7d3eafeda3451513b03db689265a68a78d15c25a52574b2ba64cfd4f3cbf83ac

Sharing

Copy URL Twitter E-mail

General

Target
all-in-one-wp-migration-unlimited-extension.zip
Size 470KB
Sample260809-ws828awwbt
SHA256 7d3eafeda3451513b03db689265a68a78d15c25a52574b2ba64cfd4f3cbf83ac
MD5 0972529d9879feceea6154c6cf35e80d
SHA1 8f31c0562e3a8a0cf523ff8cec9c94195dee9a19
SHA512 59111f78a8952c44bdf1f28367a023b8c2d224ca77f243a71fb55a86afd43e171011517a1db8a44bcbc7a1cf3f2495e8623063bc8516f4132be1573ee2506000
SSDEEP 12288:NXR4OKWwPFh/xfDsa4LEQyzbgKSr3PPiSAcx:NXqxj5Dp43KbgznDx
TLSH
T1E5A402E1991F9802EBAFDAF28635E048D43ED7D567FA682F30F91105630CB05672AF25
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

execution

Malware Config

Targets

- Target
  all-in-one-wp-migration-unlimited-extension/lib/controller/class-ai1wmue-settings-controller.php
- Size 4KB
- SHA256 bec43c7f68cc85cc1dc2855108400ca3af19ecab2fb536ab796d210387153b8a
- MD5 767f31dcebeb1e920f5074f3476ead12
- SHA1 4f853b1ddbe1027083473d645a414072501bfb7c
- SHA512 48c2c50cc5f994c665ce8ee3f879bdfeaebce978b07ee01931dd16a43a4fc4901068d2214a48d3342cf0973178a66d8621c5b7f8bd8d7c8cf503a259141b4190
- SSDEEP 96:/J7f7WPqKTnZ3PNhbzn0zomzFw+lT+rTHvGTK+gJjXbVV/zXEw+le+UZWl4+5SQc:/J7f7p2KCy0hhblrQuEVy
- TLSH
  T11AA11E75E28CB36902AE1D156575FE8C932D85E2F9300016F5D9A7C42C3AD388F6CEE8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  all-in-one-wp-migration-unlimited-extension/lib/vendor/servmask/command/class-ai1wm-backup-wp-cli-base.php
- Size 9KB
- SHA256 0821c7a34701c66dea52d9cd2b452274619ce11ac2af58f94d243b748c44c315
- MD5 ad59d707b5406f0e8dc241262a7c92dc
- SHA1 172ef5ec6f021710ef7e13eada62910e91b86f59
- SHA512 db13a6b289449d00591255071c47841a50c84ab45d360f2e0b65df40760b2a6e0d9320cb4efee3fe0127d26af12964fca0ed0cd60c2133f2df659a88343a3b0a
- SSDEEP 192:GJ7f7p2pJvwLcQNcE/oGT9X/GtRGeY3sVIbVy:GJ0pScCcE/lR2Re3sV4Vy
- TLSH
  T1D62211A5E7CCB32A836F711819B0E59CA32D91F5E47010A6FDF89BC85C69429462CFD4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  all-in-one-wp-migration-unlimited-extension/lib/vendor/servmask/command/class-ai1wm-backup-wp-cli-command.php
- Size 15KB
- SHA256 5a4f2d1aa38be8765a641fc1beab1ac7f6a6c908becd594fe904fc246545c1a4
- MD5 f5c0f0a1b6241bf8c55da2d2c94d981c
- SHA1 f9cd466675060467f7c173e4ffddc005fc6dd695
- SHA512 e36730ba309e2b0063796df6ff67b60fc95cc270e23b473d99b429b7c3ce4dceafa2af934dbe8373b17c2c2340cfdfe2d8b597bc36fea3d623b9a6bf939d8845
- SSDEEP 384:GJ0G06yZgw89F4wEPaClob43hkhksi3gn9jV5XeD:GJh06yZgrF41Pamu+gn9jjXy
- TLSH
  T1A07213DAEFCCB325329FD5093964EA98F27C50F145B00893FDACDAD43B654254A4DE88
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  all-in-one-wp-migration-unlimited-extension/lib/vendor/servmask/pro/controller/class-ai1wmve-export-controller.php
- Size 5KB
