69ca6d56385c43d0790edafac0353f0f8e5512cae3b5fba3f182f62ff30d7185

Sharing

Copy URL Twitter E-mail

General

Target
wordpress-6.1.1-fa_IR.zip
Size 24.1MB
Sample260813-gz96jatdja
SHA256 69ca6d56385c43d0790edafac0353f0f8e5512cae3b5fba3f182f62ff30d7185
MD5 4c7d84cc30788d32668e76fa1ba481df
SHA1 7455458fe578ee72a2c6bebd7f23ba3cfd22f26d
SHA512 6ca0faca9c66779fb22a6bd67ff1f9668ec216e805838cb551c8845f17e257df706bd1f940c754efb8b47d97e006561b0ce9f8ef7cabdbce4d1a1e99bf120372
SSDEEP 393216:3TVFmhU/S1q1ClNcqJjF1WJo9Nq4+L+jN7B+PL2SNbku39DuxdhjwtAZZZAYHE:DOV1aqNcFofqrL+jj+PJNbkCD6go7HE
TLSH
T127472375EE2E0E40C6FD4E7088ADD200E4AE9132E14B995BBB3555409B6C5AC3E3F74B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Language

Source

URLs

exe.dropper
http://api.wordpress.org/plugins/info/1.2/

Targets

- Target
  wordpress/readme.html
- Size 14KB
- SHA256 a1da3c700025b075a0a9691a5cb962cea1f182c5a81c8342ba83658b5e7bd997
- MD5 466d58f11e1942aaf385124264eaaf29
- SHA1 1e7b614e7c49cf104421bb7ab5be284451acca17
- SHA512 b1b47b69833b950fa035c6f39e3e8b210b52135b34c09c2c6bdeda6530690d76dbd513148291c1e69732b07c0d51bd451c337f741feb741457145e101f063863
- SSDEEP 384:SM6Rhy1bWnzsnAVHMrXQ2S3llVQFGr7EQfMfG:SJ8bWzsnAVsDRS1LQFGbfMO
- TLSH
  T15452F3C95DA86B735751C61390F23434C373BF52D288EE40A9620B27A9A5713AF4F63B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  wordpress/wp-admin/admin-header.php
- Size 8KB
- SHA256 7edf2bd80117c1cbda7ec2d0dd8850c68a2ed4634286404afef202a832e370ff
- MD5 6cf9030deced5093707fb0ed5f135aca
- SHA1 12d23dda690e9ea73d31286d0ef83f8d8fc879d5
- SHA512 7ea967fbe847fcab5e3fb207b94ab104673510fbf2670641b2b31bcac9a799fd9b8a7b3aa137bd848ecb6add3e606f193573a23e9d3ea6e73e0c0087c5c3699e
- SSDEEP 192:h/H43xQB/m4TxUIddqqQsY65ifPyWoAXZPXt/VC46q:943xQB/myyYd5iD/VCXq
- TLSH
  T1B70266451CF2673388A22DD166D1D278762B410BB3D52855BCF941F89B4136C8DFAFC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  wordpress/wp-admin/async-upload.php
- Size 4KB
- SHA256 7dfab663df16c2d8d25834b7368b9632001abcfe6662478e6205a7cc5614d739
- MD5 f051354b8265bfc5b95c542372ea8a00
- SHA1 fc73711b93b0255b263f031d85a52f664ebb00c2
- SHA512 e686eace9c55e5825751e0d04d86d3e60e191b011f4cd7e76ff60cba709744eafc616fa828b3e9a5eb0847389f7454b656d739e2ec2b81e6c68c27dc312365f8
- SSDEEP 96:tKikv2f2NpGSrpPaxACeP8M4RoOqg754Vo6vngDnVovMmDhscCJgjE0ZDW9QgM:t7Vf2gx4P8HCil+f+QE0ZD9
- TLSH
  T1BFA175F1A2EC6766513371C45609842C649DCC37F490AC99BC2EE0E0D680D6EF4FAEA7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  wordpress/wp-admin/edit-form-advanced.php
- Size 28KB
- SHA256 b742485a17092669fabf964ef8db5948c622903521ba6be326fc1a188a6e7985
- MD5 92bb809b84825f9965b64902ab9e6a1d
- SHA1 68bfb0cdf6e9d3a3be5fb1658a2f8b9d65f1aac4
- SHA512 66df16226e8aff381ea210bcfe48e4d00bb32bce23bc4fdff294794664a4e0fb73e5f1b61f6a7f260568423831787d44e377997214c6cda943a99b625523d23c
- SSDEEP 768:D9VrD7o8wo5ufsX3EfqKb1Scvu568gIL+t2Oa6QEmbWZnSjmB:xVrD71wogf83Efq61Scz8gIL+t2Oa6Q4
- TLSH
  T16AD20956F1F4236159131682F8C4927CEEBD8455338158EAECBE94ECF7832724639FA8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  wordpress/wp-admin/edit-form-blocks.php
- Size 10KB
- SHA256 2d6a57af16c2e90ecd008ae8b51f71b7eceef98d6ed4a106ae88d93e1bc2206a
- MD5 a36d2cf1dc4513904f12c8dc3a959def
- SHA1 72c7be38798ac8d69c5d10020471c4af7bc90c89
- SHA512 02aeee52ddad391c9ad779d805fbf5698d2277d231349e4a1612476a6090cb8091a26f310350ad3c9340ddf5f5a90b9c0b6710decb1bf28c14e93c78a02b59ff
- SSDEEP 192:M0DKaZp9AVx+2BjZH3f3DO8MaGbJF+lx23nU2A+:rKaZp9AVxPDO8AOKnO+
- TLSH
  T19A321A07A4BCA37940622695DC1CC5BDAC3509867741A0E1F9FEDD885B471E68730FF5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  wordpress/wp-admin/edit-form-comment.php
