d636a852ac7ee87077ef6cc680641fd2dbfd442ae525232dc8152f33d2ac141f

Sharing

Copy URL Twitter E-mail

General

Target
booking-activities.1.18.4.zip
Size 1.2MB
Sample260720-wp9jksct7y
SHA256 d636a852ac7ee87077ef6cc680641fd2dbfd442ae525232dc8152f33d2ac141f
MD5 c8a5df190584f1c8cd013900842a7155
SHA1 65118c5b0498248c216fd2702938bfd9020fe288
SHA512 f63358d72d4a659e0aadd60e3d4882ad67bbda53e87f98821a0a49c0875729ccbed676726a6d31167e6a2b5a5d50cb8dab525f1bf27c4d1c56f62958bea4835b
SSDEEP 24576:pNOb/pniD8Byy+Gk2ScKbpslnJUSek4fEK8XnyPV1wyYBd5ymRws7G:pyTUXfcKlGilfEKEyPV10hRwEG
TLSH
T10E452319F55C5A38EB4F8938BC4632AB6198E1C3502038BBBF1476FB8F629DD5740B19
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  booking-activities/class/class-bookings-list.php
- Size 31KB
- SHA256 ef0b73e93b9b86d6a0b93319fcbc67fa536d2096ab5f76658223e79bf9608b2f
- MD5 032ba3b332cd1ecbe6a703ad957f8c98
- SHA1 2a4fee8744d62639160099ce450afb64f7b1bfd7
- SHA512 5507933aa09f6ed9df41d79463bf6b4f6965920e03f7c6f9bc041afe2ef6666bdc8eed16b39cf7619c3b8605c743e79d4f9908a08d521ebff09d5340aa7ac437
- SSDEEP 768:buD4EVMssQJpCbBURzKQw7EiiR4S8Uu+hYFSi9r4d:e4gMssQzCbBURzKQw7EiiR4VV+hk39rA
- TLSH
  T1ABE24086F29D797E02E373B15EB49A07D4BCC531C0022CDAB95CF9317720B6986B8B65
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  booking-activities/class/class-forms-list.php
- Size 21KB
- SHA256 794706611305395a44bbc4c543e56bb9aaec43adc8c12fd783449ab65212915f
- MD5 5039377564e7b09ffdab3dd21c374199
- SHA1 4ba27f2d7e7fbe46dd59dfcd3c97f2059b14a1ac
- SHA512 88b77b7bc2abb737dfa71158d536a35057619382a013d6155517a5add91f9aefd2f023229d70fece9e0acd17871b2da32db96e889debfe4c236bf67ed6473c2c
- SSDEEP 384:Hu0tXywegt/q3nMRkR3pRaWtReaRTCFC1gRwG0g19D+gPM6D4MSKXzJAQ88kC:Hu0tC9g68z0gj+yLD4xKB3kC
- TLSH
  T11FA2A4C7B39EB97E15933241A9F98A19E17CD03090013CDABC5DE504BB74B59CAB8B39
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  booking-activities/class/class-notifications-list.php
- Size 23KB
- SHA256 ce87dc50d807bfaa0c937dcb7279b54313105cfa567644cbf14e4b358fa4829e
- MD5 5aaa2857fcdc293416fa57f31ce89ca9
- SHA1 d491fe04704782b0e1df8502e4a46aca47a59e5e
- SHA512 68180daeebf02453465e31491bf7a6d75ccc24bbbaa00bc419200eda7b6b135b56b6d3a39aa0111104a1c0052cffebaf0eefc061b0149aab77a87d7546df4ca3
- SSDEEP 384:7u5Wh4wh1Ljt/qrBAvge6uqakJuE1iA7i7LfDJzr9+JRyKuSn/dyk04B88Gr6P:7u5Wz1Lj+Bygen7E3i7rFzr9Gtd8W3Ga
- TLSH
  T162B274CBB39FB1BA1AC3B122A9768551D4BFD13490022CC5BACED0007761715CBBBA25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  booking-activities/controller/controller-bookings.php
- Size 92KB
- SHA256 afc0856fe69adb51d70837f069cd2ad83129252cdd4773e82619a3373e902673
