8383c4a72e31deaacec7385f9d916c5a3089dcd93fedc94bb1949722ca90dff9

Sharing

Copy URL Twitter E-mail

General

Target
wordpress-5.2.2.zip
Size 11.6MB
Sample260723-ph3dcsycja
SHA256 8383c4a72e31deaacec7385f9d916c5a3089dcd93fedc94bb1949722ca90dff9
MD5 a977eec37628a886964e67b5881df77c
SHA1 8137e24a2625c7f2eed92834cbc09edf84f39c7a
SHA512 a01b65b9a9f1a3371ac311e314eac4c0fb432e6b9fcf0128cd84ac19efaaee4bafc37a5927230b1f000d120fd7cb35f45d8d99173c7a9d471c177e0291c96260
SSDEEP 196608:S9kZJeOhdrq01pq/gLh86MSkpmdig/W/abo/XV9nS5M1MyS+tCMIGF5YS0ED/3Ot:Rxdr1pM0Omod9Shr+t/xL30A/VbXY
TLSH
T1A9C61234F52E4A42C20E4F78CBCD6544E0AD9162E21E694E5B351B8B9BFC1DE3E32746
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Language

Source

URLs

exe.dropper
http://api.wordpress.org/plugins/info/1.2/

Targets

- Target
  wordpress/readme.html
- Size 7KB
- SHA256 75de713715da0ed3d926a025c4b5f1fe8c205ea76a75232fee5bf8efb0ebcd40
- MD5 8734f564e795dad3f234b79f58e899d0
- SHA1 04d6776545c2a53b85de070ce5ad2a93de2abeff
- SHA512 d87442dfb5bee91ea3973ad4d3afbbba2f8d2849f0dc046e8ffe6db1cef628d2de2a04a93d77198aeaef9006ae3db012bf4b97eef76ad297f8e8994b5419791e
- SSDEEP 96:4UKLApz1z/4kR5kyJpbifN8uueKQPmt441tcqkKuIDdKCZUjD+9+v5tdYGgzIZzl:6LA/TZPqmuGQCwDaCdYUidI
- TLSH
  T1E3E1C66BB540437A171153B1A006217A773300BEA39C465654EBE62DBBA23B0BF7F4DE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  wordpress/wp-admin/admin-header.php
- Size 7KB
- SHA256 2297618f6d67aae20c3dce7148674473931bac3366473c7b9e32d2ca3688a789
- MD5 89facb12d99a661a4e4079aa61b8c5b5
- SHA1 f9d3430aae6fb89674eb5cd1ecb64b4e5e3fff6f
- SHA512 0aea27477a76e7d5a53de3d32b5aa056d37721e73fa4aee8c0b6a38f662d88333848654468ccd58ba1db551f32fc74dd4b7dd6ebd34f022d6d6abb0bd808caf0
- SSDEEP 192:D/HDzTcn3/o6v1diqql1Y6AifPEcXZPXt/d+C4fd5:DDzTcn3/oOvOdAiE8/d+CAd5
- TLSH
  T1A2F197415CF2676388A32AD176E1D27C362B4507F392289598F941F99F8136C8DEBFC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  wordpress/wp-admin/async-upload.php
- Size 3KB
- SHA256 da572d7f27de2199c7bf513feb03f24cff24cc0f9166df1aa8a480822d1693ff
- MD5 424574a8763266d7064967f6795d1921
- SHA1 a70f60014a23995a65634ae5e38ccd6316c88ea9
- SHA512 7a5272c4e22375ea22c6a4f67e61fa237b0cf70c5315361c34430c08e86eb1d10e2c4255d343a34297ae3eef267cf33c8b1396b7a8ea896f0ee2f7b7fc079b06
- TLSH
  T1CC7186F4B6E8A796117371C49649842C585D8413F4809C9C9C2CE4E0EA8496EA0FAFEB
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  wordpress/wp-admin/custom-header.php
- Size 46KB
- SHA256 b903f00b664d3ddd001c6d580c2ca62f6024245af383c27ddc0a544dfcac65e9
- MD5 1d9cafcd057c641eac362b72b7e39862
- SHA1 7f18413490cbcb62fd1f0d4c44e33f50c3153521
- SHA512 492441cc9e2857133ee5c86a899d4839ed7aa8578a8e13300de3b52cfd75447c150b57f7a9a5a5d10b2c41f98b6c195898f3bfff5ca5bd6d8867db3d6d55000b
- SSDEEP 768:rpTRqm90UEOYqgZm29/WjlmcHlevJCO/TlA5JpnjFiQpLvuajuYh:rp4m90ROYqgZL/ClmcHleRCO/TYJNDvp
- TLSH
  T15423B568F7BDF277403324A0EA1FAC4E85AEC5245241AADBBD8C90DD56C0D2CE934F95
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  wordpress/wp-admin/edit-form-advanced.php
- Size 27KB
- SHA256 77394b61455ad2eac44f6b7120130567c68eda5f657f435dd708c0cb852e5979
- MD5 fdbb42caab217da1c0fb6351bebfb27e
- SHA1 7dfada3fdacab23968c681e6a3f9a2d56376b30e
