe190f71f37ed135ce0468a2f35a0710d18472
  • SSDEEP 384:a2VwprnZ206ggghnHuo4opEzJomOTb7tI+K4xDc5ncSP85qzSxWni9k730N9dYa:aDnw03nHn4op0+mOTb7tI+KkDsPxi9Wg
  • TLSH
    T17BB273C4F78D208582B73065AC9DF1D9313C6E72E1881C6FFC7F25A566A4429136AF3A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral21behavioral22
• • Target
    Avada/assets/admin/js/block-editor.js
  • Size 2KB
  • SHA256 d95adf2ba624b4b1a6654e24b7a1fec5b7325a7ab92eabc09ce8121e6c678b5a
  • MD5 68e8f28bb6163a5d0361010065ab09b1
  • SHA1 5c23b1bdc3b3c4982ff547845b3c5f2b978b7d34
  • SHA512 7815e5b12db0945c44f76a6819abebe244a394cbd40275649eb8b96c803cadc56e02c2b5ec8924c946fae3b4c9f38f426bac25c551d7af1644fafb5d0a9ba851
  • TLSH
    T1EA41ED05B57912D450FA34E0D6F8A1F4A9BF1F50F01857A38E6EE2C4520077BCADBAE2
  • MD5 SHA1 SHA512 TLSH

  Score

  8^/10

  executionadwarepersistencespyware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral23behavioral24
• • Target
    Avada/assets/admin/js/fusion-builder-slider-preview.js
  • Size 1KB
  • SHA256 1ebbcfc86d7a8c5260c78eda4020e72a57401f0c7b2eb49891be3032c321fa84
  • MD5 461c840fac45c4b237f91699ecbf0ec9
  • SHA1 2e620975da4e0c810551b26c4c28079712234d30
  • SHA512 a558a155ec2cc88851d3fcbdaa5eedb50fd5685a623cb57a5868c0a51e00625e44a0e58870575153ce1ad280864bb372a9c1a5b677a4a2c51a2a41c79f704132
  • TLSH
    T1803167286B0C04DD22332254FF3ECEA8F4EF1A5669486720F2C9A2F0F754E0144B8EC6
  • MD5 SHA1 SHA512 TLSH

  Score

  3^/10

  execution
  behavioral25behavioral26
• • Target
    Avada/assets/admin/js/fusion-menu-options.js
  • Size 19KB
  • SHA256 db506003b95c626e940c02d91eef32325af9fa84ca05f31fd7b77a285f8a1e87
  • MD5 98dd17dfdaafd3590ab8494b0d78d6dd
  • SHA1 5beb08ab2a6b14d89e25e5f1618015d047082349
  • SHA512 3d8ab7c8bc4b77f430b5fac84f13ee3c34887ae211f55951c6e7898796b612427822d4b4fe9e039b10fcc7bd489a96504732e1329240d7bce4c0b32ee80177fc
  • SSDEEP 384:8PYuoTwuxJLs0crQd3DXlfyJvqov8TWOLQmcs/b1bCcL:woLDr5wvqov8V5bCcL
  • TLSH
    T1CB925250FFDC00AAA0BB311D6D79CAA9B93F86B2F4004F69BF5E457487D841412E5EB8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  executionadwarepersistencespyware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral27behavioral28
• • Target
    Avada/assets/admin/js/icon-picker.js
  • Size 6KB
  • SHA256 1fab3767465067ba04f6f29eee3e2d3d0a05b985c8b95cd0574393f8898c517f
  • MD5 afbc161e7deb37ed6bd24383a567ea2c
  • SHA1 dbf1e694a2d79eedefcbe9a283639103b101fe63
  • SHA512 9b5ed5cdb3ef1d7e3ccfd57d202d93f03b43f2d03d44698f205f7b49baa5f115a297e1af0ff5ee47b953ee62dd7c9a4c7ec820a3588080cbbffe1cd3f98aedc6
  • SSDEEP 96:OKjxBfhi8mvwjSZ0JCQJcGatkjcEXCH6NZ8nKmcccLxfz898PTmOTuL85QjNyGfS:OKjxBfU8mvaSZzFGaMJ7ccNitg
  • TLSH
    T1FBE133483FAA017BD973346E8AAAB955743F9473DC488F187C4E42788FEC41841E5FA8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral29behavioral30
• • Target
    Avada/assets/admin/js/jquery.biscuit.js
  • Size 3KB
  • SHA256 21a04ea653df768b90060fcb3f01f7e8ee6c82ba170d7b4d8f88893a11f6b7a9
  • MD5 4e6dbf063eb4ab743055a70950fe76d3
  • SHA1 7795ea11954b8084481ba8741bf3d19c416b900b
  • SHA512 f7d9221c7c2799ef66acdee626f022d006ee0a8c15528cc4ca3763167334446519dbdc29b4f30b3e289dd8ca8b0866b05d79371f074d2f3f25969009c712c657
  • TLSH
    T145517650B7CC361E06AB21416B6F10ACE63CBF721058489D8C1965F82CB0C3BDB6BD6A
  • MD5 SHA1 SHA512 TLSH

  Score

  3^/10

  execution
  behavioral31behavioral32