3e95777a3acb3b05d5cdbd31b16fc1e9b71122ebe3c1f18c6f53dee3eab0d111

Sharing

Copy URL Twitter E-mail

General

Target
wordpress-6.9.zip
Size 27.3MB
Sample260727-pm9cgaba52
SHA256 3e95777a3acb3b05d5cdbd31b16fc1e9b71122ebe3c1f18c6f53dee3eab0d111
MD5 0fef6bff212ae225abf4841abec9cdfd
SHA1 964ddc9d491bb662c7dfb21b40aef561210d390c
SHA512 e0aaf428c76e3bb90e668c034a95b3564fd93a4997460951d74d743661816fdbadc937fc0fd92601f89372d4a8f690121a2853f008f87c094ff49fe97228e3e8
SSDEEP 786432:DcFRkKzzJYE97LKeQQGJnbvY1xVcWCOocOzYWwjAU+Rhb:D2R/zOE97LprGZc1fcWTelwcU+Rhb
TLSH
T1E4572372EA2F0F40C6D657B48DD5A110F52CA423F64F629BD77A69C4AB784DC2F13A02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Language

Source

URLs

exe.dropper
http://api.wordpress.org/plugins/info/1.2/

Targets

- Target
  wordpress/readme.html
- Size 7KB
- SHA256 d6a2953452c4b0d9c6853367cde550b275d4af549abf4cd07db57ec9d22d683c
- MD5 161dba8de49f41eee63421cce887ca0e
- SHA1 b1fa0fbc7ac9176f2af1d8e1eade2215e0589884
- SHA512 2de5c438949e6b349d0450ccf95a904521482593b776b3b7a39478a04500f8c752103a75db353d884723d6556b639858c5482047f81e4bd57c277ae3e3ad76d3
- SSDEEP 96:CQUK8pz1E/4kF5kyJ0ifN8uueKQMdc8FdFPKuID9kKCZxjD+9+25tdLwGg1IZz67:n8/SVPmuB3C/Da7d0JuCidI
- TLSH
  T157E1A56BB540537A135143B1600621BA733300BEB79D464654DBE62EBBA23B4AF7F0DE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  wordpress/wp-admin/admin-header.php
- Size 9KB
- SHA256 014f8a8852336101ea3b33debd43ac7e2521d1ca55106da7652c81cf2d8f3e2b
- MD5 4a1d8133e129d6c4c2e242c7e7474345
- SHA1 59306fe44b19602680fcd439ca1ac7a20060cda6
- SHA512 d1e2212d33b674f6ea92c41e304fdef7a8197bcf2d49cbcf9ea8da21b992f567f1909dc498b6608780c2eb8452b5dcda8a59c31b7ac1c7dffe6ad08bfe11aeb4
- SSDEEP 192:O/HW3xQB/m4TxU4ddqqQsY65ifPAWoAXZPXtSoVC46q:UW3xQB/mKyYd5iBSoVCXq
- TLSH
  T1B71265441CF2672388A22EC166D5D27C722B410BB3952995BCF941F89B4136C8EFAFC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  wordpress/wp-admin/async-upload.php
- Size 5KB
- SHA256 cbf153ab3aec6d4b01cb58828aceec81d7d429df3f6e3367a78bd5c7f1cb9b78
- MD5 64073faaa1362e61f1bfe9c4a41ddf63
- SHA1 31a257693296708107231ac340cb3ad2cd8b5e40
- SHA512 1e4976ee3cfb5be1116a14b3e7fd6fecf6cdb266e50c3a012c7c0ddc54e0251a7bbe09ad326ae6d8d9930f1dd1b50b3e342311fe7b86532a8f6f0e5fe0dc4468
- SSDEEP 96:tKikm92NpGSrpPaxHQC/RU4gr4M+sgaOE4Vo6vngDnVovMmDhscCk1ReljZD2VVL:t7/92gxL6shHaOg+fVv6jZD2fzT0I
- TLSH
  T1C2C196F5A69C676A513370C4564C842C749D8837F0806C89BC6EE0E0E740D6EE4FBEAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  wordpress/wp-admin/edit-form-advanced.php
