78d35779d2e765f79c7ef20a47d23199f68d50bed9c43bc47b42c86cd1c8f31f

Sharing

Copy URL Twitter E-mail

General

Target
wordpress-5.8-en_AU.zip
Size 16.3MB
Sample260727-ph5hqasthv
SHA256 78d35779d2e765f79c7ef20a47d23199f68d50bed9c43bc47b42c86cd1c8f31f
MD5 2fe40437b7b53056faed9eac87365303
SHA1 dc4ad41064d03a57a81f15073fe2089962754352
SHA512 5445165fb6c19fa37f9052c2672e69d511b9d12272720d32edaaa84a2429f303ec5d900731d8d20f2ba84e43b40b84462ccb4fed5ae7bb1fbaac823453c8cc91
SSDEEP 393216:kD3GR0sStcQ31p6TmbFG2lqlwA7ggI9PZesHjqJto:kD3Av/ToFpUlwA/I98sujo
TLSH
T11A071274EE2E0F00D6DE4E70899DD211E0EDC137E54EA99BAB39264497581DC3E3B70A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Language

Source

URLs

exe.dropper
http://api.wordpress.org/plugins/info/1.2/

Targets

- Target
  wordpress/readme.html
- Size 7KB
- SHA256 17b8e0ae15ec0c3ba9f9d4647ad8191b705f8baf589db6dd0e869ca0c301c352
- MD5 5c5fb2fc92934133f676ab414579b55b
- SHA1 700c4a5490cb9053e5d6aabb709b0515d93ae49f
- SHA512 f5880db52aaae1530ef7de6a2a990323678efee0dbfe8038a8a436c79cbe4161794e386026e3ca72cbcfcf8392818a9f8e8a2a88110f8c60a6020f8922c2452c
- SSDEEP 96:4UKLApz1z/4kF5kyJ0ifN8uueKQPt441tcrkKuIDdKCZUjD+9+v5tdLwGg1IZz6f:6LA/TVPmu4QCwDaCd0VuCidI
- TLSH
  T1BDE1A56BB540537A131143B16006217A733300BEA39D465A54DBE62DBBA23B4AF7F4DE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  wordpress/wp-admin/admin-header.php
- Size 8KB
- SHA256 8b9c7e02b235869a7ac647b18730f0f0934264cf62c2f3b23694395fe7a9e4ae
- MD5 b2e803d3e679d758e2d56bb62a76ba3e
- SHA1 f360780ddf10b5fa18f8cd4aac3e1a656a020003
- SHA512 cb6b18d17ba29483824948ea1efb9f7138917e8c93d2024b589b8ddf57f65451227a6d7986557b44314e37b40a7dba64240271d382cf9b0e30734d61c84fe3de
- SSDEEP 192:h/H4uT//m4fxUIddqqQxY65ifPyWoAXZPXt/VC46q:94uT//m4ytd5iD/VCXq
- TLSH
  T1F10286451CF2677388A22ED166D1D278762B410BF3962894ACF641F99B4136C8DFBFC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  wordpress/wp-admin/async-upload.php
- Size 4KB
- SHA256 1b26d20befd457f4415b8b2d18ea660953e935c5e27b0f3364e9b6b1d1d37100
- MD5 a80a802317396f75b06f3c9742cdcedb
- SHA1 c24e6f24cf8e206d1e4a298caecb849ec66b9199
- SHA512 51d90183890d15af7b91cda2d87c11f4dde04028cc30d2541c781fb9e988ddcc5bc8246a587f6c2ff380dcf2ca83d6e3bda0747ceaeb500e02f19ddfc6f1b384
- SSDEEP 96:tKikv2f2NpGSrpPaxACeP8M4RoOqh754Vo6vngDnVovMmDhscCJgjE0ZDW9QgM:t7Vf2gx4P8HCjl+f+QE0ZD9
- TLSH
  T150A175F1A2EC6766513371C45609842C649DCC37F490AC99BC2EE4E0D680D6EF4FAEA7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  wordpress/wp-admin/edit-form-advanced.php