- SHA256 2a019e27cda0ed748bc22c895869889576bb8e4493e54326a17d36079490c627
- MD5 2e7781d9c378203356d2f4115c326fc1
- SHA1 d29d4e5b99d4cfd0c58d917924efc2db2c20f089
- SHA512 1af6551c2ee1bc7b3034d52b2c3d8a29e6fd37584c9afda7ebe622fb51d0a9044465d5efa7d0bb6baf264f98b4f9afb9fb48d1089581ec0ead81ae8fa16e27b4
- SSDEEP 96:GJ7f7WPqKTnZ3PNhbzn0zoW0wpLupxupDY+HTYUd7Bupnwz6C/jXhOSIp/61G+b/:GJ7f7p2MWc3zsSh/jXQSIp/p+blxDqO
- TLSH
  T18AB12036E28CB335022D39509A74FC8D932EA0F1D6B50012F5DD5AC56C668788BAEFF5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  all-in-one-wp-migration-unlimited-extension/lib/vendor/servmask/pro/controller/class-ai1wmve-main-controller.php
- Size 45KB
- SHA256 773f22cf295502e6b491d083eea82cb574ec0b638a8b83e73a7ecd2674196c0d
- MD5 8f64e9fc67c250731d9c85c976724ad7
- SHA1 65fe7a9971f72b7d786a19d41bb8d2002c8dd7c5
- SHA512 4a0c0389ea42e8325c93a93685051dcfa30173608297b552691968a7ff8c10fad1701a2b7be98b10be4617735c0d4dd650e4c92e6712bac2c78afe4ea2981214
- SSDEEP 768:GJnGQtK9HnsfcQdBcy08rtbVu81f2Y289Kqq:bHr2rtbV7f2Y289Kqq
- TLSH
  T1FA2385A6F3DC3E37127A10816D19C8D0B17C65B1176100D7FEFE6990AFF62A9C12AB64
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  all-in-one-wp-migration-unlimited-extension/lib/vendor/servmask/pro/controller/class-ai1wmve-reset-controller.php
- Size 4KB
- SHA256 3832d93471f5dd8969a483cf5e40aa3a6351a79c9e339c35c8897aee88d3b0fe
- MD5 dca852a680288c306d0cb079cfb06127
- SHA1 0bd90282c6f6766b19ffb032f97fe6c1ef6acb28
- SHA512 f0293eca0e8669b0117c36ac3a13c19b24620b95dfca0624e051eae80840c5baee6b131b5e24f2bf8f73c00411dd21162edb17acaae8b856256332d8b86f3012
- SSDEEP 96:GJ7f7WPqKTnZ3PNhbzn0zoTzeTw+jp+Ke+UDWpZvgWrOLqml22anvKcqI6Lhjvwi:GJ7f7p2ne05LradqFF
- TLSH
  T1FCA1BDB6E1CCB33A428E2C1469B5F89C932D48F2EA350047F8D96AD51D36928DE5CFD4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  all-in-one-wp-migration-unlimited-extension/lib/vendor/servmask/pro/controller/class-ai1wmve-schedules-controller.php
- Size 8KB
- SHA256 aa3457464ee02393445d6df222e2ed022abee8e1551ea409d4057b37a3a63e85
- MD5 41f1e61a56c3c5cdda159b749b6b8f64
- SHA1 2e161e221d1a2f38a20ab06c2e67320b130b1d26
- SHA512 49bd393ea42925f02afe679b6c62d42a71885f572cb12ebe7d46c3349e5e024ed6d9b45e876ba612e33c0c16cee9af64fea25bd318682a2b8648e635eba262ad
- SSDEEP 192:GJ7f7p2TbZ/Z8Fe8FcOIFJK8FnfOFtKKtX:GJ0TlKIy
- TLSH
  T13E02FEB2E39CB329926D2819B670F889D73C4AE1B570046BFCCA5DD12C65438872CFD6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  all-in-one-wp-migration-unlimited-extension/lib/vendor/servmask/pro/model/reset/class-ai1wmve-reset-media.php
- Size 4KB
- SHA256 e899c3c5392b9ddfa736990159247829520eb330d1460e2d766f1327ba6b9c13
- MD5 865bb78676fa69e4ce90b59ba9217ba0
- SHA1 ed99f9e04013ec1f0b22ce7443ba55b9b5b0893e