- Size 28KB
- SHA256 ef75741532d1b29a664fd7e279bda90061752fcfe41d9a72956faffa4fb8c88a
- MD5 9da48e8a83f6fc5eaea7dc152344501e
- SHA1 210f97d25157a0e7c556ace2515bfd0e36eb844b
- SHA512 c65078dd8a9537060f7987e2b47eee7a5ef2ecba6f1f5c28193eaada0212cd86e42f3371d7ad5f39fa72258762742e2d74495b95bd0940fc72053dd0a8c09f59
- SSDEEP 768:q9VrD7iE75VXfsX3EiqKb1SceoC0Dm8gIL+t2Oa6QEmNWZSOmB:0VrD7X75Zf83Eiq61ScpC0Dm8gIL+t21
- TLSH
  T174D2F956F1F8126159131682F8C8927CEEBD8055738168EAFCBE54ECB7C32724539FA8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  wordpress/wp-admin/edit-form-blocks.php
- Size 14KB
- SHA256 5c45084ea9d9e28bc6d15ce9c0dc5686afbd982354509fd6ecb6712bca99695f
- MD5 a4ed89a1ea0756d098d3cbc1f5cae47e
- SHA1 39ccc2d4d26da0bc57eb5191ba211df617ed75b9
- SHA512 8bc4118c80db20e563af3364e9cfaff76fde5acd90f05fee43e4c40db2a0d8fa02ec6d30d15c0324c86d07b78f132d3af83e0f6075e6eae982938b930111465e
- SSDEEP 192:70DKx7ArZr4Z/PoVuaKc3XVfLIqEqgtgdxy+2d2QZH3f3DOBaGbJF+0x/iZ3MN2y:4K5ArZr4Z/Q8cHFOxPDOFrwMeoqTk
- TLSH
  T1D8622917A4BC637A1072369AEC1C80F9ED2504867342A4E1F8FDCD88674B2D98731FE6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  wordpress/wp-admin/edit-form-comment.php
- Size 8KB
- SHA256 2b2688f5627a87a020cd622a4577a96d34d9f492700412e7915f7fb457b4b9e6
- MD5 07297b9520c636513839b377e0a4d22f
- SHA1 407556eda5e1accbe00ac4db079b56227ccc88ad
- SHA512 44eb1b314633525be6d80b3db6f4d7c1603c5bb9fc40edb56c5d192f6a104f2b2759497e8d3865e5894442a040c139495dbda6e6de1c9bad80a91631453f22a5
- SSDEEP 192:TosxqDLyvTQ/EBU/albNBNRj8yV9p/4iCtoW0MLexXLtkYyPyVKL:TosxqDLsTQ/yUilHjBCSW08rPyc
- TLSH
  T1B602769390E44721C0A33CD12D9867B939C88709E2491C8CAABCC5D86F50FA66D36B9D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  wordpress/wp-admin/edit-tag-form.php
- Size 10KB
- SHA256 98d778683bc93d97c245550d6181f0cd28abd9db959366e6ad52e6b4696b7da6
- MD5 d3d41392ebb0872f012e0e57230ac120
- SHA1 7831cf4ac0811f0feee155d90dc84d084d0e3376
- SHA512 371bb35f2e101c9080c9ab4f236d93cd544cd14cbf525610cf0bfaf1d38cc79703b0b40184c1d8df6d750c83618cc91bee9e46590be1a40e63e4869f3028f4c8
- SSDEEP 96:T4qPPi8wvR0Hi+hmVbmaE2azn47Nve21Jiysa/xdT+g7KA5HK3EIx7a558ZF8C9j:sqXCF4zn47kyBzJqVRaw91YI
- TLSH
  T1612283F759ECA63055530EC03CD2B7493FBDDE2976010CA9FA4ED8989725AE2493AE40
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  wordpress/wp-admin/edit-tags.php
- Size 22KB
- SHA256 fcd401000a326b05e0d398d1a0a093c3daa450cb6f1f3fe1f430753beb5e6e2a