- SHA512 9c5d700b0b67958a39129de6eb703a92abbb79bf4d32d6806e7d033c71253df0a35f970f279acd3159f8a725c704aa4dd40b8528f2996a6a2f035e61b44b3cbb
- SSDEEP 768:KQ8lo1S1fTf7X3cPF1pECu5a8gIL+t2Oh6QkmD0xnSgxK:Z8loS1bfb3QF1pEm8gIL+t2Oh6QkmDc6
- TLSH
  T1FDC2F716F1F4236255131682F484927CDEBD8455738264EEECBE94ECBB83272453AFAC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  wordpress/wp-admin/edit-form-blocks.php
- Size 12KB
- SHA256 f31ebfcd5490e82ff47bd54477ade969a8bfb6907308c92d5b65a46094e7f119
- MD5 88cba868bb41c1488b9869dd8fe05c7f
- SHA1 e5d30c62ca256d47b062e07269b8d5112c47d6b7
- SHA512 2171fa8ae7082c3776b6471d5fcc9a4d3f9d39d3fc7eea99df75afbd1c621f6520dac28d241e94bdcf53efd9285086d1bb9207adc3036dedc53f37e51e261580
- SSDEEP 192:YDrYq7aJAXMKC6UyZG3E3OuOqO2stLgk44INKA+:grYq7aJARRJy6d5OltMR4IT+
- TLSH
  T10A42E72764BC933950622998ED1C81B86D684807375291F2FDFFBC546B4B2E98332FE5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  wordpress/wp-admin/edit-form-comment.php
- Size 7KB
- SHA256 5e3c0794e1e651b4bf21a05bdcdcab0a6c354c114b68a3215859cbeaa61f39a8
- MD5 295fb249728ecdfcf4157948e1bb14d0
- SHA1 79a0cd0369e5e07eeb9db8f5443252b1643f10cb
- SHA512 5b53d5c21772b286f035ad2ae1403bf670daed69edcc973908321701e368bc41eee4420a02c94816355b900d314b63d034d704d1f1249d95029c11c4069a2506
- SSDEEP 192:mosxqDLsUTQtuBkvalRNJmyV9yKat+P0ML8XLJkiyPyVKL:mosxqDLlTQtIkylh4tO089Pyc
- TLSH
  T19DF15542A0D44771C0E33CD17D98667978C8CB04E24A2C9CAABD84D86F50FA56D3ABED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  wordpress/wp-admin/edit-tag-form.php
- Size 9KB
- SHA256 8ce1fa2b0b327ba9131d6e1b73e82351f2fcd5d325dd96441bba0e462c23bea3
- MD5 edaed73005c0e2f6f3d9a589b34dcee5
- SHA1 b7e2af6183c0f5a5c64c2fee839b2df0885d0315
- SHA512 0de607fbd8e9066247ea24fb6298be39c35661cdf1df01144dcbe8e1e7ab2d7c087dddac0b3c567a3ddc55b40882da3c2da9a0b2e22b786a539611488b9c1fdb
- SSDEEP 96:hsm1eHf8HRzkgVVaEEDb4NNve7JiIaIjdT+g59Hn3CIx7t558fFuFXeMyLQP028j:2mY8klDb4NvC9HDRtlOpqFI
- TLSH
  T15C12D8F6699CB63045521EC07DE277467FEDDE2576010CB9FA4FD8A897208B2093BE80
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  wordpress/wp-admin/edit-tags.php
- Size 20KB
- SHA256 cc04d78e2fd1d8d1e162493e03adbb6cd6278d7f6aaa60727d4a3d0ebfddd58e
- MD5 6c4888fc9ad6b1dbca49f0af0d9375e7
- SHA1 fa5c5972bca765074f5620669367874a5973dc9a
- SHA512 8e837b10aa11c2f078335eede7244b2ce77da92c2eda098cc31bdeee2c0ae1529dc71e54ca2d9d5ec2085c4907188ce71c6a0b16858ad4cd7bd837e739cf02f7
- SSDEEP 384:tzifrwO3T3sfXg8q4syrdgrJI1S3IebhLrLYDN:tzAb67q4syrdgrH1LrLkN
- TLSH
  T11D92D6EAE69C627112135E80BDD8E25B7E7CC93436411CFE799CD058FB505760A3AF88
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  wordpress/wp-admin/export.php
- Size 10KB
- SHA256 1ef0ef044db6082fda7717b6acdf309ef174f829b55fa05fc3076602829309b1
- MD5 855cfc01ecc31687fe7af74ef1d3755c
- SHA1 ae013ea2c23a7009a1572a33c0a481df77b2070b
- SHA512 cf15f5ca3a2f9ba3572dbce764ccc0427f0a916d227248672e96fe232d43edd5dc6392d294e862d60428e7ec54df6405e0e947ca0533bd332ea8e73eb4878103
- SSDEEP 192:fJHWPgBMv9RseiZg0HY8nvKhwzkrs31B8ToFriOGHXspIEm/H6:h2PgCvviHH5KhJroBZg2mP6
- TLSH
  T1DF3276A3F5E84B3184DB28D415A496F12AEC8D0591012CC6F41D46ECA7D1D69CC3FFEA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  wordpress/wp-admin/images/wordpress-logo-white.svg
- Size 1KB
