963d93d727fc757de38031c375f24a4fcd73f72a9615e0db2891576594ad71d6

Sharing

Copy URL Twitter E-mail

General

Target
wordpress-6.7.2-de_DE.zip
Size 34.2MB
Sample260718-pdfnsses4z
SHA256 963d93d727fc757de38031c375f24a4fcd73f72a9615e0db2891576594ad71d6
MD5 f03803f2bdea1f0e69f3081510ac9791
SHA1 a3d6e6b142a5766eec44677f832fe3eaaafdfe03
SHA512 7ad1104a645f13e85aa37e501679f97ccf0e5525c33b6ac35bac95e50b32360eff1d76d42985fd5e52d8b0589b5cade841792b90163a7b3d36c77861727bccbe
SSDEEP 786432:NJvloSlTkhzUlKae/e/ATcgAijk5Mu6zB6QEBGee/WQ81xlH:jviSlTkh0K/pTeijq86Z8ezH
TLSH
T116772335DE3E0E40C6DE8E70C8EED200E09D9136E64FA94BAB791584576C59D3E7E30A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Language

Source

URLs

exe.dropper
http://api.wordpress.org/plugins/info/1.2/

Targets

- Target
  wordpress/readme.html
- Size 7KB
- SHA256 587d471315f941cbde21046760a35cb3668c7720d0029af3145e0e4188227439
- MD5 1f04dd54c5f57fc8d031b14b4696023e
- SHA1 c02b50a386fabcea8e244f694180cb4a02d33fe8
- SHA512 0c339edbdf449b8081d4df5b9cef016ac0435e3a43ce038e79dccf4366bbce0a1196df6c5524a204e173ce2327ea17a6da892b258cae6f217d673d604efce363
- SSDEEP 96:4UK8pz1E/4kF5kyJ0ifN8uueKQMdc8FdcwYKuID9kKCZxjD+9+25tdLwGg1IZz6+:68/SVPmuQ3C/Da7d0euCidI
- TLSH
  T196E1956BB5405376135143B1600621BA733300BEA79D4646949BE62EBBA23B4AF7F0DE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  wordpress/wp-admin/admin-header.php
- Size 8KB
- SHA256 b711bcf08edccef51b29b5883bae6215bf1165f0153c4c70b33f1dcc4a40aaf6
- MD5 e263a6e698df6f4483f1d63a0733dffd
- SHA1 4aa873ddb884e5738e5c4d983dfd54f12ea48d17
- SHA512 2acd2adb6f6a05d849638532e93e9f3c182d6a62aa326281d0de1a2ef92753d611e780d39f84bae63c084c40478f1607e4f6540be66507a6d44be270528f07bc
- SSDEEP 192:h/HW3xQB/m4TxU4ddqqQsY65ifPmWoAXZPXtSoVC46q:9W3xQB/mKyYd5iHSoVCXq
- TLSH
  T1A01255552CF2673388A22DD166D19278762B420BB3D52855BCF941F89B4136C8EFAFC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  wordpress/wp-admin/async-upload.php
- Size 4KB
- SHA256 a387db1ef45b49f9d7b903523a4a117a7b215baf61ae2e9edc9bfd6d2eb1ed9a
- MD5 7fb6e6b97ec0049302af0182a7232e26
- SHA1 f4edf4a09c094194428137ee6194697b827c81e9
- SHA512 bee9832aaeaf355a4779deef8529987f5d588ca541a889367f792ea69abaa0dffb19b20f9fb042bd72b940c558d97573a488787f3d1807818352ecb458426e6a
- SSDEEP 96:tKikv2f2NpGSrpPaxACpU4gr4M+sgaOE4Vo6vngDnVovMmDhscCkRejE0ZDGVli8:t7Vf2gx76shHaOg+fXmE0ZDGF
- TLSH
  T156A186F1A2AC676A512370C5564D842C649DC837B4806C99BC2DE4E0D68082EF4FAEA7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  wordpress/wp-admin/edit-form-advanced.php