- MD5 fded6fe2e5c50339a33ae9c678124005
- SHA1 e33d880c2b3c01aa5d0ebe73800852d965ce9688
- SHA512 ac8e71b2c32c2869ec5e592519738ccc3931d7fe72a460aba1efdb0916349cfdc770291220c849147beaf6192d35386338f66203687a9fab39458e1c50025eca
- SSDEEP 384:KFifr45F03CfXgsqlqf0rxgrZU46rPhkaLrANi8:KF7SU1qlW0rxgr2VLrAQ8
- TLSH
  T1B7A2E7EAAA9C517013171E80BDD8F35A7E7CC92472411CFA799CC458FB506A64B3AF88
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  wordpress/wp-admin/export.php
- Size 11KB
- SHA256 ee901231d339d23779867ad2bc8af2eca109d85d837f2e9638ecf40b3e006074
- MD5 209aae46126b9fa9c9e08dc43d2d79b5
- SHA1 be21bd8b2921b9fddd455c2c4944060b856a734b
- SHA512 2332c6be304fdb12b11077e00d1f848e758bd734be6317d75cd2cced1d126b448b4008057aab12a36ada969994b4742c4dbce079185a19e6e75aaded47dac848
- SSDEEP 192:f2I9QVgBMvCqjyNNgBtshhIzkeBs3QB8ToFKDOG1XspINm/P0R:eqQVgCv4NXhhxM3BZyJm30R
- TLSH
  T15B3264A3F5EC4B31849B28D416A497F13BEC890591016CC6F42D46ECA7D1D698C3EEEA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  wordpress/wp-admin/images/about-release-badge.svg
- Size 1KB
- SHA256 722d859101159b8db38bc0f2579da94c38c22e63ef4817f2b710d29988d9381a
- MD5 a452c34398e8c17e636dd8baa2a0d924
- SHA1 b4f77eb3b67f8be463e96e22337799d0cf8da4ba
- SHA512 edfe61e90dc5cc9f3b1699efbe93de73eeb06be18e42a0f7c8139c9134f4c695852588de20f547f005610060409a2f9b919ed77ffe4f5edb304aeaf7f9e033ef
- TLSH
  T1114110D2B370B07DE5C95F81EB2A94A91677A0BC6E5383D0607CDE606E89E5C894A884
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral19 behavioral20
- Target
  wordpress/wp-admin/images/about-release-logo.svg
- Size 3KB
- SHA256 95377c48d330044c851791365ae232a1a5488bb5cdc373329f43ceda8d04f523
- MD5 6f64ef5576cfbc2294644fac9ba73e9f
- SHA1 ad3c081ca7f72160740d0f5e5ec85a5c35f07fec
- SHA512 90ac53c1ae8bb0311b4b6c4bd787ce9b8f0faedcee45773b605238c3acb2b69ca4be3ec29ccbb427fbed716402fa0a2c44a165334e6e5765233e76aa597746df
- TLSH
  T1208179B6F795FC62F298D3C4DF014030226E24B7A683C7A0C1E1EE3A55294DB481EBD5
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral21 behavioral22
- Target
  wordpress/wp-admin/images/contribute-code.svg
- Size 9KB
- SHA256 5383af9878f5f7647fd4f46aecef497eaed7c16803ffa3071b710a1bfd89dd27
- MD5 b725278c2b638cb79b9dff90f526224c
- SHA1 adc72b808e6eeedad83560ae5ae11e40fb2c664f
- SHA512 35bbfdb5db23262916d7221c05c137f2e0821c6da89c16c7f1d48cdc7eb3b65872ca6335af53d480ef5e30669e0e47f73ad7eb307063e0486960705ca025280e
- SSDEEP 96:3QwY8Rs8V4Qt/n+8uh1QREQw5RGC19Rmt:3uV175Rz1it