- MD5 cbd9f5bc65b46b5b46610556102aa85a
- SHA1 f3b88002ef54f59529298db33baabc6671d1b2a1
- SHA512 c12fa2e48ca5956af0084574359fdbf9ad9732a8c21c562c405010c590b9707d96d2e50756aa63d783722172dd36800792c51464bc27a7fef05a7882b130baf0
- SSDEEP 768:p267pRni9PJAjYqTXHqJ8/VH9C/lPxf45twXje2ZUrPa+roA5lGZvT0BMLBKHlMy:pc9fZXqmZvTDKHlMCG/2rz
- TLSH
  T16D93105FF0A5A57E87F373B14EB0961B98F4085682420EE6B51D37302761AD48EB8F4E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  booking-activities/controller/controller-forms.php
- Size 93KB
- SHA256 0898b08102d84ec05db5035037167d5adcc8e0c6a1bdd0bc0513b72b80f34325
- MD5 caf94264902b66bccdafbd29fdd7e133
- SHA1 21929fa606860d0848c21e7f64df29ead7042465
- SHA512 d2b37cf992b3e780ff7bb875ff73f50e61fd5ea56bb869e993145feaf5e1ef9ae656acfcd6b256e8ca76f40eca3b074d6379f6d61d93d496ec4430febe5b5ce7
- SSDEEP 1536:msMCWZd9CdwlRXqWaKQxbUA8YAaU5Z6CyuapymaAZCQS8MaSZhVCQS8MaSZ4z2ME:0XqpxPXkuanmaXWDbGsn4sz6t8VJeiLF
- TLSH
  T13393645B7199A53D8663B6B04AF0D32AA7588030CB015EE6FF6C395B37B25C09C94F8D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  booking-activities/controller/controller-notifications.php
- Size 23KB
- SHA256 45e8cb778bd85a0d4fce4b2b9f08084c2ab981cb99d3da0d75a6776aead2ca3a
- MD5 4df06cf3a7adf8a2e572737111cc83dd
- SHA1 84089b93edfc311711734cd5f02dbb02c8801e0f
- SHA512 75f0ecc349dd5282f2659ef91c43598e2d26239b6c10d8ae0359bc5a9704fa4e4d0d37d7930abb67e3dd1cac50af4f9f8273856a8af3400e7c5cfe3269852643
- SSDEEP 384:9sgRYiMfbEc/A1hDi2v2czG6wh97n1V4By6GbqRa+qsXJdXqDm257qmn9qZUgnDj:9wQRv28wh91V4By6OqRa+qWdXq6257q7
- TLSH
  T128B252AFE1AA33BD1FD7A1724C97508AB87F41195D022D916B9F51242F223E4CE63E1C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  booking-activities/controller/controller-settings.php
- Size 29KB
- SHA256 a3c20fc07c4e8c5f7ecb6c9156974deba5cc4ad3ee3b27762d22a7f3422edf53
- MD5 129254a268ad12e9d9f74c75d333628a
- SHA1 73192a1a43e6b9f2327f0443fd139da2249fe196
- SHA512 cfc0a17085934fd53bf4e161135e847f35ca721eafed01622df33bc33700f886d4d8fd41aec3d55f076f3d7a3c1e8da4092400d67ecc6d6d5d938c7e4a9f463f
- SSDEEP 384:n/Rd9w3IRdfdRS9/hRdDnRdgURdC5RdcARdrdRdXiRd1DRdQVRT3Rw3RtpRCARg6:/9VUzD2pZy5icziVL4t7rKGjECB7QhM
- TLSH
  T171D2527EB165763D0B2793318D71960EA03880419421AEF3B97E66163F137DC8DA2E8F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral13 behavioral14
- Target
  booking-activities/controller/controller-templates.php
- Size 81KB
- SHA256 c249c360db2d4bf0db43fb365629576780be5131adcc5210ae582c1b31de4fd4
- MD5 999bb810c58554ed0ba94acde05f32fc
- SHA1 1af7cd4803e6ccb7800230e5fba27951e8e6f314
