b2b6827eb7b2b51f4610893e1a6ad02466e76fe0a307bd40ca2a8ba821c40d0b

Sharing

Copy URL Twitter E-mail

General

Target
wordpress-7.0.zip
Size 30.1MB
Sample260728-phhc7aha76
SHA256 b2b6827eb7b2b51f4610893e1a6ad02466e76fe0a307bd40ca2a8ba821c40d0b
MD5 8460cf21c321ed5ededf0f943027558e
SHA1 6708d4e20f22e997196689751a4309497cfc58df
SHA512 ddc470db0437938c4c035c2922ff15c430121b2d38c1380f8991fbf7edd53140fe5b4887b24ce92e5217b21f22dae85510353fb27df6a215e99824fe99f5128c
SSDEEP 786432:QcFy+K/zJyG4lKe6OVgNDSpOy/ND6aocpkm+WMR8:Q2yd/kG4lpLhj/GxR8
TLSH
T1BA6723B2EA3E0F50C6D647748CE5A111F02CA123F64F659AE77E59C4AB794DC2F13A02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Language

Source

URLs

exe.dropper
http://api.wordpress.org/plugins/info/1.2/

Targets

- Target
  wordpress/readme.html
- Size 7KB
- SHA256 491ef4578defac49ddbd8a3df9fa8dfc61bb6d140a7532fd7948b259b07223e2
- MD5 5ee8d4ed40e9db9f5f74dd6ae092f07f
- SHA1 9c455e63e9f2dcb1444189eb1eea914d6b700222
- SHA512 afc7716726ecb6a36d36139918c4bfed68e40b74629302a86116c8ba54d34f7423edf90206f04a4e072d6ef448b7581be76f7d7a342830f6a89a25812eee3af3
- SSDEEP 96:CWUK8pz1E/4kF5kyJ0ifN8uueKQMdcwFdFPKuID9kKCZxjD+9+25tdLwGg1IZz67:98/SVPmuN3C/Da7d0JuCidI
- TLSH
  T191E1966BB5405376131143B16006217A733300BEB79D464654DBE62EBBA23B4AF7F4DE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  wordpress/wp-admin/admin-header.php
- Size 9KB
- SHA256 6a65ba93b7903dee323bc8ee932eb078c858af3fb42af0833256d11d5f29a84f
- MD5 645416acd8e3f66fb6fc7047947314d8
- SHA1 bd505f92a13a64b26d82f30e2bd77cc147b41bf1
- SHA512 3dc90c6757eabcf7b4fb8e5e6a4271f0b438a662b42630236164f22f1444eabc5405ed451e160ee990608ca9bc6157d169be06565a49a6c30d104d87409de106
- SSDEEP 192:O/HW3xQB/m4TxU4ddqqQsY6qifPAWoAXZPXtS8VC46q:UW3xQB/mKyYdqiBS8VCXq
- TLSH
  T1051266441CF2673388A22ED166D5927C762B410BB3D52995BCF941F89B4136C8EFAFC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  wordpress/wp-admin/async-upload.php
- Size 5KB
- SHA256 cbf153ab3aec6d4b01cb58828aceec81d7d429df3f6e3367a78bd5c7f1cb9b78
- MD5 64073faaa1362e61f1bfe9c4a41ddf63
- SHA1 31a257693296708107231ac340cb3ad2cd8b5e40
- SHA512 1e4976ee3cfb5be1116a14b3e7fd6fecf6cdb266e50c3a012c7c0ddc54e0251a7bbe09ad326ae6d8d9930f1dd1b50b3e342311fe7b86532a8f6f0e5fe0dc4468
- SSDEEP 96:tKikm92NpGSrpPaxHQC/RU4gr4M+sgaOE4Vo6vngDnVovMmDhscCk1ReljZD2VVL:t7/92gxL6shHaOg+fVv6jZD2fzT0I
- TLSH
  T1C2C196F5A69C676A513370C4564C842C749D8837F0806C89BC6EE0E0E740D6EE4FBEAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  wordpress/wp-admin/edit-form-advanced.php