- SHA512 05e9d88d8b1fb000ade47c5e9ff602b66513df241e6fa75ddc02628fe95b88733d707a5a56bd6dd2267023fccd119c6e56841ea96164db93bbfb158418b3ced7
- SSDEEP 96:GJ7f7WPqKTnZ3PNhbzn0zowZZ5nyIvVc8MOWGe9lesDBjQBFF/:GJ7f7p2s5nRbhghU/
- TLSH
  T18D912036A2CCB326466D2D0595B0FCDD531D94E2E6310012FCDC96E8BC3A8355E69EE0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral15 behavioral16
- Target
  all-in-one-wp-migration-unlimited-extension/lib/vendor/servmask/pro/model/reset/class-ai1wmve-reset-plugins.php
- Size 4KB
- SHA256 b39eb10c4233547097907c954d3798d1d237d16b33ba489264fe740738fa696a
- MD5 95c0b9782f39da2e0137d809d8064283
- SHA1 0cffea4cd090e7a1371f7586a49299c3d91ad223
- SHA512 c85d30b2b985788bec50cc2e7c46c485fafc01ef393eb8d4366296489db14e12ba700cad5f8fa96bfc915e5df2ba0000e706c0743db3701ca5e58c5737a89576
- SSDEEP 96:GJ7f7WPqKTnZ3PNhbzn0zoEmfX57q1Gc91ZNQNLIvVcQeznlewipk:GJ7f7p2lfR8P9fNeCcl9iS
- TLSH
  T12C91FC77A28C633A457E2C1414B1FCDD63EE26D2E6318011FCE996D82C329384E7AED0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral17 behavioral18
- Target
  all-in-one-wp-migration-unlimited-extension/lib/vendor/servmask/pro/model/schedule/class-ai1wmve-schedule-event.php
- Size 14KB
- SHA256 6409f40061f37edd5a8897444a8a960f9f8c6ad36689b67fc54f234f0abf3d8d
- MD5 44f43fa25a96fc0c45429bc66c3c9223
- SHA1 ea7810e7d7462644b3b6c8dca87b5740a6d38bf9
- SHA512 5c4c25e951b0258531ce30e15d61bd4b8db02bb7c5b0871929faaae55437f5c7477046b3fd26e6f48c2f73b2d6e2499c7c001538aca4901e5629665b6c498ee6
- SSDEEP 384:GJ0tR6WQtIilX3sbhRFRuxyfomH4wMNKDnkF3RNR0Rz:GJVcilnsbqs1MNKDkF4
- TLSH
  T1EE6222AAA3DD7FA2665A20E44B31E8CCA23D50B258370466FCDD86C47E6052DC719FF4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  all-in-one-wp-migration-unlimited-extension/lib/vendor/servmask/pro/model/schedule/class-ai1wmve-schedule-events.php
- Size 5KB
- SHA256 66e7290e7cae28926f4d2f214fa1ef81712e8dad5f502cd7c6e859ca52e727ec
- MD5 4078f10eff1d3b6a6bb95663755da8a9
- SHA1 0219daea43066e665e6f0b66ce9e449e77549c4b
- SHA512 97d7f8c0c65f5263f4e8127159dbd4423d7bb3ca2996fc862724d415b504ffd0c3bc8f332a61473defb94fbf217d2a5dfbd1907fc65d140d09c4bc50574a28cd
- SSDEEP 96:GJ7f7WPqKTnZ3PNhbzn0zoi4+P4bdXTSp4mRJRSTDSIrgnKNSIFeTDTw6bDwRUQV:GJ7f7p2nPuI6HtTTwEDwyQwA
- TLSH
  T1DAC1BEBAD28CBB75052E1CA86F75EC8DE37C16F160760056F4CA9DC42F25538CA68ED8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  all-in-one-wp-migration-unlimited-extension/lib/view/assets/javascript/pro-export.min.js
- Size 148KB
- SHA256 89c6d06aba8f4767a15e4d1e70c81da0245540297e1c268254f3b83286f36547
- MD5 41d696eb7d13c72248adbe3a6ef1ece7
- SHA1 6f779a66c14a63f865a374ee646fa23ecfa36b87
- SHA512 417cff7d2b5a0026f4a3bf0f4f4b12c7c90f2fd2ae016461ddea0613445186fcb8eccb98f4d07d5e9a2fb8fb6a24bb2ed34c03f6058b6379af9a877ba233fc30