- SHA512 c56eac6ae2b46e5fcc150bcb90a09aebda8c8df7fcb9e849de3b16d34f83abc48584c5d3b001343935cf541c1a8f04e5859ecb30d7572b264bc06afc4461d62a
- SSDEEP 1536:kAI1fsMjQiokq+9uoij7BkPLRHaU4pHVZ/hHyZ/ZvkH6Uuio8soQo:EDRHOH9HF/
- TLSH
  T1648314AD2169F97DC7FB31B847B0CA0BE97401E597820AF6764C1E4827219E09D7CE4E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  booking-activities/controller/controller-woocommerce-backend.php
- Size 29KB
- SHA256 d6c311768f9f616c861265f289b7de00c5433126e225dd6014db072ed2986bd9
- MD5 078c5cf15216cfd0563b5f5c4469801e
- SHA1 dce15d29ff89101c2a5fd48828119c14aeae4493
- SHA512 6fd044bd5781cbdd90e5049f3951cd764e5f8451187ea954e848ff821ae4989d11f4c4a6d1c41691a7034308fedc4ecfeb32a3c87bb2b81a126dccb980e10bd6
- SSDEEP 768:BN42CkxS0Jb1+PyAe8FH6vhxhyDNryGNqDx3OnOJNa:SRe8h6vHhyDNryGNqDInOJA
- TLSH
  T149D241A7F3AC713D12FA33B10D85825FB8DD642293810EA56C2D7B7826322D45DB5B1E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  booking-activities/controller/controller-woocommerce-blocks.php
- Size 6KB
- SHA256 a9038c7888aa21ec42ceebb1630a7de97bb148d4555de4145e210946db4c0826
- MD5 52668393e6a7fe5eef155b8ca1321128
- SHA1 c504d3d7c77d9e88a9dafa3e56dd186d09036501
- SHA512 aa092b4e489b1428ef87669d38b4a9c30117d6e5bc92e23ded6b8af0ede9ccfa581e65b8370649656daa23e5c2f50266a2579c6613a394f2a2d3638c432710bb
- SSDEEP 192:YACCCS5CDbHxh3nhASvQpA5uEhVpb7qYffLqWO2:WVVkGbeEqWO2
- TLSH
  T146E122DBB4BAE1BE43E673219D7099A5FC7C8021834108E4F80EB5153B195CA8F23B5E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  booking-activities/controller/controller-woocommerce-bookings.php
- Size 71KB
- SHA256 508452b83e725c5c3dab373f9403540b13e1b20766a5bbd40d1b1a5b9c444005
- MD5 f6a06d20c625bc09bf992e95be3a0b64
- SHA1 6bc4e701c6491977df2fcbd47263b6bbdc81a1d9
- SHA512 61d72b6bd7e8910a6032c44c57641a2a42efead563e7b54f1618928f949708588e0ea1e568a4ae69b858926e232dcd5c10ecf528a2a68afd544629324ca85399
- SSDEEP 1536:jGV9d8HpTh5WvYcZHOE9VjVNVfV6hGtKL4EMLAQykMYAVMBAY3:jGVuTcZHOE9VjVNVfV66KL4EEJhCEZ3
- TLSH
  T1CD731F5BF0B9713E47F6F3705E759E6BA8E8C051D1022EE8B90C76343661BE489B4A0D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  booking-activities/controller/controller-woocommerce-forms.php
- Size 37KB
- SHA256 ebed73d35aa33a783a08c5905847c0fa3c34aece81a477e4ab4c6c994c83d7e7
- MD5 0d8d19dfe2f40e87c1987100ca9813a7
- SHA1 ea73ec7586428208844f39688456be15f3cf6703
- SHA512 d8ca1e7b469d484d4898847747a79447636591256479cbacebdb2de24e20b1c836156111bb561a3787c5d9d62181ba775b1952d67a9d40f670a79ff87f58a511
- SSDEEP 768:HBdVa2NgVLOJuq6SSUGNU3SY7Nlj6+xSUzdoZ/As84:hdVa2iVLOJuqbSUGPYxlW+ss6V
- TLSH
