e45bb0540dde2d444b29f379fb12f581d0fad5e3d7ba8dd8a729f1395f8d35c1

Sharing

Copy URL Twitter E-mail

General

Target
wordpress-4.5.3-pt_BR.zip
Size 8.5MB
Sample260727-g648vsxblc
SHA256 e45bb0540dde2d444b29f379fb12f581d0fad5e3d7ba8dd8a729f1395f8d35c1
MD5 e4a32f9ede8b3969eaf4019bc56e4f2d
SHA1 a51678bdfb7fd05942a163735bd92c7fff8fffde
SHA512 59837bc7777c186f360b7de03248a4a166785721c1cae0921106986d312a465e8a8b141289299ef10f224118401dd5ca3638860a159a8e3db8fc2f2ed29dbcaa
SSDEEP 196608:x6ZGejzXAgHYOEiuBCEmNJ6vTWYYOat1AeUpcGNoBePtfO+y:MfzXJYOEiECTjCsDtTUVtf2
TLSH
T18F9622B4EA6E1EA1C35DC67088DDE040D0BDD163F25B9A9B5B392680D72899CFF32705
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Language

Source

URLs

exe.dropper
http://api.wordpress.org/plugins/info/1.0/

Targets

- Target
  wordpress/readme.html
- Size 9KB
- SHA256 aba310763476d04cc3bf7cb926811dea4db99251a36d87ebf112c83bec7cf856
- MD5 a3e4c267d60b4fc7e3166bfe34583673
- SHA1 6af1cdec40357d58af8e7fbcd5af2c412cddf7e8
- SHA512 d6fbf075894de4fef927ba4ab49c6b14ea0c5b92f78bf79e93bee8587f346e2660af5d9ec552747ee6802e7a8ebbf4496bfedadc4e59c6b17b79a6a50bd2b647
- SSDEEP 96:1zfG1J8LYWBOrciLReRsdurNaVmgGEMrwm0MS8IwZjXMD4U4Tuo0Wh+oybLVF2Dh:w8LisrNiGTxBXI47LELjMgYJnL3dT
- TLSH
  T1F522C66D6EC0032E1211C3A5F657073BB19602DAA54EC747D4EB4F1AB3C42B0ED2BA8D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  wordpress/wp-admin/admin-header.php
- Size 6KB
- SHA256 79d428ed12e732dab6299e4515615aa102cca3f0094bca443c5aa712fd109a44
- MD5 e59419f76c64a6ba6018ffe48a25382f
- SHA1 e1db2b679a74446e505dbad62d134f6a839192f6
- SHA512 5e578517a69a695938eda2f356b0e8d3816d931195830e39ce41bc2ef556652be7eeb0cc7891538e1162c42dce6143cb3f14867d830d4eba87a7c34d9f838c1d
- SSDEEP 192:HUaZXPINIK/q6v1d8qqDoS0i5rvXZPX32PYYJx:tZXPKv/qOFzS0i32PYY7
- TLSH
  T181E173411CF2676388A30AD265E6D27835178A1BF38228909CF641F99E913588DF7EC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  wordpress/wp-admin/async-upload.php
- Size 4KB
- SHA256 64028e411064cd865a3ca77193e62f44f4bfdd1dc8bd8edc9b13f6da573a20ea
- MD5 7e11643468caa5dac268efc64e0b01b0
- SHA1 3260b7fd59406fcb21d942ae377e38a4e3ed325f
- SHA512 d402e305b0612108389c3c94b5d1838dd6826e677417813bc71453581581f92066dd04662a39c0377f7a37563d44f32bedf3379c519c7f6a6088678718d357bb
- SSDEEP 96:tKzk2SabJRMDl+0F+kLheLKNabo6BDnbov/DnlCeaz60WM:tEsKy1FVeyJRTaz9
- TLSH
  T1F19187F566F8A77A5133B0C84A4C802DA559C913B1809D5C5C6CF0E0DBC496FE0FAEAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  wordpress/wp-admin/custom-header.php
