f17dc12d509c24d726d4ff0291baa54ede20d6aab1682282bcc01a37b76e62d9

Sharing

Copy URL Twitter E-mail

General

Target
wp-admin.zip
Size 4.5MB
Sample260705-anyj2abs9l
SHA256 f17dc12d509c24d726d4ff0291baa54ede20d6aab1682282bcc01a37b76e62d9
MD5 870fbce0334ae87341981928fd5d1e51
SHA1 77d5b2159268b980ec05f516b7190ed05453f7aa
SHA512 986605a50f549d86fa5526b3bf2365e75ba5c1915c4cf3011f13445d2f02cb3109fc819635120494f028089d6330f837c8872cc13d75b48d55ae1c468fcb2343
SSDEEP 98304:XKn2JAfeS50DFnFOP4p+Wjbb0jedsLIBAr3ljKWPdW:Xs2ufeS50Ru4gW3TW9r3ljJW
TLSH
T1F8263377C6685913EC8BCA7434CAB010883DA547E653B34E79BC55C6F8762CFE31A628
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Language

Source

URLs

exe.dropper
http://api.wordpress.org/plugins/info/1.2/

Targets

- Target
  admin-header.php
- Size 9KB
- SHA256 6a65ba93b7903dee323bc8ee932eb078c858af3fb42af0833256d11d5f29a84f
- MD5 645416acd8e3f66fb6fc7047947314d8
- SHA1 bd505f92a13a64b26d82f30e2bd77cc147b41bf1
- SHA512 3dc90c6757eabcf7b4fb8e5e6a4271f0b438a662b42630236164f22f1444eabc5405ed451e160ee990608ca9bc6157d169be06565a49a6c30d104d87409de106
- SSDEEP 192:O/HW3xQB/m4TxU4ddqqQsY6qifPAWoAXZPXtS8VC46q:UW3xQB/mKyYdqiBS8VCXq
- TLSH
  T1051266441CF2673388A22ED166D5927C762B410BB3D52995BCF941F89B4136C8EFAFC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  advanced.php
- Size 1KB
- SHA256 9c08f268c716bca27fcd0a657725f97caede2356a620df9cd070f7dfd896957d
- MD5 1fa4a971935fee08abe7ce288dfef31b
- SHA1 2d209bb1919bfe4a3a7484292fa218372f0ef2cf
- SHA512 7cfad29c2166cfe00442ec92fb9a5ba0cec2026d35cc85b4a1b6aa7d6d9a58b5ed4684cbfaf167069d04be126985b169419de1f7ea5565e292b52737e7aa6569
- TLSH
  T1792120885F61539A1A1BA5D2EB3631CA283A831AF155C7923A1DFF5B0FC2742C1CA6C4
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  advanced.php.backup
- Size 1KB
- SHA256 9c08f268c716bca27fcd0a657725f97caede2356a620df9cd070f7dfd896957d
- MD5 1fa4a971935fee08abe7ce288dfef31b
- SHA1 2d209bb1919bfe4a3a7484292fa218372f0ef2cf
- SHA512 7cfad29c2166cfe00442ec92fb9a5ba0cec2026d35cc85b4a1b6aa7d6d9a58b5ed4684cbfaf167069d04be126985b169419de1f7ea5565e292b52737e7aa6569
- TLSH
  T1792120885F61539A1A1BA5D2EB3631CA283A831AF155C7923A1DFF5B0FC2742C1CA6C4
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  async-upload.php
- Size 5KB
- SHA256 cbf153ab3aec6d4b01cb58828aceec81d7d429df3f6e3367a78bd5c7f1cb9b78
- MD5 64073faaa1362e61f1bfe9c4a41ddf63
- SHA1 31a257693296708107231ac340cb3ad2cd8b5e40
- SHA512 1e4976ee3cfb5be1116a14b3e7fd6fecf6cdb266e50c3a012c7c0ddc54e0251a7bbe09ad326ae6d8d9930f1dd1b50b3e342311fe7b86532a8f6f0e5fe0dc4468
- SSDEEP 96:tKikm92NpGSrpPaxHQC/RU4gr4M+sgaOE4Vo6vngDnVovMmDhscCk1ReljZD2VVL:t7/92gxL6shHaOg+fVv6jZD2fzT0I
- TLSH
  T1C2C196F5A69C676A513370C4564C842C749D8837F0806C89BC6EE0E0E740D6EE4FBEAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  css/colors/ectoplasm/content/cache/media/images/gdhkc/admin.php
- Size 966KB
- SHA256 34bba99dae637a55b5b60ab41c22fcb3c1b775df926a22c8b08fc2b81ff94f0a
- MD5 b737fcce08303ccf3a44aa2cd8592e60
- SHA1 e6851f89ce49c1055a6e67c8546974c937f97e03
- SHA512 0150797085d72df1863b5ffbd213c388342e586f9c7bc654f801b3bc6585d5307f76d960dd30e6a78dab46bb5db1f968d60c0975c3a72e1947f708dc648b9f5c