  T1910361DAF0BE653E21A7567009F0E186ED384850D2C21CE9BB4D3E461771B91CBA6F4E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  booking-activities/controller/controller-woocommerce-frontend.php
- Size 102KB
- SHA256 687d7c16e1bbd8ec4aa0f2e1f862d0fc0381c079a1ba8424581be832cba644d1
- MD5 98cbd49b6b00028457b7a6490518bb52
- SHA1 75c2883129e9508f2e0f1964ede3c1d7213c87f7
- SHA512 350b179f2951fde1b9719aa34fd71138f3721783793635e9a722e7532675d35565d7c28af1c1c59426ca0b29ace4afcdcaf534b7c73c3a9fca8c0c0587485f71
- SSDEEP 1536:m8tjfADnktEKCEwfARt/bnbtFQMxac/MCFWBQfDhjhNpzdq0pXDXwqFmj4Aqk7B+:m8+sTBNa8RFWBQfDhjhxDyj2
- TLSH
  T11AA342A7F5F5713E12E27B705D816ACBBEAC4413D2411CEDA80C76282B117DA8B71B1E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  booking-activities/css/fonts/booking_activities_icons.svg
- Size 31KB
- SHA256 ee7598fb728bdf0f0a71f800b557a0c14ecfb84cde672376377f3f8838af8c3c
- MD5 7bafee62b73b30569d2e386f0d9f8373
- SHA1 8a2c668f13afec96baa4e585f316ea379f7680e6
- SHA512 2d769a398fca8c13ae03f5467c38a4ed39a3cab8a18089178a518090588465bb1a7fa2253a52b52fa6e50bdd68464973b407a949adb5953a40056d48a95dc03f
- SSDEEP 768:LQ92VdzEifbifbsCQWTVE6rwKXHV06oPgfiX4s0CFyGZtb4KFsmi:k92k6CdQWTVjrweHV06oh0CFp3FHi
- TLSH
  T13BE2B6F11233B7DFADC0EC967550365062B81067BFAD02C4EB5EA92F087ABA15874E71
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral27 behavioral28
- Target
  booking-activities/functions/functions-booking-system.php
- Size 251KB
- SHA256 3b1ea72e47411fae1e8fcba96af054b19d32ccfa76c6104ce274b57c43ff26b3
- MD5 104ff02b2d16b7728421c8945c810227
- SHA1 1cf9295f94b4d3e7799efca9b273f80c8bf1f801
- SHA512 e303e7f1f5bd813686473d356caa29f60ac374bc8764c5921650aeb6d9c2083eda7dde236496c4f2728d6fb008c7372f1d8275c664157a718e3ebd272f5992d1
- SSDEEP 6144:eUhs0sebhz/+E6+KX1iL20kUrZS1sdJ4iWVUqAGHkkHgf7m5MUKkHXHN7XHFZ1vz:eUhs0sebB/+E6+yVUqAGHkkHgf7m5MU3
- TLSH
  T1934464D3D3E94A3D54BF32B90B81D707D63C42B1A5421CA97A4E2C982B65B74D078BCE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  booking-activities/functions/functions-bookings.php
- Size 168KB
- SHA256 b160c787239ad68136d9c1370a6f3ba2117dced2304daca5818b46db583200b6
- MD5 bf9e8ff3ee10707fbba23450a6723130
- SHA1 f5a2057874b71a3a3d525e9275d65425ca4d4d08
- SHA512 063023be1120911c3e09099aaec10b2004a35cc32bb50fc215d171d10cba91314424b4b8287ef5ccf3700c53dc707e616ea0f4b2ea43ebeca79cb1bae7e87f06
- SSDEEP 3072:TMIMRoqctOOkFfy3ugFygg/9DGPFLBwDKKZ0TIBN1mSUsNJA9K5IuNd3QCv6A+9a:w5yQy3uf/ew3Vv6zNaNnOU66GW
- TLSH
  T1C8F39357F1AA613E47E373B00EB0D51BD8F8C56191021DE9791D3A352B21BE88AB8F4D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Command and Scripting Interpreter: PowerShell

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32