d601cfc390599199826c4e54a0dbd6374b90c9bdd5bfcb456cefc3dbbbfb1efa

Sharing

Copy URL Twitter E-mail

General

Target
tranco.zip
Size 16.1MB
Sample260727-w95fcsyfpe
SHA256 d601cfc390599199826c4e54a0dbd6374b90c9bdd5bfcb456cefc3dbbbfb1efa
MD5 388795014aa6d105bdd35aee44c49440
SHA1 46c034057d2eb386e3a4bbe60bfee2c9fdeae39a
SHA512 121ce89abfae8fe2fae2ce32b1b8ba83be7f1cf5f4247932510cd1180dea0b05b12d83fee5b91c80f8c49d913379d75fedc6f57e76f5e73fc83f9eedf90330d0
SSDEEP 393216:d5SxtsD1JSlcsFrtN9QcfMryhlJc7OG4MOfGRTNiRmAlVFrURwf6c:6HOelcctNOzr2vc7OnMjRY5/FX
TLSH
T1520723758F3A0260C6FDC53AE8C94690D0CD9156E645F6BDBFA801D8EF6A3483AB3345
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Language

Source

URLs

exe.dropper
https://api.wordpress.org/themes/info/1.0/

Extracted

Language

Source

URLs

exe.dropper
https://public-api.wordpress.com/rest/v1.1/

Targets

- Target
  tranco/400.shtml
- Size 130B
- SHA256 913ab55c78156e9b4006ed1902c07cce83b69c10bee5dc59696fd73125c47d84
- MD5 67e180fd9e4a51ff64769439626e165a
- SHA1 f1d1e63ffbd7e163808cb6e983254cba4b74cce7
- SHA512 e413082e474ff14f138c301d618e205b9152132139169296435294d101ccd03e3a84ef049c124560e2fa3ec38539bed22e369631facfd87ad22fb633adedf568
- TLSH
  T1B1C09BF75090311DCE0291D44FC1F74575F4A145F5C58DB955D504EE100441AC4055DD
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  tranco/401.shtml
- Size 162B
- SHA256 960e116d7610326140516a0f53ea12227513b1df2af66be16fb4399681dedb52
- MD5 44560a083fefbe256344baf162cf468b
- SHA1 772a0aae8b6ced394cc48d0a3d5cbb6f51665f71
- SHA512 4119d9546bacdbce999b3afdffd6cb4c4e46c7b035396fa18f3fc314d0c40215c3630028eb89f6dad981f5d32558ebbb7a828572dc7301f091a30423c2448b77
- TLSH
  T18AC08CAB91CC380DBE03A3EDCFC2B142E4F8920889CD4DB8A2E580B32192860D7015A8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  tranco/403.shtml
- Size 201B
- SHA256 9caf5cf0c743763989b929298b1c69f3f486086f73633bfedb3b4c307f7ba33c
- MD5 632d05c9c9a8b6bf3bc808e8d9f8885e
- SHA1 fac210d27c7e49c19db63cec1d469e529f45d967
- SHA512 56f2eb2ac8290f183e5a5929fa1db5a96ac56dbc8cbc2e95da6d9c7c6314014813f7d3e6f12c35978dc946bc0ad4893ae3177c49a0d987199b207c75b50c9635
- TLSH
  T177D0224FF18E303ECE0091802FBD3A9178B8AE1971DA07BCA886D0371081445C608659
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  tranco/readme.html
- Size 7KB
- SHA256 cf26c14a31f49ff2e51bf26ab2cf1ba14d6d8530fde875ded0414b848ff97c79
- MD5 c17664e85bfe1b94a71597f49af06f77
- SHA1 005e238b1aaea206549ff926e4b4d594e282f24f
- SHA512 cbc54c1f269ad773cf932ef19b1c8c086dd0f3beabf0c093bd9bf122b0cb755b1ca14391d30a9bc1dc07c14e2d138ba7e6a7328b049fdca6367ca542216f6f69
- SSDEEP 96:kUKLApz1z/4kd5kyJpbifN8uueKQPmcp1iZvdKCZUjD+9dv5tdYGgzNZz4H+lUbQ:uLA/TtPqmuxCwDaldYFidI
- TLSH
  T1A5E1B55BB540537A072153B1A006227A733300BEA39C465654EBD62DBBA23B0BF7F4DE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  tranco/wp-admin/admin-header.php
- Size 6KB
- SHA256 79d428ed12e732dab6299e4515615aa102cca3f0094bca443c5aa712fd109a44
- MD5 e59419f76c64a6ba6018ffe48a25382f
- SHA1 e1db2b679a74446e505dbad62d134f6a839192f6
- SHA512 5e578517a69a695938eda2f356b0e8d3816d931195830e39ce41bc2ef556652be7eeb0cc7891538e1162c42dce6143cb3f14867d830d4eba87a7c34d9f838c1d