- SSDEEP 24576:8X5eAkpibtStrgwct9ZNCwVqbz2jJSAcfNJoqVBXTxugQT3WXSsq:bUt3g3XBXTaQ+
- TLSH
  T17A258C74BCB70571D317D0A9879FA818A57B802B2405E804394CF2D43FE61B6D6EEAF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  edit-form-advanced.php
- Size 28KB
- SHA256 a74058bfbc0768353858872e0a170c34220ca52f9d726f37ecbb325e75b9aab6
- MD5 a58434d4cf259e05fce4990e632c5fd0
- SHA1 f6f18e1a573f6f1f40a128001a0fa9c05a85dba7
- SHA512 2e977854ef9771985299c7135dd8c619aa49df4e17f61be4ccb3246fa40952f0de697afc4f3d70d66e7111683e798b9911ad04bac0841202bca3d16679ba9ab4
- SSDEEP 768:O9VrD7iE75VXfsX3EiqKb1SceoC0Dm8gIL+t2Oa6QEmNWZSOmn:AVrD7X75Zf83Eiq61ScpC0Dm8gIL+t27
- TLSH
  T1D6D2F956F1F8126159131682F8C8927CEEBD8055738168EAFCBE54ECB7C32724539FA8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  edit-form-blocks.php
- Size 14KB
- SHA256 6c95b99b9a51a864880525493d782ec3803140260f40d3e4430bf0dce3723023
- MD5 cf8e8ddc9550bd9ce8f3bac639479f7c
- SHA1 551c71c42c1d64838cf4e6705a1da848af6afb84
- SHA512 62bc60a8aece6f159964bb2d821abe94c8adcc771b704475631434e6d24b93b2817931df816bcd802f2847b995fd4c9bfd11156a7db1a654eb0e0e356b3d88f5
- SSDEEP 192:70DKx7ArZr4Z/PoVuWBKcUXVfLIqEqgtgdxy+2d2QZH3f3DOBaGbJF+0x/iZ3MN1:4K5ArZr4Z/QT4ccFOxPDOFrwMeoqTk
- TLSH
  T151622817A4BC637A1073369AEC1C81F9ED2504867342A4E1F8FDCD88674B2D98635FE2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  edit-form-comment.php
- Size 8KB
- SHA256 47c7c2c85b7786236b326157f0f8faa4d3c15228bf5dd5ed0c19e08bf0d24a84
- MD5 dd0304cb076495b0c4e5a2b837b6cc7f
- SHA1 a91d3f63169f98dea7272e22581c5ba7d2025a57
- SHA512 a5bd15cde724020d89e0ca518f0b692eda5cfbae336ad21df7b518cc09610cb4e9590d2a4983019766393e5cd3e2ad19418eb57715d392acb934d0d0283b1865
- SSDEEP 192:TosxqDLyvTQbEBU/albNBNRj8yV9p/4iCtoW0MLexXLtkYyPyVKf:TosxqDLsTQbyUilHjBCSW08rPyW
- TLSH
  T19102769390E40721C4A33CD12D9867B939C88709E2492C9CAABDC5D86F50FE66D36FDD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  edit-tag-form.php
- Size 10KB
- SHA256 c6048841b3d0c9821abac035046657c18753de62b330dc8f647b81033a83af8d
- MD5 e8c365617952fa370aaa41d1311d95a3
- SHA1 9044ba46a25af74afdd3cb8304aac6842b32c376
- SHA512 9ed0c4c9f671bca984c700ed5410466daef54e72e8d95618e70de0cd21d486416928b27c8c0e9125bce0f5d227f13ad4cf6ffda0a8d42d226028feefec60beef
- SSDEEP 96:T4qPPi8wvR0Hi+hmVbmaE2azn47Nve21Jiysa/xdT+g7KA5HK3EIx7a558ZF8C9N:sqXCF4zn47kyBzJqVRaw91Y8
- TLSH
  T1A72293F759ECA63055530EC03CD277493FBDDE2976010CA9FA4ED8989725AE2493AF40
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  edit-tags.php
- Size 21KB
- SHA256 3695a5c6430d6b61982f90e4fb0298a915ed88f93f11fd4f9f1a1cc075da96f8
- MD5 ea2db0b9a8df5c1434d0d43ccc194882
- SHA1 b6be195d72475cfd3f53135e8a223944de0b8f5a
- SHA512 d752ff8cc5bb71f3db1630823159247ab4932c5a7493cc2f5614d8b7395f7be22104836e99b6a095e95ecca3e486affc620cf1254fbb11e3775c56b1a93e6928
- SSDEEP 384:KFifr45F03CfXgsqlqf0rxgrZU46rPhkaLrAN48:KF7SU1qlW0rxgr2VLrAi8
- TLSH
  T1CBA2F7EAAA9C517013171E80BDD8F35A7E7CC92472411CFA799CC458FB506A64B3AF88
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  export.php
- Size 11KB
- SHA256 956911bb9f675c93be60439b84490be4b67571eedecf4224bcfe064c8340b343