- Size 28KB
- SHA256 3e43f46b744e2cd9f47d4b195bfb2e45bb9bb82e993cf10b7ea25772872c03a8
- MD5 fd8ea0c539ee1fbb32000030a3cb3880
- SHA1 35fbfe45387a59365288151ed81f75aea279f04f
- SHA512 25e71d57f7146a4de6676b3d0a5072c4ddef45e42fa7db4529f8bc122b7514824358db411673949dece7a0f39046bbbda07966b9b352710a70116cb355405fd4
- SSDEEP 768:D9VrD7oFwo5ufsX3EfqKb1Scvu5a8gIL+t2Oa6QEmbWZnSjmB:xVrD7Kwogf83Efq61ScR8gIL+t2Oa6Q4
- TLSH
  T136D21956F1F4226159131682F8C4927CEEBD8455338158EAECBE54ECF7832724639FAC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  wordpress/wp-admin/edit-form-blocks.php
- Size 10KB
- SHA256 2b02b63eee0063a9e1cac0ec51fb0d544a808efe819461fdb92e371946f55bc2
- MD5 d9ddf8465d3fc1cc7ba4cf4571f0c274
- SHA1 dd2a752cd0297ce40d0e404be46bf41a71c5e8f4
- SHA512 1de3607315536f1498fa3a6b079c81351c69be19082edf4b7eb18e9b4492c0d081b0683e97a6828ca5dc3a4fd13279dab66269c884e46c29cba4b62fa1f96eeb
- SSDEEP 192:A0DKtHXx+2UZH3f3DOerZ3ceGdLlx23nU2A+:3KtHqxPDOI2vKnO+
- TLSH
  T1F822091394BCA3B804232599DC1CC4B9AC6509467342A0E2F9FEED886B472D58B31FF5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  wordpress/wp-admin/edit-form-comment.php
- Size 7KB
- SHA256 2ff32affe32cd65330e3fd90d202bbac8011e07c6aba333673e71ce0560295aa
- MD5 3c783cf436d6423d0b974c5ea9b65720
- SHA1 c38be575cb607556830b5e72a2589147a2d4fea8
- SHA512 6311466d9da90ce4e3e5a64e28dfb11736634e60564085eaf9d20040e5cb130766b573fb16f917c9eb72aa473e6e149a67ae6ed526bd0de4119cbfab8398e221
- SSDEEP 192:yosxqDLsvTQ/fuBkvalbNBNRjmyV9p/4it+P0MLexXLtkYyPyVKL:yosxqDLqTQ/fIkylHjHtO08rPyc
- TLSH
  T1ABF17583A0D44770C0E33CD16D9866B939C48709E2492C9CAABD84D86F50FF56D2ABDC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  wordpress/wp-admin/edit-tag-form.php
- Size 10KB
- SHA256 a3a20fb8440c26ebfca59f52f2d50e1d6d59e7e9190d3f0fbf645b989140f5a1
- MD5 3c2c7ed603cba59e2c2eae1925cde847
- SHA1 26e7fa8a0d9758d14e35585e20964c8842c84bc5
- SHA512 b0f54a01eddcdbcb64aac17acb5e8b084faf1a16fa6b63c7ad9978cb37a43073db8efe37d5c1b0bd142aef822ac595397ceb23d7ef8a7192167515d9368df555
- SSDEEP 96:T4qPBwi8wvRzkgVVaE2azn47Nve21JiysaImxdT+g79Hn3VIx7t558fFuFbC9q+3:sqZnkCzn47kyxz9H+RtlG91YI
- TLSH
  T1712295F799ECA63045530ED03DD673863FFDED2976010CA9FA4ED89897249A1492BF80
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  wordpress/wp-admin/edit-tags.php
- Size 21KB
- SHA256 574193bbc0d49b4d6c2c1f7a02182a357ed3644c3f1347aa5bb48da3e5294b21
- MD5 c16041ba55cdd2bcc3dd9a846eed0292
- SHA1 311edf5ca6ba2b479af646df0efdda8757b5127b