- Size 43KB
- SHA256 28a90c3b08d88ec46593d57032e6fa61bffd284e1931721617a5f625e2d219c0
- MD5 b97a5f75f1ed09129cb8d18d034244eb
- SHA1 7a734efde91f4defafef715f46cb2a384898a817
- SHA512 70dd3c9cae3bef0af60723a60eac4fa6396e3fbbb9b1f22dc34c1b7dfa598f4876e19c9b7683c48260013e4cb39a5e066eea9da5cb2aca5b2cd33d14691d864c
- SSDEEP 768:qp1fwQYR2WiDDPGaoByjlmhNtje/RmwO/TmxxLg6FiQvNux1nAt:qpaQYRniDDPKB+lmhNtjeJmwO/Tgpuxi
- TLSH
  T1A213D668F7BDF23B403328A4E60EAC1E55AEC5145242ABDBBD8C90DE59C0D2CD974F85
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  wordpress/wp-admin/edit-form-advanced.php
- Size 31KB
- SHA256 475ed53be155a346afb4519dc4251564df8e86d413f08998f51cfc2435499031
- MD5 ec47b8411683ab0c2cdefc4588062a83
- SHA1 ae25d8c1e78f85a5675566996ec079f55ae17d8e
- SHA512 0d6f48fd4dc6cc4533ab9222ac9d736df1ef01185a86d7a719ce7ea524d70903e0227e84cd43e8b6ed27bbc7a882d8d4bf9edb4c4e2b1bb6864decd4f0a4719c
- SSDEEP 768:NR0gcA1crX+hVAeiK0C8X3cPcoC2BuwaxnLL+t9dYAQkf5YUsI6ua3fI:/0gcA1crX+L7iKg3QcoC20xnLL+t9dY2
- TLSH
  T1B1E20916A1F8236154234280F584D27CDE7D8451739164E9EDFE94E8BBD32B38936FAC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  wordpress/wp-admin/edit-form-comment.php
- Size 7KB
- SHA256 cfd0fcedfc7912f13d2fca21dae7faf3cf9dbea86a2a0575ddd8cff826f70234
- MD5 b2afe23ef1dfb3b0c87034d5b5dc6142
- SHA1 01646a284647fb57098e2b6ddb2652f32cf24ac2
- SHA512 6db796c8816b42f34186cf551107509608b3eef83b6afdca88066cad165147e8d2691fdd1b2c0789d628888f0922461a52deaccb3affa250a75944b0e3485394
- SSDEEP 192:qxsxqDLwOTgsOkvub2mNJmaxdyCY+70MLhfLdECYJXj4ByMVA:qxsxqDLZTgrkm22880DCYxj4B0
- TLSH
  T1B0E16553B0D4477190A33CD17DA8667938C8CB04E24A1C5CAABC94D86F40FA6AD3ABDD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  wordpress/wp-admin/edit-tag-form.php
- Size 8KB
- SHA256 d19ff013e0dd36fc533a610e89db59cf65c4d5efaf01bc086847388283d94c3f
- MD5 5fec5e01c8390ec789d239c23f0ab0bc
- SHA1 621949620bdbf0e47eb6ccd24d0082b4e888b04a
- SHA512 1b63f9ce461e55b855db94cbdb1b00156badda638c664b13a800cba19663c0668ec36fcf9368c0f92989474ffb92144d6cf39f39131025fbc230f9cb53eed221
- SSDEEP 96:h2UJ1Vif8WRF6BR1aECx04kNve6JajrYdx+mm5Hn3DIxB558fFYPF1zMNLHPN28j:TJvm6Box04kGz5HMzH5kjnGA
- TLSH
  T11202A5E668ACF53005530ED07CE3B7867FED9E2576411CA9BA8FDCA493218A14937E84
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  wordpress/wp-admin/edit-tags.php
- Size 20KB
- SHA256 68f9bb218142fa9aabc2879b8b9a8b61178e7d0f79758caf976b45553b140898
