39344be709924d9a7817b0c2d665f7adbba7de7d6d76962936d101d06b230b15

Sharing

Copy URL Twitter E-mail

General

Target
vna.zip
Size 44.1MB
Sample260727-w9769ayfqd
SHA256 39344be709924d9a7817b0c2d665f7adbba7de7d6d76962936d101d06b230b15
MD5 53f342349d7a7ef7fcd0326e3fc7f047
SHA1 1bdf70454837310c2c69900b19ad6f6cbb426519
SHA512 5e62ed73e284259d9a85e4ec652e71a04d3d12a87a87f07c6b346f6bd40dad40ffa340cc4c35b092c36da55fe27ec5619ad99a934d95dcaf104116cc4ebe634a
SSDEEP 786432:8U0A2U511cHIVA+qv0LTXbqV9EjVwJM6mOVWEoFQUdA9lWdaunu2k4LgjJfKSw4m:92411cHIKvUaVOjVwJLmtE3IAEM4Lgj2
TLSH
T12CA733368F3D0560CAEDCA37DC9911B090CD4386A685B9F97F7C11D8AF9A25E3A72704
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Language

Source

URLs

exe.dropper
https://api.wordpress.org/themes/info/1.0/

Extracted

Language

Source

URLs

exe.dropper
https://public-api.wordpress.com/rest/v1.1/

Targets

- Target
  vna/readme.html
- Size 7KB
- SHA256 cf26c14a31f49ff2e51bf26ab2cf1ba14d6d8530fde875ded0414b848ff97c79
- MD5 c17664e85bfe1b94a71597f49af06f77
- SHA1 005e238b1aaea206549ff926e4b4d594e282f24f
- SHA512 cbc54c1f269ad773cf932ef19b1c8c086dd0f3beabf0c093bd9bf122b0cb755b1ca14391d30a9bc1dc07c14e2d138ba7e6a7328b049fdca6367ca542216f6f69
- SSDEEP 96:kUKLApz1z/4kd5kyJpbifN8uueKQPmcp1iZvdKCZUjD+9dv5tdYGgzNZz4H+lUbQ:uLA/TtPqmuxCwDaldYFidI
- TLSH
  T1A5E1B55BB540537A072153B1A006227A733300BEA39C465654EBD62DBBA23B0BF7F4DE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  vna/wp-admin/admin-header.php
- Size 6KB
- SHA256 79d428ed12e732dab6299e4515615aa102cca3f0094bca443c5aa712fd109a44
- MD5 e59419f76c64a6ba6018ffe48a25382f
- SHA1 e1db2b679a74446e505dbad62d134f6a839192f6
- SHA512 5e578517a69a695938eda2f356b0e8d3816d931195830e39ce41bc2ef556652be7eeb0cc7891538e1162c42dce6143cb3f14867d830d4eba87a7c34d9f838c1d
- SSDEEP 192:HUaZXPINIK/q6v1d8qqDoS0i5rvXZPX32PYYJx:tZXPKv/qOFzS0i32PYY7
- TLSH
  T181E173411CF2676388A30AD265E6D27835178A1BF38228909CF641F99E913588DF7EC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  vna/wp-admin/async-upload.php
- Size 4KB
- SHA256 64028e411064cd865a3ca77193e62f44f4bfdd1dc8bd8edc9b13f6da573a20ea
- MD5 7e11643468caa5dac268efc64e0b01b0
- SHA1 3260b7fd59406fcb21d942ae377e38a4e3ed325f
- SHA512 d402e305b0612108389c3c94b5d1838dd6826e677417813bc71453581581f92066dd04662a39c0377f7a37563d44f32bedf3379c519c7f6a6088678718d357bb
- SSDEEP 96:tKzk2SabJRMDl+0F+kLheLKNabo6BDnbov/DnlCeaz60WM:tEsKy1FVeyJRTaz9
- TLSH