- SHA512 b0ec3610c78ae95dbe15eb9bf8cbd84e243e2e4af11e4db3ad2d84b14fb948d9dc07845b2b9539b6842ec6ef8ea98405f1d8f48c112326eec57ca61127b87ea3
- SSDEEP 384:KQifrwOFN39fXg+qMcrxgrJI1SMIebaLrANi8:KQAbplqMcrxgrUmLrAQ8
- TLSH
  T1D8A2D6EAEA9C527113131E80BDC8F35B7E7CC92462411CFA799CD458FB506A64B3AF84
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  wordpress/wp-admin/export.php
- Size 10KB
- SHA256 37d8068176b5bf4f19819636b8314000db6766498b9412dcbe7cf7b761d0074c
- MD5 91b788ce5a07c722950d0deeb4809d04
- SHA1 7ce18d5fa6d6646f577756ef3bf50a26255d97fc
- SHA512 64d8b5fe716845cb6dda2c076b30f965db05494a84d33781bf7d6b9770e08ec87f5d9c9d32acba262d7a4d10ed3f527d8bc3516a3aefb6c1de2448785600d04c
- SSDEEP 192:f2hQfgBMvCqjyoZgHLnvKhwzkeBs31B8ToFriOGHXspIEm/F0R:ehQfgCv4o8KhJMoBZg2md0R
- TLSH
  T1A73285A3F5E88B31849B28D516A496F12AEC890591012CC6F41D46ECA7D1D6DCC3FEEA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  wordpress/wp-admin/images/about-header-about.svg
- Size 44KB
- SHA256 5e5b39ce09810faac10ee03d4589a7bddbd3fd9173ee295016bc407f6449b85a
- MD5 b177604c4b02737bea87b66d250fc6fc
- SHA1 478c2e818e7bfe1ceaf314a5be12bd419f6c56ae
- SHA512 58afa406b380f23039ffeca3546fc4250e5a5981409d9110a7d2ef4cf394eea085578704c791cd16ad2439876a658275bc6fb1ae15d16b78b182412c20fae077
- SSDEEP 768:JhVysJtUTuxVX3faSxlRHrFptbaLiY4MpKSNVVgq+My10RY:J/1JaCFiSxlRLFbaLic/7Vgq+uu
- TLSH
  T1F41353D76730E2E47AC7572FFF116C5C2966A0FEDEB992C5816BCA9160C7BC0DA00950
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral19 behavioral20
- Target
  wordpress/wp-admin/images/about-header-credits.svg
- Size 51KB
- SHA256 396af14e0800672f95d3788f8acacdb30e974c29399bcd4f06ee6d8c09c6c50e
- MD5 5a4656aa8f326024b0dacc5ca1ac5f7b
- SHA1 02ab5541908b37a1381b9e2f89ad3ef6a45a3904
- SHA512 25756620d02e6eaaa4f2ab2a71ccdf9de988a9400826d41a03f25b6ca2882fc31923da5301206b66bcab9d740129e4047a41581b404e77b95dde998ee218de4d
- SSDEEP 768:QnPmbTIdLPTbqRiKb5WCgDIIMBFQrebwdFC6v3rxjrzwn7nvuKw:Sa9Nres9w/CSxYtw
- TLSH
  T1D93341E63BB0ABD099CB4089FF225895A61AF4BE8EB753D042BFEE516DD35C4E500D10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral21 behavioral22
- Target
  wordpress/wp-admin/images/about-header-freedoms.svg
- Size 7KB
- SHA256 65561b35f87a9b57c1420b24289642616c77f06610297e926cf16f830210b82f
- MD5 c4c2744d397e9fdfb266849919cd2b14
- SHA1 6fb2cbf204c2b8ca89cac2a437c08811ebed2933
- SHA512 1aff96c0eafea806b5c5173636a4633d5fd4054273041cc28be65b85ffa72d8a45ea0730e0357cdd48b67a2c4924e6bf0aee8a4578a25e68354cab59809c891f