- SSDEEP 192:HUaZXPINIK/q6v1d8qqDoS0i5rvXZPX32PYYJx:tZXPKv/qOFzS0i32PYY7
- TLSH
  T181E173411CF2676388A30AD265E6D27835178A1BF38228909CF641F99E913588DF7EC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  tranco/wp-admin/async-upload.php
- Size 4KB
- SHA256 64028e411064cd865a3ca77193e62f44f4bfdd1dc8bd8edc9b13f6da573a20ea
- MD5 7e11643468caa5dac268efc64e0b01b0
- SHA1 3260b7fd59406fcb21d942ae377e38a4e3ed325f
- SHA512 d402e305b0612108389c3c94b5d1838dd6826e677417813bc71453581581f92066dd04662a39c0377f7a37563d44f32bedf3379c519c7f6a6088678718d357bb
- SSDEEP 96:tKzk2SabJRMDl+0F+kLheLKNabo6BDnbov/DnlCeaz60WM:tEsKy1FVeyJRTaz9
- TLSH
  T1F19187F566F8A77A5133B0C84A4C802DA559C913B1809D5C5C6CF0E0DBC496FE0FAEAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  tranco/wp-admin/custom-header.php
- Size 43KB
- SHA256 f8a6c06246136390ae467c5537adf6ef463d0983f8a1abd8c966da0a47f94658
- MD5 99eefa9b1939cb204c388833bae2b409
- SHA1 7783d5417243dd82478763038375d5f58fc628ad
- SHA512 ce71ff4daa565c95999162451cc0093d760b66b47475a591ff23b53b7f0e473d41e7d84f46ca791af51be95717c84ce4f2c5f3d151b3a5168c3444dd45ba31ad
- SSDEEP 768:qp1fwQYR2WiBDPLGaoB0jlmhNtje/RmwO/TmxxLgnFiQvNux1nAt:qpaQYRniBDPLKBolmhNtjeJmwO/Tg+us
- TLSH
  T1AF13E769F7BDF337403328A4E60EAC0E55AEC6145242ABDABD8C90ED59C0D2CD974F85
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  tranco/wp-admin/edit-form-advanced.php
- Size 31KB
- SHA256 c0d69fcf04389f2d9da883dae89d94f2dd609373a02cf702fffd7bf7dda6c6c1
- MD5 050baceae44fa0560c2911d97236c5eb
- SHA1 2577f75a268d1c274bb8fa75642f1dca33deb633
- SHA512 7d382ea900349ece6f93c3edf0ceed395e5ae0572d7b3f1a4c8529ca83a229cff37e18133b6ba7f6cdb83a7a6de4d4a6458bf71654981c32e70407376c52190a
- SSDEEP 768:Ne2gcA1crX+hVbTiK0CK53cPcoC2BuwaxnLL+t9dYAQkf5YUsI6uaHfI:w2gcA1crX+LHiKq3QcoC20xnLL+t9dYG
- TLSH
  T1CCE20A16A0F8226254235680F984D27CDE7D8451339164E9EDFE94E8BBD33B38935FAC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  tranco/wp-admin/edit-form-comment.php
- Size 7KB
- SHA256 182a8417dcf82f4dcea4cc6290bbc55d2c0e7ad063f7afb951d84c9e411644d4
- MD5 b2626eaa0002908437813a72dfcac748
- SHA1 514e8e35f3fc95d0c037773f6089c44600ef23aa
- SHA512 a58faaf3d23af1e3557321bc741dcb4f17839bbc64e0180e2458ff561767ce637b67592030abea9397d1195f2b49bfa43188d9c7d5820fdeb31727f5d998a7e2
- SSDEEP 192:qxsxqDLPOTgsOkvub2mNJmatlHCY+70MLhfLdECYJXj4ByMVA:qxsxqDL2Tgrkm22180DCYxj4B0
- TLSH
  T16DE15493B0D4873190A33CE17EA4667939C8CB04E2451C9CAAFC94D85F50FA5AD36BDD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  tranco/wp-admin/edit-tag-form.php
- Size 8KB
- SHA256 410c7ca560a0a7cedf2859644f5c63406878485496d53ddb9745dbb97c34e1c9
- MD5 92d876578a7a8bcf54969bdef5ba3f2f
- SHA1 e65fca1db4d2cc59bb7fad597aab7164e054c776
- SHA512 efdc7a0e4de6245cf30ef6049c2b6f707ab49b143075274cfb5053fe9ff82c42da11af3c3659057f7b0eb537845a089d0a44dea0950cf9e10ba834a6e4234fdd
- SSDEEP 96:aFHUJ1Vif8WRF6BR1aEC1j4QxxajrYdx+mm5Hn3DIxB558fFYPF1zMNLHPN28Lp1:aWJvm6Bo1j4QMz5HMzH5kjnGA
- TLSH
  T18002A5E7A4ACF53005530EC07CE3B7467FED8E2576011CA9BA8FD8A493218A1493BEC4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  tranco/wp-admin/edit-tags.php
- Size 20KB
- SHA256 0f27511ca62ef1d0b95c6185807936491e0f92707013cfe63f828be739b3b616