- Size 28KB
- SHA256 a74058bfbc0768353858872e0a170c34220ca52f9d726f37ecbb325e75b9aab6
- MD5 a58434d4cf259e05fce4990e632c5fd0
- SHA1 f6f18e1a573f6f1f40a128001a0fa9c05a85dba7
- SHA512 2e977854ef9771985299c7135dd8c619aa49df4e17f61be4ccb3246fa40952f0de697afc4f3d70d66e7111683e798b9911ad04bac0841202bca3d16679ba9ab4
- SSDEEP 768:O9VrD7iE75VXfsX3EiqKb1SceoC0Dm8gIL+t2Oa6QEmNWZSOmn:AVrD7X75Zf83Eiq61ScpC0Dm8gIL+t27
- TLSH
  T1D6D2F956F1F8126159131682F8C8927CEEBD8055738168EAFCBE54ECB7C32724539FA8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  wordpress/wp-admin/edit-form-blocks.php
- Size 14KB
- SHA256 6c95b99b9a51a864880525493d782ec3803140260f40d3e4430bf0dce3723023
- MD5 cf8e8ddc9550bd9ce8f3bac639479f7c
- SHA1 551c71c42c1d64838cf4e6705a1da848af6afb84
- SHA512 62bc60a8aece6f159964bb2d821abe94c8adcc771b704475631434e6d24b93b2817931df816bcd802f2847b995fd4c9bfd11156a7db1a654eb0e0e356b3d88f5
- SSDEEP 192:70DKx7ArZr4Z/PoVuWBKcUXVfLIqEqgtgdxy+2d2QZH3f3DOBaGbJF+0x/iZ3MN1:4K5ArZr4Z/QT4ccFOxPDOFrwMeoqTk
- TLSH
  T151622817A4BC637A1073369AEC1C81F9ED2504867342A4E1F8FDCD88674B2D98635FE2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  wordpress/wp-admin/edit-form-comment.php
- Size 8KB
- SHA256 47c7c2c85b7786236b326157f0f8faa4d3c15228bf5dd5ed0c19e08bf0d24a84
- MD5 dd0304cb076495b0c4e5a2b837b6cc7f
- SHA1 a91d3f63169f98dea7272e22581c5ba7d2025a57
- SHA512 a5bd15cde724020d89e0ca518f0b692eda5cfbae336ad21df7b518cc09610cb4e9590d2a4983019766393e5cd3e2ad19418eb57715d392acb934d0d0283b1865
- SSDEEP 192:TosxqDLyvTQbEBU/albNBNRj8yV9p/4iCtoW0MLexXLtkYyPyVKf:TosxqDLsTQbyUilHjBCSW08rPyW
- TLSH
  T19102769390E40721C4A33CD12D9867B939C88709E2492C9CAABDC5D86F50FE66D36FDD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  wordpress/wp-admin/edit-tag-form.php
- Size 10KB
- SHA256 c6048841b3d0c9821abac035046657c18753de62b330dc8f647b81033a83af8d
- MD5 e8c365617952fa370aaa41d1311d95a3
- SHA1 9044ba46a25af74afdd3cb8304aac6842b32c376
- SHA512 9ed0c4c9f671bca984c700ed5410466daef54e72e8d95618e70de0cd21d486416928b27c8c0e9125bce0f5d227f13ad4cf6ffda0a8d42d226028feefec60beef
- SSDEEP 96:T4qPPi8wvR0Hi+hmVbmaE2azn47Nve21Jiysa/xdT+g7KA5HK3EIx7a558ZF8C9N:sqXCF4zn47kyBzJqVRaw91Y8
- TLSH
  T1A72293F759ECA63055530EC03CD277493FBDDE2976010CA9FA4ED8989725AE2493AF40
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  wordpress/wp-admin/edit-tags.php
- Size 21KB
- SHA256 3695a5c6430d6b61982f90e4fb0298a915ed88f93f11fd4f9f1a1cc075da96f8