- SSDEEP 192:fm+AytqWgQ8wKvtzUbJjspH4+KnsifqKAhKGLLNmofiWLvC:Opy5gjwAZepspQqHLBmof4
- TLSH
  T122F162E5AFB0D1F0ABC38F5EEF329D587A4AA5BC4F5646C88139EA8954C3DD4D400C60
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral23 behavioral24
- Target
  wordpress/wp-admin/images/about-header-privacy.svg
- Size 4KB
- SHA256 ae8f58f67c4465b2f30c1a1fedd2de37a84e99f8c61d5745c3d9c08cbcccc72e
- MD5 92c02ee735e9434480cb313e0c57175c
- SHA1 3c79823d3ea432213a9d8e4f58238e8977867016
- SHA512 a5e905951ea5069cae497fac8858a8cbcba445df2dbc9a2e361e29cb0373d899b7a446bfd3fad98c6336b59a074d19e831b082a0da2313b8a3fa42fb8448086e
- SSDEEP 96:3RyEwX2jxt+QKlAIqDgm59jDKdh8Ha3Qi+o3Mwim:IErmQ8BCjeAauo33im
- TLSH
  T1A3A186E4EBB461F8E9C4A35F972064ED799AA0AF3533C928D21A1BA41BC7C095A008C5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral25 behavioral26
- Target
  wordpress/wp-admin/images/freedom-1.svg
- Size 1KB
- SHA256 c2f182da78376c1a4f649937a64a36dae169dfff6f4efe5afdd6ea2c6f512507
- MD5 584feda2dd775e95c882652ffcbe659a
- SHA1 0ce36b88e6fd4ccd16918cd80dd4631e7d654279
- SHA512 7ba37970725702aebb871b02fe3df5c4841b89471a5e80bd05e0cb7950d8261666a00274287257748279a9e5d9a701170185891b694b9d17f7f45e66cbed20ac
- TLSH
  T1B321ABDDBB486D3CF8BC4289D71431F070A461AF894062B0D8250CB872166CC9A3BCC6
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral27 behavioral28
- Target
  wordpress/wp-admin/images/freedom-2.svg
- Size 1KB
- SHA256 020e4a63d953ddcfe8831adc836250ef925c92b2718fd7b7fc7767066da8601f
- MD5 efee3a441677c7f58fc0f638aba8ee8e
- SHA1 66c2b9b526a373674fd0ab6329c0078d6e75e835
- SHA512 273241a1d158f0d01e30161b61d45b0fbad9165cbf6aa5509d1d2e56d5a8367d2958749d3bff0dbee70c1c704725e5465723184c23da7d0b9df8df09c90a24ce
- TLSH
  T15F311E556728593CF9E58269E304B0B8307B10E7A3447338E537183452198EE98BB9E6
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral29 behavioral30
- Target
  wordpress/wp-admin/images/freedom-3.svg
- Size 4KB
- SHA256 a421a8b20a01ce49243dddeb196357ee84186d53cf3abdce473f5c2c1d4c2441
- MD5 6854827a4310a48e917735f536d92060
- SHA1 003e45979fd01ec55f0ae23d96a375420e43c0a6
- SHA512 587889256e93fc786da7fd1ecf858331a8448502973cafc70121f16add236a6871d737ba7f85b0240f0b90f3172d6d6bdfbeb7bb7f185cbd17a3520516035247
- SSDEEP 48:lUg7Dc+wEUicLiVc3GR0L7VBBBLkVZjDBLtVmQKt+L/GV8M75V7bL3VrSMcGSVda:l13i3FBcjDMQKnr7VVV8VayXU1L
- TLSH
  T19E810094FB6DB83EF6B4C685D702B83134BA00B7AB51A320B47906BC87249DD593F0D6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32