- Size 28KB
- SHA256 cdb359818e03c8f60589b5a2e09db69197479a19290795597c0cd71c109a85b7
- MD5 e20570fe58fe2dabc3384abf474b94ce
- SHA1 1c86d116414c62dba265b4e446a78d530efa51b6
- SHA512 50d2029ec42a81446c2d00d06da3fcca82b41a734d8ff203015fc2c61d735622d786be44fb041dc3323ba2f79e04383f018ca3818b82b3a99a9578254a3b4108
- SSDEEP 768:Y9VrD7o895VXfsX3EiqKb1SceoC0Dm8gIL+t2Oa6QEmtWZmOmB:SVrD7195Zf83Eiq61ScpC0Dm8gIL+t2P
- TLSH
  T130D2E956F1F8126159131682F8C8927CEEBD8055738158EAFCBE54ECB7C3272453AFA8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  wordpress/wp-admin/edit-form-blocks.php
- Size 12KB
- SHA256 3935654072f1314d61b86c95ec2be74d49baad5c18b8a8f781ac8f1b07494b46
- MD5 56f8439b6b116b14baa74ff17ff7af15
- SHA1 e99498ee1b551161338f2c5770998f7e934cff89
- SHA512 cbd0a0bf79500f803929a0824fe4510d87894eb2971ea9221fd5c1f0bac90719c5ec2e0c53cad9e261bb11c5b3fd3b0358f4351609ebf3ea73a7b8666f89b225
- SSDEEP 192:70DKcZr4Z/ynVlIqEqgtIy+2d2QZH3f3DOBaGbJF+0x23MN259UDqTk:4KcZr4Z/ynRQxPDOFrKMeoqTk
- TLSH
  T134521917A4BCA37A00733695DC1C85F9AC650486B301A4E1F9FECD886B471E98A31FF6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  wordpress/wp-admin/edit-form-comment.php
- Size 8KB
- SHA256 b994079a3e1cbdb637866dc7f22f9c1c645f4186633ea91822bde117e9b78e3a
- MD5 05a28a3e49baaa396a40730b08e76ff9
- SHA1 f30c37b3481833953d5ed7647930bb879fcfde8a
- SHA512 625402537ace95e3d1fe167009e47d3b60ee0c8db8eb16e06ab9e7c49f625678f879a66e898b1759a811167a0e0441929313a6ad680e50e3ed4d8031e1b6bfaa
- SSDEEP 192:TosxqDLyvTQ/fuBU/albNBNRj8yV9p/4iCtoW0MLexXLtkYyPyVKL:TosxqDLsTQ/fIUilHjBCSW08rPyc
- TLSH
  T17D02769390E44721C0A33CD12D9867B939C88709E2491C8CAABCC5D86F50FA66D36B9D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  wordpress/wp-admin/edit-tag-form.php
- Size 10KB
- SHA256 2e7650eb284feae284317861a2fe1ade4fb1cbbc15d27412f6ca7d8726e2f26d
- MD5 753931a48f65cc8582a2bdb892b1d344
- SHA1 efbdfe3965c655bd4d523b6f1bfa6915c5c1fcb6
- SHA512 e9af6896b7b16821ecc1474cc2afd971c4b1927b8a7c55746ecf417deb3e1d20407c335e92dc545dcb059b24c18938872450a5a4f9f3981a347f0a1057f5c12a
- SSDEEP 96:T4qPGi8wvR0Hi+hmVbmaE2azn47Nve21Jiysa/xdT+g7KA5HK3EIx7a558ZF8C9j:sqGCF4zn47kyBzJqVRaw91YI
- TLSH
  T1722283F759ECA63055530EC03CD2B7493FBDDE2976010CA9FA4ED8989725AE2493AE40
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  wordpress/wp-admin/edit-tags.php
- Size 22KB
- SHA256 fcd401000a326b05e0d398d1a0a093c3daa450cb6f1f3fe1f430753beb5e6e2a