- MD5 b724dac10c9ae75d9c0b0200f50ebb4f
- SHA1 ebc78bf354f0d2c822918e773993ee8e8b4e5ba0
- SHA512 f72961f0042c4f7860fa39c0a4db73f92df1b7a0c64f9d7cb9a44fdd831b75cc678d2ac120ea31ccb36add2fdcef88f15e986e40a282fc9cfd32f685ba4db4f4
- SSDEEP 384:oOw7wLuWkZiwWmXRfgga0ewLtkLtxH6LIHYnYtUVw/fhcN:oOw7wLuWkZiwbmt0ewLtkLtxKIHYYtxu
- TLSH
  T17392E9F7A698517002575EC1BEC4F21A7E2CCD3132421CFA7A9CD0A4F7516A60B3AF88
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  tranco/wp-admin/export.php
- Size 10KB
- SHA256 25cdd4134a42cac5ed485f8d67428af81ff370524fefb99bd433314fc45a3148
- MD5 e1a3d7025ea7a640122a6afb07631b9a
- SHA1 83e9b9439bc75aa5a4fdc19883fba84af191a516
- SHA512 00934a7b9fb4c1ff002d8ed4e0b90442a5c7f9e81d00d49c3ecafacb0ea9a8a9ce2ac095d33a599fda81192807317d8f01a10b7a2a3c7765dbcd6bd7ca17ba52
- SSDEEP 192:fXbTqODPvGR8eiug0jEnF+rwzwrsiB8ToFAEOVXspIEsn/yq6:vbT3bvEigs+rLrHBZxZg6q6
- TLSH
  T1672298A3B4A84B35849B28D81694D7F13BEC8D0591052C86D81D47ECA7D1D6DCC2FEFA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  tranco/wp-admin/images/wordpress-logo-white.svg
- Size 1KB
- SHA256 e0658d46dae8331fc0bf524fe1bb1708e0c3b5de6d8ec2770fff3b89e3fa9492
- MD5 e1af633d59dcb5988cacff73b6dee9ff
- SHA1 fa9cf458a1d9c755ad61ef741efb9189c72dbcd4
- SHA512 38246e5731114aa38d965481ac4e59f3549735aef06610a571dc2ac2f73301eb4aa6b6b9eb27bd1c0711841dfb4e381093cd14101a60b21fc0ac0bc1569c8e58
- TLSH
  T1D031008D872954FC68A692E4AF30B8A3262C95DA5171D988931D99317AD0CC9EA44CD8
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral25 behavioral26
- Target
  tranco/wp-admin/images/wordpress-logo.svg
- Size 1KB
- SHA256 a0bbefd626f1e76f9245ec6c6101b679ba27412b71b32fc43eccda9db40f394b
- MD5 f34ef6259364f7ef0ccf67cd1dddc970
- SHA1 18b563726b3d24a73552791fff91f61077ae1ec5
- SHA512 c4ef2a19b114946484a6fadbe9bcfd80111779a5bfce8fa1d38bc09915a6e660978435f7796b34a7c71668d97c0e87186188ee5ba1704aafa592c22754e63651
- TLSH
  T1D131008D873958FC68A693E4AF30B8A3262C95DA5171D988931D993169D0CC9EB44CD8
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral27 behavioral28
- Target
  tranco/wp-admin/import.php
- Size 5KB
- SHA256 9496e0a2a6b30f02adefe54d790884818d4aaa758a6c4fbb54dcf1833aaa2a2b
- MD5 3d2669392c78b01c6277355e3b8f847b
- SHA1 e09d9cfb71c8cdf1968f8b0ecfcbe85eb2b72181
- SHA512 5516aa8624544800e6292480edb5041f1961ef2e8571a7fcddd7078e926a8cdd498e1430b37b86be97731db34eee324231efd07255c7cd1a60633637b96b367f
- SSDEEP 96:3u/GSOC3r40FfLi/nWnuIHdmT/TQ+ZN3tOrPJBA82pQ+mdof197eb06b0u6EJg9y:3u+S3r40xGkkDk+bdOrPzAB041MBl+YN
- TLSH
  T139B163B39BDC52320032EE9512A041F422FE86B17341995E7CAF43B05FB63799A73959
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  tranco/wp-admin/includes/class-ftp.php
- Size 26KB
- SHA256 31c1d458cc9af1c4ba431e9fe92ed3d2874ffd4c0a90675d80019d069c191067
- MD5 855ead5de20fb92f5c67ebb648f18749
- SHA1 4bfa19d7a879df5ee8cf3b22e4900661c0759fea
- SHA512 7f34424e23a1d7516157ffe9b032a5849733230b027fdb0b2630d03eccdb7bef40d226fd72dad488f083072315ddc888189ac8428e2ccd59a288abf49db2e2ec
- SSDEEP 768:P6q1jqhlXzMgIXGsObD5gseUrLzFK/oqu:SgKD5gyFK/oqu
- TLSH
  T11EC21EC7BF9FACD63592D0E94353909FE86CB531686A8C47BDD981303B9832D805E978
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32