- MD5 ea2db0b9a8df5c1434d0d43ccc194882
- SHA1 b6be195d72475cfd3f53135e8a223944de0b8f5a
- SHA512 d752ff8cc5bb71f3db1630823159247ab4932c5a7493cc2f5614d8b7395f7be22104836e99b6a095e95ecca3e486affc620cf1254fbb11e3775c56b1a93e6928
- SSDEEP 384:KFifr45F03CfXgsqlqf0rxgrZU46rPhkaLrAN48:KF7SU1qlW0rxgr2VLrAi8
- TLSH
  T1CBA2F7EAAA9C517013171E80BDD8F35A7E7CC92472411CFA799CC458FB506A64B3AF88
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  wordpress/wp-admin/export.php
- Size 11KB
- SHA256 956911bb9f675c93be60439b84490be4b67571eedecf4224bcfe064c8340b343
- MD5 8f84adce85891be383b351f5d6f28e2b
- SHA1 40fd55d536d0b6a4c610fc547e945e9425763d2e
- SHA512 b12cfe4470688df2484a47b80833dbe15fd7b4f18b8c7fab8d86eb1fed95f8de0a8ab145bc98e60daf0767b70ef12dea4627e1855c6cc79a7bc4ba3ade2d5d0c
- SSDEEP 192:f2INQVgBMvCqjyNNgBtshhIzkeBs3QB8ToFKDOG1XspINm/P0R:eoQVgCv4NXhhxM3BZyJm30R
- TLSH
  T10C3265A3F5EC4B31849B28D516A497F13BEC890591012CC6F42D46ECA7D1D69CC3EEEA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  wordpress/wp-admin/images/about-release-badge.svg
- Size 4KB
- SHA256 89f4c892f72202765daefecea322a2058bcc21491b797bb994d615c4df04d9e6
- MD5 b8e766cb84082709053adea3ac75cc97
- SHA1 282d507952e42a140c11a2996016339defa8a63f
- SHA512 35ef93dbd2fe0991ef29e66b8141fa23e1a987488889cf783867d46cb746f927eb4aabb950eaa08d2761d76791fe3e4a2b9b4ef1b13bf231177ab64a2fb306ec
- SSDEEP 96:zC4i/ICIVMfY5IqSBMlROWX+1PtJwpkX8DOmFK4Z:49IKf+IqSBmRzXGtGpkX8lFK4Z
- TLSH
  T1D69131EF67204CE6CDCAD2CBFB8210EDA01F91BA16924B54C358EB9D7845C5D8CD9846
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral19 behavioral20
- Target
  wordpress/wp-admin/images/about-release-logo.svg
- Size 3KB
- SHA256 6d7e4987de45bd1a6529f632a91a6d64ca7dc6e8f1e14f74975ba80d09aa01d9
- MD5 2620c6ae1157906c0ba9e5a7b37167b3
- SHA1 9b2bd3968e345b660fc39ebb7e12f0eea6e41d37
- SHA512 38bbb4d6c84231544430cf16e395949be8ba0bd669a3f0a9282586cd4a6a935cd71d453439dc014ee30edfe1bcb393e09e69b7b6f6e0b656b7083b3d56ea06b2
- TLSH
  T1A781B5D63769F3C4E10ABBA4DF35A1283A1F24F90EC0C0ECC7B2A950665249E1D59CE2
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral21 behavioral22
- Target
  wordpress/wp-admin/images/contribute-code.svg
- Size 9KB
- SHA256 5383af9878f5f7647fd4f46aecef497eaed7c16803ffa3071b710a1bfd89dd27
- MD5 b725278c2b638cb79b9dff90f526224c
- SHA1 adc72b808e6eeedad83560ae5ae11e40fb2c664f
- SHA512 35bbfdb5db23262916d7221c05c137f2e0821c6da89c16c7f1d48cdc7eb3b65872ca6335af53d480ef5e30669e0e47f73ad7eb307063e0486960705ca025280e