  T1F19187F566F8A77A5133B0C84A4C802DA559C913B1809D5C5C6CF0E0DBC496FE0FAEAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  vna/wp-admin/custom-header.php
- Size 43KB
- SHA256 f8a6c06246136390ae467c5537adf6ef463d0983f8a1abd8c966da0a47f94658
- MD5 99eefa9b1939cb204c388833bae2b409
- SHA1 7783d5417243dd82478763038375d5f58fc628ad
- SHA512 ce71ff4daa565c95999162451cc0093d760b66b47475a591ff23b53b7f0e473d41e7d84f46ca791af51be95717c84ce4f2c5f3d151b3a5168c3444dd45ba31ad
- SSDEEP 768:qp1fwQYR2WiBDPLGaoB0jlmhNtje/RmwO/TmxxLgnFiQvNux1nAt:qpaQYRniBDPLKBolmhNtjeJmwO/Tg+us
- TLSH
  T1AF13E769F7BDF337403328A4E60EAC0E55AEC6145242ABDABD8C90ED59C0D2CD974F85
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  vna/wp-admin/edit-form-advanced.php
- Size 31KB
- SHA256 c0d69fcf04389f2d9da883dae89d94f2dd609373a02cf702fffd7bf7dda6c6c1
- MD5 050baceae44fa0560c2911d97236c5eb
- SHA1 2577f75a268d1c274bb8fa75642f1dca33deb633
- SHA512 7d382ea900349ece6f93c3edf0ceed395e5ae0572d7b3f1a4c8529ca83a229cff37e18133b6ba7f6cdb83a7a6de4d4a6458bf71654981c32e70407376c52190a
- SSDEEP 768:Ne2gcA1crX+hVbTiK0CK53cPcoC2BuwaxnLL+t9dYAQkf5YUsI6uaHfI:w2gcA1crX+LHiKq3QcoC20xnLL+t9dYG
- TLSH
  T1CCE20A16A0F8226254235680F984D27CDE7D8451339164E9EDFE94E8BBD33B38935FAC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  vna/wp-admin/edit-form-comment.php
- Size 7KB
- SHA256 182a8417dcf82f4dcea4cc6290bbc55d2c0e7ad063f7afb951d84c9e411644d4
- MD5 b2626eaa0002908437813a72dfcac748
- SHA1 514e8e35f3fc95d0c037773f6089c44600ef23aa
- SHA512 a58faaf3d23af1e3557321bc741dcb4f17839bbc64e0180e2458ff561767ce637b67592030abea9397d1195f2b49bfa43188d9c7d5820fdeb31727f5d998a7e2
- SSDEEP 192:qxsxqDLPOTgsOkvub2mNJmatlHCY+70MLhfLdECYJXj4ByMVA:qxsxqDL2Tgrkm22180DCYxj4B0
- TLSH
  T16DE15493B0D4873190A33CE17EA4667939C8CB04E2451C9CAAFC94D85F50FA5AD36BDD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  vna/wp-admin/edit-tag-form.php
- Size 8KB
- SHA256 410c7ca560a0a7cedf2859644f5c63406878485496d53ddb9745dbb97c34e1c9
- MD5 92d876578a7a8bcf54969bdef5ba3f2f
- SHA1 e65fca1db4d2cc59bb7fad597aab7164e054c776
- SHA512 efdc7a0e4de6245cf30ef6049c2b6f707ab49b143075274cfb5053fe9ff82c42da11af3c3659057f7b0eb537845a089d0a44dea0950cf9e10ba834a6e4234fdd
- SSDEEP 96:aFHUJ1Vif8WRF6BR1aEC1j4QxxajrYdx+mm5Hn3DIxB558fFYPF1zMNLHPN28Lp1:aWJvm6Bo1j4QMz5HMzH5kjnGA
- TLSH
  T18002A5E7A4ACF53005530EC07CE3B7467FED8E2576011CA9BA8FD8A493218A1493BEC4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  vna/wp-admin/edit-tags.php
- Size 20KB
- SHA256 0f27511ca62ef1d0b95c6185807936491e0f92707013cfe63f828be739b3b616