- MD5 24d74d58296195e1eb2efe0a19113c8b
- SHA1 5e16b755b8f12f86d0b3c82af717e147c6f6f9ea
- SHA512 b9e05ed57d384e1f6e7cbb76c25256ce6271d557a0f5f4a86560a035084d60da01fe008dc7fc74a943a4852a82285ec97d13d36c9114c95095b1e9f04203f778
- SSDEEP 384:oOw7wLuEiwWmXRfgga0ewJtkLtxH6LIHYnYtUVw/fhcN:oOw7wLuEiwbmt0ewJtkLtxKIHYYtxGN
- TLSH
  T1B192D9E7A698517002175E91BED4F21B7E2CCD3172021CFA7A9CD0A4F7516A7073AF88
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  wordpress/wp-admin/export.php
- Size 10KB
- SHA256 728cf7b96d40ac236ab16b55c45e866e41c0d3204a9ddf80b07dad74026342d8
- MD5 99dbf296761e8c3a044b5e038fc82df3
- SHA1 0e95422b6077874fa9630d2248c489b838ee3856
- SHA512 a0a6bd7565aca1779f36f77c1af5fc897f34d97627fb23d6e7d0d62cfba47a36b8141f0b66b4b083b591ec09be2a44c5d5b36140ce8ef922a473d1aa6c8f79ea
- SSDEEP 192:fXbTqODPvGR8eiug0jEnF+rwzkrs41B8ToFAEOZHXspIEsn/yq6:vbT3bvEigs+rJrV1BZx4kg6q6
- TLSH
  T1E32298A3B4AC8B3184DB28D911A4D7F12BEC8D0591062C86D81D46EC97D1D6DCC2FAFA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  wordpress/wp-admin/images/wordpress-logo-white.svg
- Size 1KB
- SHA256 a069a75b57617e5a262c71466627b5f05a67d4e70646efe72dda4e1ad6130b41
- MD5 19bdd97150fb43aa862d53500c44e6f7
- SHA1 b288b88784b040847db124ece3bf332e4a4173a9
- SHA512 7c963de397dc51317d5ed7283322ef3a34896a6a4981d55278f3c550c85d27ddd4eaddf91912a535934017709e8aab38d65c4ba72af3225b30ba8a9926763d39
- TLSH
  T108311476D6085394BAA38A58DE338061370F7CFC579E63B12262C37379816D4E4C4D6C
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral19 behavioral20
- Target
  wordpress/wp-admin/images/wordpress-logo.svg
- Size 1KB
- SHA256 a0bbefd626f1e76f9245ec6c6101b679ba27412b71b32fc43eccda9db40f394b
- MD5 f34ef6259364f7ef0ccf67cd1dddc970
- SHA1 18b563726b3d24a73552791fff91f61077ae1ec5
- SHA512 c4ef2a19b114946484a6fadbe9bcfd80111779a5bfce8fa1d38bc09915a6e660978435f7796b34a7c71668d97c0e87186188ee5ba1704aafa592c22754e63651
- TLSH
  T1D131008D873958FC68A693E4AF30B8A3262C95DA5171D988931D993169D0CC9EB44CD8
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral21 behavioral22
- Target
  wordpress/wp-admin/import.php
- Size 5KB
- SHA256 7d74e1c64b53cdfb1c71550bf21574c1deb0324b393dc373c28d67bab458e10c
- MD5 3e5fc815fb8b734ada389ef32a6053a0
- SHA1 58f08909567bd986a672edbc1d9961f29d8abe80
- SHA512 579506b5c89cce70a00dac8e9904882a607bab1c0d445dd86a64f3f5331deb5e71030cf49f799462e6f1fdfb4e5e5520b0eabd8148bcb3e6c39c409c96c69527
- SSDEEP 96:3u/GSOC3r40FfLi/nWnuIHdmT/TGCN3tOrPJBA82pQ+mdof197vhb06b0u6EJg9y:3u+S3r40xGkkDqidOrPzAB041NBl+YN