- SHA256 a069a75b57617e5a262c71466627b5f05a67d4e70646efe72dda4e1ad6130b41
- MD5 19bdd97150fb43aa862d53500c44e6f7
- SHA1 b288b88784b040847db124ece3bf332e4a4173a9
- SHA512 7c963de397dc51317d5ed7283322ef3a34896a6a4981d55278f3c550c85d27ddd4eaddf91912a535934017709e8aab38d65c4ba72af3225b30ba8a9926763d39
- TLSH
  T108311476D6085394BAA38A58DE338061370F7CFC579E63B12262C37379816D4E4C4D6C
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral21 behavioral22
- Target
  wordpress/wp-admin/images/wordpress-logo.svg
- Size 1KB
- SHA256 a0bbefd626f1e76f9245ec6c6101b679ba27412b71b32fc43eccda9db40f394b
- MD5 f34ef6259364f7ef0ccf67cd1dddc970
- SHA1 18b563726b3d24a73552791fff91f61077ae1ec5
- SHA512 c4ef2a19b114946484a6fadbe9bcfd80111779a5bfce8fa1d38bc09915a6e660978435f7796b34a7c71668d97c0e87186188ee5ba1704aafa592c22754e63651
- TLSH
  T1D131008D873958FC68A693E4AF30B8A3262C95DA5171D988931D993169D0CC9EB44CD8
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral23 behavioral24
- Target
  wordpress/wp-admin/import.php
- Size 7KB
- SHA256 34ecf87242884fbb6c3f61d4b103326b58b870bfc2498d150615f3d917e41630
- MD5 692e2842c89539bc47d94422b049a427
- SHA1 7a493eff3273503e64575304cf32c2030e7dec6f
- SHA512 39fd3eccbdc6b06b5b7123a5d6253e0aea938a29b5fe4c488128a230ba3745976789ef5ea9a175719d58d4f8737716db646987717e35b608a71c5044bb16c954
- SSDEEP 192:Phgb3a4iPkP1diDOPzAwWT2V2zlBJ5kmN:pgj0GeoALqVIgmN
- TLSH
  T149E16563E7DC11370572EAC8199901F521FE41B1730199AAB8AF0774BFA7138A976E0D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  wordpress/wp-admin/includes/ajax-actions.php
- Size 134KB
- SHA256 199feb806f8b35a14160df9fd1f4390e38ae625a890d48b31c2becc1c5c5781f
- MD5 3517de38bf9f7d305bf2e04c3ff95d30
- SHA1 20c7e7071c596b0bf48692f2fd3c2f04e4f388ce
- SHA512 253d320d06ef872d98e4e741661697cbfcbfb3c0f579f47c5448fd4f71c3394974dae7a99f8c1466e24990420a4b1578bc03f8df07ae1565c17affbb97273c02
- SSDEEP 3072:1uh28entme7hiyBpvu0MBABXswvJK2TEzb3UIVVGQ/flIFb5Ty:1ZntXW0MeHvQ2TEzbEIbcFFTy
- TLSH
  T146D3C595D6FC613B413330A19E2840AA3CBC0572B1410DDEBE7D68587F506AEEA7EF58
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  wordpress/wp-admin/includes/class-core-upgrader.php
- Size 14KB
- SHA256 217e698715451a730940c1087d45f227fc37f30214a6384704037f41d970063d
- MD5 ce4653a3a4aabc8f4e93607e06a6dcb5
- SHA1 f980a928a0fabc301bd31979bdda50e0907839b3
- SHA512 87c8ad0e3f0a28a03119f8b8fecf340c5dca5873eb0d005934b324235b639b5d1e46127915fa5b87e1f19f291f17e7c4bfce27a4bede6e3a971cc5f38324b833
- SSDEEP 384:7HqcH+62xDayguDNtzBL7kczgOkPFNNVDUPpjcDQU3jSXGpCm5KsJZc3dK:7KE+jxeahtzBL7ZzgOkPFPVyjcUcjSWH
- TLSH
  T1AF5282D4A7CDA6BB44317298DD5461B8723C98BE515818D5FC9C0A64B38013EAB3FF2E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  wordpress/wp-admin/includes/class-ftp.php
- Size 26KB
- SHA256 27d68baa00a5367b238682278b86e29c08ed14c90da53662429c0080d6d2e21c
- MD5 12ac36c3d84c1685b0c42c74289f99da
- SHA1 37acf9023e5ef2943f69d806efd92a44fff6ac5a
- SHA512 0710d67d8b56f25c969fc242019440bf1173e37c3cd97dc50437626574e59999fe75edc1348eff7f8a787fe4010a09573fde36736b9bb1d7f858a907bb70aa8e
- SSDEEP 768:F6q1jqhlXzMgIXGsObD5gseUrLzFFloSY:8gKD5gyFFloSY
- TLSH
  T1ABC21EC3BF9FACD63592D0E94353905FE86CB531686A8C47BDD981343B9832D809E978
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32