- MD5 b724dac10c9ae75d9c0b0200f50ebb4f
- SHA1 ebc78bf354f0d2c822918e773993ee8e8b4e5ba0
- SHA512 f72961f0042c4f7860fa39c0a4db73f92df1b7a0c64f9d7cb9a44fdd831b75cc678d2ac120ea31ccb36add2fdcef88f15e986e40a282fc9cfd32f685ba4db4f4
- SSDEEP 384:oOw7wLuWkZiwWmXRfgga0ewLtkLtxH6LIHYnYtUVw/fhcN:oOw7wLuWkZiwbmt0ewLtkLtxKIHYYtxu
- TLSH
  T17392E9F7A698517002575EC1BEC4F21A7E2CCD3132421CFA7A9CD0A4F7516A60B3AF88
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  vna/wp-admin/export.php
- Size 10KB
- SHA256 25cdd4134a42cac5ed485f8d67428af81ff370524fefb99bd433314fc45a3148
- MD5 e1a3d7025ea7a640122a6afb07631b9a
- SHA1 83e9b9439bc75aa5a4fdc19883fba84af191a516
- SHA512 00934a7b9fb4c1ff002d8ed4e0b90442a5c7f9e81d00d49c3ecafacb0ea9a8a9ce2ac095d33a599fda81192807317d8f01a10b7a2a3c7765dbcd6bd7ca17ba52
- SSDEEP 192:fXbTqODPvGR8eiug0jEnF+rwzwrsiB8ToFAEOVXspIEsn/yq6:vbT3bvEigs+rLrHBZxZg6q6
- TLSH
  T1672298A3B4A84B35849B28D81694D7F13BEC8D0591052C86D81D47ECA7D1D6DCC2FEFA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  vna/wp-admin/images/wordpress-logo-white.svg
- Size 1KB
- SHA256 e0658d46dae8331fc0bf524fe1bb1708e0c3b5de6d8ec2770fff3b89e3fa9492
- MD5 e1af633d59dcb5988cacff73b6dee9ff
- SHA1 fa9cf458a1d9c755ad61ef741efb9189c72dbcd4
- SHA512 38246e5731114aa38d965481ac4e59f3549735aef06610a571dc2ac2f73301eb4aa6b6b9eb27bd1c0711841dfb4e381093cd14101a60b21fc0ac0bc1569c8e58
- TLSH
  T1D031008D872954FC68A692E4AF30B8A3262C95DA5171D988931D99317AD0CC9EA44CD8
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral19 behavioral20
- Target
  vna/wp-admin/images/wordpress-logo.svg
- Size 1KB
- SHA256 a0bbefd626f1e76f9245ec6c6101b679ba27412b71b32fc43eccda9db40f394b
- MD5 f34ef6259364f7ef0ccf67cd1dddc970
- SHA1 18b563726b3d24a73552791fff91f61077ae1ec5
- SHA512 c4ef2a19b114946484a6fadbe9bcfd80111779a5bfce8fa1d38bc09915a6e660978435f7796b34a7c71668d97c0e87186188ee5ba1704aafa592c22754e63651
- TLSH
  T1D131008D873958FC68A693E4AF30B8A3262C95DA5171D988931D993169D0CC9EB44CD8
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral21 behavioral22
- Target
  vna/wp-admin/import.php
- Size 5KB
- SHA256 9496e0a2a6b30f02adefe54d790884818d4aaa758a6c4fbb54dcf1833aaa2a2b
- MD5 3d2669392c78b01c6277355e3b8f847b
- SHA1 e09d9cfb71c8cdf1968f8b0ecfcbe85eb2b72181
- SHA512 5516aa8624544800e6292480edb5041f1961ef2e8571a7fcddd7078e926a8cdd498e1430b37b86be97731db34eee324231efd07255c7cd1a60633637b96b367f
- SSDEEP 96:3u/GSOC3r40FfLi/nWnuIHdmT/TQ+ZN3tOrPJBA82pQ+mdof197eb06b0u6EJg9y:3u+S3r40xGkkDk+bdOrPzAB041MBl+YN