- SSDEEP 96:3QwY8Rs8V4Qt/n+8uh1QREQw5RGC19Rmt:3uV175Rz1it
- TLSH
  T1AA123FC8672D5528737A2E1E67072ACE00FF6C9CB25C3748EC1F69B5538B59AD42388D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral23 behavioral24
- Target
  wordpress/wp-admin/images/contribute-main.svg
- Size 17KB
- SHA256 d17763d0cf6ac7899dcf6c50075b682e983d0b0ff278e752b13061af2551dcbb
- MD5 abadc35556c6a613bc1632ecb0cbf000
- SHA1 54df7083d150caf86f0e09f3f14b8ca4e2533d00
- SHA512 0d78739db1c6729acf95153b6858c2941c04e75a416bae62722e0e64adba15aad222e5a5ce59a4047bee6dcb0d9707d7854c59674003452a419a1f8c50650fd4
- SSDEEP 96:VfWZZwfbiJYAXf8zffuTptfVJkeU3f8WzfWZZwfbiJYAXf8zffuTptfVJkeU3f8l:5RlkXSoL3JL
- TLSH
  T16D8234C8672D512877762E1EA7072ACE01FF6C9CB54C3748EC1F69B1538B999D82348E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral25 behavioral26
- Target
  wordpress/wp-admin/images/contribute-no-code.svg
- Size 8KB
- SHA256 17cf12d1a2f8693922386a4696d6e4b9786a4afff0dc65f86b014e0a33826212
- MD5 583f8b10a1cb4c6c8a52cf2731ced8ff
- SHA1 063ade614573d3044dd1c650695491d3c85482e0
- SHA512 857d604c8a228f6c9286b3b61d1ed2e9349e06c9af2cb5e86672c865f6efaa6681816dece85f8397d691a92af3b0a1bc79dc6fc2856f0eb5372ae7aa21deb1e6
- SSDEEP 96:0//ahMpMZa9MNI/SdXeYeAlEoAjBh9PwE1DdkgZA:0HahMpMZa9MuuXplEzjhPwEzRZA
- TLSH
  T11A02068CEB987F32AA541B809F51F0C4117B24EDEA647128546C54B8E5EFFAD8D1F0B2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral27 behavioral28
- Target
  wordpress/wp-admin/images/dashboard-background.svg
- Size 3KB
- SHA256 eb55d8055063f46e176b6780b55e8d98b999b9ad3b85fbca55c64b0221480546
- MD5 5b480d6b67f680796a4ba34f4d87c5fc
- SHA1 49ccd7b576475b4adbee1678fa19c1e2a828a75a
- SHA512 9ee1b84a753bd8e5bce782b9f2c370f21f07b81141623a2781b119a1c378de54af37abeaa213f14d1c7c352ff9a2b7a8e4138f4daf9dd447c975495735095d2d
- TLSH
  T137614A6DE6BCAA37D64AC28CD985E4643A1903C766C48241B16E9F9F5F28C830D1F7F0
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral29 behavioral30
- Target
  wordpress/wp-admin/images/freedom-1.svg
- Size 1KB
- SHA256 c641e751bcfb5d44aa4609d9f94c3aa9297f1baf564196b292aff3ee4e90ff72
- MD5 0b28aa39660dddc94f4a1aa117a75db2
- SHA1 ca822ca083e29e2ff15e9be4b50b80ab31a8e2a6
- SHA512 6d6918b9d5a73db24593380dd228093ea5444d631598e73a4418f48db0c3c891b8b12ce6bc693d6ab9cd34eb8e27ad95c496adf34cfa21a4b434be47812abef2
- TLSH
  T12A319AA592BCFD2AD6A1C1EC532BF1E0306E20285356A75859305F3F696A4B33409BB6
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32