- MD5 fded6fe2e5c50339a33ae9c678124005
- SHA1 e33d880c2b3c01aa5d0ebe73800852d965ce9688
- SHA512 ac8e71b2c32c2869ec5e592519738ccc3931d7fe72a460aba1efdb0916349cfdc770291220c849147beaf6192d35386338f66203687a9fab39458e1c50025eca
- SSDEEP 384:KFifr45F03CfXgsqlqf0rxgrZU46rPhkaLrANi8:KF7SU1qlW0rxgr2VLrAQ8
- TLSH
  T1B7A2E7EAAA9C517013171E80BDD8F35A7E7CC92472411CFA799CC458FB506A64B3AF88
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  wordpress/wp-admin/export.php
- Size 11KB
- SHA256 ee901231d339d23779867ad2bc8af2eca109d85d837f2e9638ecf40b3e006074
- MD5 209aae46126b9fa9c9e08dc43d2d79b5
- SHA1 be21bd8b2921b9fddd455c2c4944060b856a734b
- SHA512 2332c6be304fdb12b11077e00d1f848e758bd734be6317d75cd2cced1d126b448b4008057aab12a36ada969994b4742c4dbce079185a19e6e75aaded47dac848
- SSDEEP 192:f2I9QVgBMvCqjyNNgBtshhIzkeBs3QB8ToFKDOG1XspINm/P0R:eqQVgCv4NXhhxM3BZyJm30R
- TLSH
  T15B3264A3F5EC4B31849B28D416A497F13BEC890591016CC6F42D46ECA7D1D698C3EEEA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  wordpress/wp-admin/images/about-release-badge.svg
- Size 1KB
- SHA256 a6f18ca303f01dd08e9c2d348dcb5dc1cead624fc516e7e10e20550306e82351
- MD5 6fae3927855d6ffdf11307c04d7ec3bd
- SHA1 80a5d72980e450ce8718e4d211a65a907194bfef
- SHA512 a666b0e1175d94e4bf4f934064fcfdd0f754367bbea72d1354c3df1dc1a491fc9c5f17c898fac3f9ba7c205b83574eb96b865a6ef08c6fba7699d8c506918839
- TLSH
  T1824154DE6778D1ECA0C31B2FDF3009856B5FA4F96A2841D0C16D170864CBDC8E689C14
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral19 behavioral20
- Target
  wordpress/wp-admin/images/contribute-code.svg
- Size 9KB
- SHA256 5383af9878f5f7647fd4f46aecef497eaed7c16803ffa3071b710a1bfd89dd27
- MD5 b725278c2b638cb79b9dff90f526224c
- SHA1 adc72b808e6eeedad83560ae5ae11e40fb2c664f
- SHA512 35bbfdb5db23262916d7221c05c137f2e0821c6da89c16c7f1d48cdc7eb3b65872ca6335af53d480ef5e30669e0e47f73ad7eb307063e0486960705ca025280e
- SSDEEP 96:3QwY8Rs8V4Qt/n+8uh1QREQw5RGC19Rmt:3uV175Rz1it
- TLSH
  T1AA123FC8672D5528737A2E1E67072ACE00FF6C9CB25C3748EC1F69B5538B59AD42388D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral21 behavioral22
- Target
  wordpress/wp-admin/images/contribute-main.svg
- Size 17KB
- SHA256 d17763d0cf6ac7899dcf6c50075b682e983d0b0ff278e752b13061af2551dcbb
- MD5 abadc35556c6a613bc1632ecb0cbf000
- SHA1 54df7083d150caf86f0e09f3f14b8ca4e2533d00
- SHA512 0d78739db1c6729acf95153b6858c2941c04e75a416bae62722e0e64adba15aad222e5a5ce59a4047bee6dcb0d9707d7854c59674003452a419a1f8c50650fd4