- TLSH
  T139B163B39BDC52320032EE9512A041F422FE86B17341995E7CAF43B05FB63799A73959
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  vna/wp-admin/includes/class-ftp.php
- Size 26KB
- SHA256 31c1d458cc9af1c4ba431e9fe92ed3d2874ffd4c0a90675d80019d069c191067
- MD5 855ead5de20fb92f5c67ebb648f18749
- SHA1 4bfa19d7a879df5ee8cf3b22e4900661c0759fea
- SHA512 7f34424e23a1d7516157ffe9b032a5849733230b027fdb0b2630d03eccdb7bef40d226fd72dad488f083072315ddc888189ac8428e2ccd59a288abf49db2e2ec
- SSDEEP 768:P6q1jqhlXzMgIXGsObD5gseUrLzFK/oqu:SgKD5gyFK/oqu
- TLSH
  T11EC21EC7BF9FACD63592D0E94353909FE86CB531686A8C47BDD981303B9832D805E978
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  vna/wp-admin/includes/class-pclzip.php
- Size 191KB
- SHA256 7f4e7c8d97fe34aa9229e7b91d5daec7b8f94974f35f6e3fc45a2b4c3f6d3181
- MD5 834d22f8b68a2c5c01866a43eb24efc4
- SHA1 ccd23ef96a588840943fba081bfa6f88531c4abc
- SHA512 680eeacbb3c2846af6f5afad377d5f1560d4b7f778f8b9f3d0fa404b4f42671e31c3e13ec80573c3b3b07a075f895b99eb1d6ff2bdc00e71784c9cce8b55bb8c
- SSDEEP 3072:IdItMRpT6v5sll1TC6RRbxWJdZK3+EUZz55w:IdKv5slrTC6RRbxWXZK3+EUZz56
- TLSH
  T1B9144345BC8601726AE3D2FEA7CBF44ED164C6370A4DD816396D43C82F60564C6EEACB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  vna/wp-admin/includes/class-wp-filesystem-ftpsockets.php
- Size 10KB
- SHA256 fbc0a057644a1c89d5b2b9a429654ad0039d5e35d1f1331ddc4fb05109b9e5c8
- MD5 6252ec199a431cde0066f55eab574f3e
- SHA1 9254edcf3f9281d5954708676605bb67cf5153bd
- SHA512 c626d865b12836ad1a980d29012c8b1b4f4f9c9cce9b461da51ebadc3f4806db3e7706e803f3dac2f5ba97ac3bd190da28017e77205bf3122053662f0042a4af
- SSDEEP 96:DZ6nXLUBAuUrocpUYIhUrTcw+sGEsGL+YogVk+yImh7IKIpY95xa3PRX5B0doOGo:DwUJUVUDhUfYSly1aEMfDWr
- TLSH
  T15C323FD2EBDDACA6521031B95FC7B21A70BE9931D59A4DC9FC8A5590348433C86FCC36
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  vna/wp-admin/includes/class-wp-internal-pointers.php
- Size 4KB
- SHA256 90eaadf27bf104b4beb4233a03e04871f168c8545b24181867ae87bc8f28b36d
- MD5 e3be49879e4e749823539e234113d6ce
- SHA1 11ee61a11ba296cd08692d30db786904f8d5bc60
- SHA512 1192432ddd64d8461f6c5d2c23134bcd778000239981ab50a96d28f32d20cfc951fad9860477a61aa94edb6ef8ac38928ae78de37efa76f81b100577250699be
- SSDEEP 96:6zwNxWZrEHBidODUxKljhZ4tl7SNfSq0EGblp:6smJEHwd+UxKlMoS/P
- TLSH
  T12F914188AA8B6D2EC0132654BC469099957F8D6160C44886FCD99BA43FD727CCF7DF08
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32