- MD5 8f84adce85891be383b351f5d6f28e2b
- SHA1 40fd55d536d0b6a4c610fc547e945e9425763d2e
- SHA512 b12cfe4470688df2484a47b80833dbe15fd7b4f18b8c7fab8d86eb1fed95f8de0a8ab145bc98e60daf0767b70ef12dea4627e1855c6cc79a7bc4ba3ade2d5d0c
- SSDEEP 192:f2INQVgBMvCqjyNNgBtshhIzkeBs3QB8ToFKDOG1XspINm/P0R:eoQVgCv4NXhhxM3BZyJm30R
- TLSH
  T10C3265A3F5EC4B31849B28D516A497F13BEC890591012CC6F42D46ECA7D1D69CC3EEEA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  fzp6r0gs.php
- Size 1KB
- SHA256 73c53d3963d2daa6ed6c2de86217ce96754ec2df98c452de37d78f22501a0758
- MD5 9911250ef509d1ac4e160359061014b4
- SHA1 2af6f48cd42f49a16ad3bce784b060f6e8f08953
- SHA512 10b5b6cecd7dcf4b4c0d787725f0dde5408ca992aa6c18146a3d7f98ceca0ee0e784f56fbd68061bc35d98513af4352f3ed9f49c8a77557c8de54e83c9697bc0
- TLSH
  T15A31834C1A722356596BA0D6EB37308A243B8317B111CB923E2EBFC50FC2745C28B7C4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  images/about-release-badge.svg
- Size 4KB
- SHA256 89f4c892f72202765daefecea322a2058bcc21491b797bb994d615c4df04d9e6
- MD5 b8e766cb84082709053adea3ac75cc97
- SHA1 282d507952e42a140c11a2996016339defa8a63f
- SHA512 35ef93dbd2fe0991ef29e66b8141fa23e1a987488889cf783867d46cb746f927eb4aabb950eaa08d2761d76791fe3e4a2b9b4ef1b13bf231177ab64a2fb306ec
- SSDEEP 96:zC4i/ICIVMfY5IqSBMlROWX+1PtJwpkX8DOmFK4Z:49IKf+IqSBmRzXGtGpkX8lFK4Z
- TLSH
  T1D69131EF67204CE6CDCAD2CBFB8210EDA01F91BA16924B54C358EB9D7845C5D8CD9846
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral25 behavioral26
- Target
  images/about-release-logo.svg
- Size 3KB
- SHA256 6d7e4987de45bd1a6529f632a91a6d64ca7dc6e8f1e14f74975ba80d09aa01d9
- MD5 2620c6ae1157906c0ba9e5a7b37167b3
- SHA1 9b2bd3968e345b660fc39ebb7e12f0eea6e41d37
- SHA512 38bbb4d6c84231544430cf16e395949be8ba0bd669a3f0a9282586cd4a6a935cd71d453439dc014ee30edfe1bcb393e09e69b7b6f6e0b656b7083b3d56ea06b2
- TLSH
  T1A781B5D63769F3C4E10ABBA4DF35A1283A1F24F90EC0C0ECC7B2A950665249E1D59CE2
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral27 behavioral28
- Target
  images/contribute-code.svg
- Size 9KB
- SHA256 5383af9878f5f7647fd4f46aecef497eaed7c16803ffa3071b710a1bfd89dd27
- MD5 b725278c2b638cb79b9dff90f526224c
- SHA1 adc72b808e6eeedad83560ae5ae11e40fb2c664f
- SHA512 35bbfdb5db23262916d7221c05c137f2e0821c6da89c16c7f1d48cdc7eb3b65872ca6335af53d480ef5e30669e0e47f73ad7eb307063e0486960705ca025280e
- SSDEEP 96:3QwY8Rs8V4Qt/n+8uh1QREQw5RGC19Rmt:3uV175Rz1it
- TLSH
  T1AA123FC8672D5528737A2E1E67072ACE00FF6C9CB25C3748EC1F69B5538B59AD42388D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral29 behavioral30
- Target
  images/contribute-main.svg
- Size 17KB
- SHA256 d17763d0cf6ac7899dcf6c50075b682e983d0b0ff278e752b13061af2551dcbb
- MD5 abadc35556c6a613bc1632ecb0cbf000
- SHA1 54df7083d150caf86f0e09f3f14b8ca4e2533d00
- SHA512 0d78739db1c6729acf95153b6858c2941c04e75a416bae62722e0e64adba15aad222e5a5ce59a4047bee6dcb0d9707d7854c59674003452a419a1f8c50650fd4
- SSDEEP 96:VfWZZwfbiJYAXf8zffuTptfVJkeU3f8WzfWZZwfbiJYAXf8zffuTptfVJkeU3f8l:5RlkXSoL3JL
- TLSH
  T16D8234C8672D512877762E1EA7072ACE01FF6C9CB54C3748EC1F69B1538B999D82348E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32