- TLSH
  T1AA123FC8672D5528737A2E1E67072ACE00FF6C9CB25C3748EC1F69B5538B59AD42388D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral23 behavioral24
- Target
  wordpress/wp-admin/images/contribute-main.svg
- Size 17KB
- SHA256 d17763d0cf6ac7899dcf6c50075b682e983d0b0ff278e752b13061af2551dcbb
- MD5 abadc35556c6a613bc1632ecb0cbf000
- SHA1 54df7083d150caf86f0e09f3f14b8ca4e2533d00
- SHA512 0d78739db1c6729acf95153b6858c2941c04e75a416bae62722e0e64adba15aad222e5a5ce59a4047bee6dcb0d9707d7854c59674003452a419a1f8c50650fd4
- SSDEEP 96:VfWZZwfbiJYAXf8zffuTptfVJkeU3f8WzfWZZwfbiJYAXf8zffuTptfVJkeU3f8l:5RlkXSoL3JL
- TLSH
  T16D8234C8672D512877762E1EA7072ACE01FF6C9CB54C3748EC1F69B1538B999D82348E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware discovery spyware
- Loads dropped DLL
behavioral25 behavioral26
- Target
  wordpress/wp-admin/images/contribute-no-code.svg
- Size 8KB
- SHA256 17cf12d1a2f8693922386a4696d6e4b9786a4afff0dc65f86b014e0a33826212
- MD5 583f8b10a1cb4c6c8a52cf2731ced8ff
- SHA1 063ade614573d3044dd1c650695491d3c85482e0
- SHA512 857d604c8a228f6c9286b3b61d1ed2e9349e06c9af2cb5e86672c865f6efaa6681816dece85f8397d691a92af3b0a1bc79dc6fc2856f0eb5372ae7aa21deb1e6
- SSDEEP 96:0//ahMpMZa9MNI/SdXeYeAlEoAjBh9PwE1DdkgZA:0HahMpMZa9MuuXplEzjhPwEzRZA
- TLSH
  T11A02068CEB987F32AA541B809F51F0C4117B24EDEA647128546C54B8E5EFFAD8D1F0B2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral27 behavioral28
- Target
  wordpress/wp-admin/images/dashboard-background.svg
- Size 3KB
- SHA256 eb55d8055063f46e176b6780b55e8d98b999b9ad3b85fbca55c64b0221480546
- MD5 5b480d6b67f680796a4ba34f4d87c5fc
- SHA1 49ccd7b576475b4adbee1678fa19c1e2a828a75a
- SHA512 9ee1b84a753bd8e5bce782b9f2c370f21f07b81141623a2781b119a1c378de54af37abeaa213f14d1c7c352ff9a2b7a8e4138f4daf9dd447c975495735095d2d
- TLSH
  T137614A6DE6BCAA37D64AC28CD985E4643A1903C766C48241B16E9F9F5F28C830D1F7F0
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral29 behavioral30
- Target
  wordpress/wp-admin/images/freedom-1.svg
- Size 1KB
- SHA256 c641e751bcfb5d44aa4609d9f94c3aa9297f1baf564196b292aff3ee4e90ff72
- MD5 0b28aa39660dddc94f4a1aa117a75db2
- SHA1 ca822ca083e29e2ff15e9be4b50b80ab31a8e2a6
- SHA512 6d6918b9d5a73db24593380dd228093ea5444d631598e73a4418f48db0c3c891b8b12ce6bc693d6ab9cd34eb8e27ad95c496adf34cfa21a4b434be47812abef2
- TLSH
  T12A319AA592BCFD2AD6A1C1EC532BF1E0306E20285356A75859305F3F696A4B33409BB6
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32