- SSDEEP 1536:uKb4GHUAP4NYu1VAdVQRo9U/zHkkPlCYytHXVvwy0aO3VVDj6JrpQ:uKbb4L2dVd9LkPlCYytHXGyO3VEJ+
- TLSH
  T171E3079EB2C6B4B207EA24E1007F090AF2766954780AC4D4F27CE8D76D7954E50ABF3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  all-in-one-wp-migration-unlimited-extension/lib/view/assets/javascript/pro-restore.min.js
- Size 513B
- SHA256 148acf2f0a4ee1db936d7e6b572fc5033f07be53f5eded3e1fada2c2fdc2afdc
- MD5 0b124ef1c0f635563c90c09d60a37828
- SHA1 055981e20fa58a22a86259f341afdda208cfc52f
- SHA512 97f91212f0baae55948d6d45e1b1d9f7cb98c1d01b92ab8c11aa85f760ed98b8a309de8535278a1d80662308257497ed05e14863119a2d7593279abbb1e47c30
- TLSH
  T196F0529BF0A194B00766212A9E4F630FF5260A7B265E5C40F033C8A02C7CE7ED06EA84
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  all-in-one-wp-migration-unlimited-extension/lib/view/assets/javascript/pro-uploader.min.js
- Size 45KB
- SHA256 0d25488b38c0f4b1e9b21ce31544c53589981f9c3f1c9407c96d6e4ee3983ca4
- MD5 e991a09cd2fa1e9d1d5ecff1e6df8de2
- SHA1 aed6afc791105a5031607dca8f941958ae5d6b3c
- SHA512 c76e4e45afe3ed6c59b39901d641e93c42270e57959a27cf1e9bcb0349f46de0ced426f6dbec43a4f5d8bf5504c549080786333b27ecba93ced275c6d5d4b1a1
- SSDEEP 768:NyGIUrgFuOcgnNDLGrScTahwdEtEj1bhuRA7/GMQrT0IP:NyGvMFut6DgL+ss67/e
- TLSH
  T1E8238389FFD1B4B51363B570816F5A0AA2B72A54B40E88E0E266D5C1DC7C58E4137F7C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  all-in-one-wp-migration-unlimited-extension/lib/view/assets/javascript/reset-tools.min.js
- Size 150KB
- SHA256 ff86f3687d512f60ecafc81ae81a770d0db1689c24eac89972e02444d2643728
- MD5 616a81b76cd5b0a7067ee562b4778c25
- SHA1 d4aa05f10caf69118a6b567be0821f41d971e578
- SHA512 52e08b674b0ba2b76f90688b45574701dea5d3eccb6b70e49d81345a3b6405acd8f7f243b16435fd8ca90b62ffa6827e2cec81db1acf7cd2fc1c5ac81a89740a
- SSDEEP 1536:A9c4MLYOtyOUFi4gnfqBD6k0pyxU7k86YGrMYkqF6OBVCcFrKm+eTH:8czLY+42kgyxJ86YGrrZF6OBVCq+k
- TLSH
  T19DE31899B2C2B4B217EB24E1017F150AF27A2945780BC4D4F278F8D66C7644E90ABF7D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  all-in-one-wp-migration-unlimited-extension/lib/view/assets/javascript/reset.min.js
- Size 135KB
- SHA256 b9b413a97f786b35473b925b495389d8df29b661f30c3c784fc2bf5e92f0a157
- MD5 88f3f1bad3ba109a02f5791ccc599ccf
- SHA1 c8a475c5697f498ce51c2dceb82a3bd81aeab1f4
- SHA512 233c7c2002ee3c830729b2c8de6823afa013d33d55176edb728600d1fc90426dc60a7648ffb8ff9131b7cded073afd8064c97ea2d0ac627f05d7335817399687
- SSDEEP 1536:PDjKaOBupMUhs4qn8XGpGGo9ztSvciSecYiN6WOqb9O3VMUpib:XKaG742GGA5KciSecYiMcb9O3VMMi
- TLSH
  T16ED307ADB2D5B4B213EB24E101BF050AF2762945740BC4D0F268E8D76D7A44E90ABF7D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Command and Scripting Interpreter: PowerShell

Command and Scripting Interpreter: PowerShell

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32