- SSDEEP 96:VfWZZwfbiJYAXf8zffuTptfVJkeU3f8WzfWZZwfbiJYAXf8zffuTptfVJkeU3f8l:5RlkXSoL3JL
- TLSH
  T16D8234C8672D512877762E1EA7072ACE01FF6C9CB54C3748EC1F69B1538B999D82348E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral23 behavioral24
- Target
  wordpress/wp-admin/images/contribute-no-code.svg
- Size 8KB
- SHA256 17cf12d1a2f8693922386a4696d6e4b9786a4afff0dc65f86b014e0a33826212
- MD5 583f8b10a1cb4c6c8a52cf2731ced8ff
- SHA1 063ade614573d3044dd1c650695491d3c85482e0
- SHA512 857d604c8a228f6c9286b3b61d1ed2e9349e06c9af2cb5e86672c865f6efaa6681816dece85f8397d691a92af3b0a1bc79dc6fc2856f0eb5372ae7aa21deb1e6
- SSDEEP 96:0//ahMpMZa9MNI/SdXeYeAlEoAjBh9PwE1DdkgZA:0HahMpMZa9MuuXplEzjhPwEzRZA
- TLSH
  T11A02068CEB987F32AA541B809F51F0C4117B24EDEA647128546C54B8E5EFFAD8D1F0B2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral25 behavioral26
- Target
  wordpress/wp-admin/images/dashboard-background.svg
- Size 3KB
- SHA256 eb55d8055063f46e176b6780b55e8d98b999b9ad3b85fbca55c64b0221480546
- MD5 5b480d6b67f680796a4ba34f4d87c5fc
- SHA1 49ccd7b576475b4adbee1678fa19c1e2a828a75a
- SHA512 9ee1b84a753bd8e5bce782b9f2c370f21f07b81141623a2781b119a1c378de54af37abeaa213f14d1c7c352ff9a2b7a8e4138f4daf9dd447c975495735095d2d
- TLSH
  T137614A6DE6BCAA37D64AC28CD985E4643A1903C766C48241B16E9F9F5F28C830D1F7F0
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral27 behavioral28
- Target
  wordpress/wp-admin/images/freedom-1.svg
- Size 1KB
- SHA256 c641e751bcfb5d44aa4609d9f94c3aa9297f1baf564196b292aff3ee4e90ff72
- MD5 0b28aa39660dddc94f4a1aa117a75db2
- SHA1 ca822ca083e29e2ff15e9be4b50b80ab31a8e2a6
- SHA512 6d6918b9d5a73db24593380dd228093ea5444d631598e73a4418f48db0c3c891b8b12ce6bc693d6ab9cd34eb8e27ad95c496adf34cfa21a4b434be47812abef2
- TLSH
  T12A319AA592BCFD2AD6A1C1EC532BF1E0306E20285356A75859305F3F696A4B33409BB6
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral29 behavioral30
- Target
  wordpress/wp-admin/images/freedom-2.svg
- Size 7KB
- SHA256 59e2923003e08c636372d0a073fa51a7ec5be56e27a7e8456a98f1c65aad5eaf
- MD5 eccb22be2030bf67eb8c483e0389a044
- SHA1 d79e8a8f9d38db79520d395e203e4b0cf63d5eeb
- SHA512 16b170565e575e757778119c1318b48a63d80efb1d7771a4c5d8d12dba89af897111941abaa375570a41ad19ce0470446d99c778db0f5b0f442d14fa35c118fd
- SSDEEP 96:gJMZYjh0aRb/lo2t6xDymli9OYr0cY5lgBGOLbuGoKGQzwruihb55C:gV90aRbBQxDy9OYgcKlgB2equGHC
- TLSH
  T16BF1CBCCA72C81BCBD425FEE632A6410223E79BC31310D746DDD59A0A6E2E1DEE364C1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32