- TLSH
  T11BB153B39BDC52320032EE9512A041F462FE86B17340995E7CAF43B06FB63799A7395D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  wordpress/wp-admin/includes/class-ftp.php
- Size 26KB
- SHA256 7c783a71ec87acf1ca9abf2549829b2c765c563c95a2b475397ae7636cf270ae
- MD5 1d21a99c7cb4152ae0faa895c202a564
- SHA1 3f5c09257f346218dcbc424e68cb7f7536e9c415
- SHA512 adc07c26994317a887feef77b6096d44a877b623333be9b29e149e1f49cedfa90ff5ff670f2c9d4591d41256975d1609594b7f9451ea438addcf2d75e8bfe556
- SSDEEP 768:P6q1jqhlXzMgIXGsObD5gseUrLzFKloqu:SgKD5gyFKloqu
- TLSH
  T185C21EC3BF9FACD63592D0E94353905FE86CB531686A8C47BDD981343B9832D809E978
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  wordpress/wp-admin/includes/class-pclzip.php
- Size 191KB
- SHA256 7f4e7c8d97fe34aa9229e7b91d5daec7b8f94974f35f6e3fc45a2b4c3f6d3181
- MD5 834d22f8b68a2c5c01866a43eb24efc4
- SHA1 ccd23ef96a588840943fba081bfa6f88531c4abc
- SHA512 680eeacbb3c2846af6f5afad377d5f1560d4b7f778f8b9f3d0fa404b4f42671e31c3e13ec80573c3b3b07a075f895b99eb1d6ff2bdc00e71784c9cce8b55bb8c
- SSDEEP 3072:IdItMRpT6v5sll1TC6RRbxWJdZK3+EUZz55w:IdKv5slrTC6RRbxWXZK3+EUZz56
- TLSH
  T1B9144345BC8601726AE3D2FEA7CBF44ED164C6370A4DD816396D43C82F60564C6EEACB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  wordpress/wp-admin/includes/class-wp-filesystem-ftpsockets.php
- Size 10KB
- SHA256 67e55a696a1baa14719feeffa734232de7eab6be15dd416aff73917aca7bd9af
- MD5 c2a3862ccedcc857e69d3fcec2dbaf0a
- SHA1 edb33a48872489887b489da2abe3812b972a2f29
- SHA512 e8dbcbe881cfad3a8e1e2230ac60c1539c4f77c7e7ee6e17ec5e4b13078a837e7e8986a1e848f40ce5e4d3e5c86387a939d7bc0edfa8c54178371a085847beed
- SSDEEP 96:DZ6nXLUyuUrocpUYIhUrTcw+sGEsGL+YogVk+yImh7IKIpY95xa3PRX5B0doOGVC:DwUZUVUDhUfYSly1aEMfDWr
- TLSH
  T1FF323FD2EBDDACA6521031B95FC7B21A70BE9931D59A4DC9FC8A55A0348433C86FCC36
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  wordpress/wp-admin/includes/class-wp-internal-pointers.php
- Size 4KB
- SHA256 90eaadf27bf104b4beb4233a03e04871f168c8545b24181867ae87bc8f28b36d
- MD5 e3be49879e4e749823539e234113d6ce
- SHA1 11ee61a11ba296cd08692d30db786904f8d5bc60
- SHA512 1192432ddd64d8461f6c5d2c23134bcd778000239981ab50a96d28f32d20cfc951fad9860477a61aa94edb6ef8ac38928ae78de37efa76f81b100577250699be
- SSDEEP 96:6zwNxWZrEHBidODUxKljhZ4tl7SNfSq0EGblp:6smJEHwd+UxKlMoS/P
- TLSH
  T12F914188AA8B6D2EC0132654BC469099957F8D6160C44886FCD99BA43FD727CCF7DF08
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32