- Size 8KB
- SHA256 bd1f846a5b0efd94124e4197881e16728ba10715589a5deab11ab014b12f065f
- MD5 751325a85ed09a60c01633165d40453f
- SHA1 0b3b9c86bb9fc6f9b704b819697559a65b049069
- SHA512 0b9079116b12187baa7c0123027bf0f0bda1e6356d659a66ae8a8f0873fe4a42826583a722d82318844d35228c9219ca3582746920019f6efca944b4dd1bab9d
- SSDEEP 192:TosxqDLsvTQ/fuBkvalbNBNRjmyV9p/4it+oW0MLexXLtkYyPyVKL:TosxqDLqTQ/fIkylHjHtjW08rPyc
- TLSH
  T1CB027583A0D44771C0E33CD16D9866B979C48709E2492C9CAABD84D86F50FF56D36BDC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  wordpress/wp-admin/edit-tag-form.php
- Size 10KB
- SHA256 1b842e7e8e3841c4976aed04c51465bf2be291efe9f4b043c4913883a8ad74b9
- MD5 5209d1229b274fb900b265e5b8da8dab
- SHA1 97c7058f13da9357cbdf1d78b59db6b9e00104c2
- SHA512 bc73627e54139c9d4c34372da70a75ad343907726df262c78090524554f3b756631b8d2d9bb226c3c84c88e54b7bcd0575f4cf67327b8eb0e6f1d2e4b57d7a83
- SSDEEP 96:T4qPBwi8wvRzkg+VaE2azn47Nve21Jiysa/xdT+g7KA5HK3EIx7a558ZF8C9q+iM:sqZnkbzn47kyBzJqVRaw91YI
- TLSH
  T1F12284F769ACA63054530EC03DD277493FBDDE1976010CA5FA4FD8989721AE2492BE40
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  wordpress/wp-admin/edit-tags.php
- Size 21KB
- SHA256 f1fa0e24f1f652c28873d8fc8cabb067d32e135eb89ed263b84f7dd2dd905eda
- MD5 418d0b6d540e4bc183e5818f0410556f
- SHA1 508aef5f1e9a4aea15eb7e68c707caa64d06d433
- SHA512 27e748219a8551a81ae017a1f8a08d4996231dc1e18d364c620482f28e806097a6e6c043a16b80b20d985d4e3a8413de29beaf896c799cfd802182967ea5f105
- SSDEEP 384:KQifr45FN3CfXgsqMcrxgrZU46rPhkaLrANi8:KQ7bU1qMcrxgr2VLrAQ8
- TLSH
  T132A2E7EAAA9C517013131EC0BDD8F35A7E7CC92472411CFA799CC458FB506A64B3AF84
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  wordpress/wp-admin/export.php
- Size 10KB
- SHA256 9f8f19af847f17b165460e37dd3bf2d045a671ea6951d29d3807598a79d5720e
- MD5 c9c1722aa5758cae1a5e60531f3b56a4
- SHA1 45171eb1b5391ca639d09807655962e6932c01e6
- SHA512 1031f1c8bd0cc35b2f244f375edda31a8eac56dde11234c0accee1e647119b0556ae3186d8cd63f9fb34ad69f1b148bcaef1b61cd2f9c5b9ffe36463edc99723
- SSDEEP 192:f2I9QVgBMvCqjyoZgHLnvhhwzkeBs31B8ToFriOGHXspIEm/F0R:eqQVgCv4o8hhJMoBZg2md0R
- TLSH
  T1A43285A3F5E84B31849B28D916A496F12BEC890590412CC6F41D46ECA7D1D6DCC3FEFA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  wordpress/wp-admin/images/about-header-about.svg
- Size 3KB
- SHA256 ead2462b6a594a5de4234f9e63738dc2ffc22d20ec70e81c8990acd5b46f7fbc
- MD5 014ea791c9b2f3ec8221436695ce8e86
- SHA1 f33ef3868bf0c05615408c47885f415de7a7be9f
- SHA512 82400d983fbc47d6cd55988a95491105ce0b5f907fcad5a0fbbcf74ffee3daee71dda4d479e43ae4ac2d0a0286804b9154c43231fd3c8d5dd7d93aead3171063
- TLSH
  T14181D66430ACF91CA33DC5ED9177B3EEA1DBA0CF475BA360C4944D8659DA07234862FA
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral19 behavioral20
- Target
  wordpress/wp-admin/images/about-header-credits.svg
- Size 7KB
- SHA256 b16807556a3db3605e8d1e1f207e78bebcb7fcde2a406a8778babae9f4ed24b5
- MD5 afa30fe754c114dd6f14bb2c155a6cb5
- SHA1 448eb365a6ad028b83f078ba23dbf46b40f942e2
- SHA512 78301e4a5bd65b871c933305eabead96c6659f24fd101174f390b54b96b0415fb4dabca007789cad8193c66bf3fbca1ac4b9483654b4f3da422580ccaf48aadf
- SSDEEP 192:oAQXnKGifcjF4NXnpus8nqWcimG1r67RXDUBXWNArwX7:oyhcjF4r05cimF7BUBUo0
- TLSH
  T126E13FC8DFB8A374E44A5BFF5B5E1CE436E155ED1C1889BCC28D068091A9B2EFE544C2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral21 behavioral22
- Target
  wordpress/wp-admin/images/about-header-freedoms.svg
- Size 8KB
- SHA256 a334930bf68f359e41440026ffb06a6cdc38f83f99ea8988386b15d08efe1724
- MD5 9c78795c53e13281a8b5ad636c6dc008
- SHA1 5114e70d9576fb059ddce5f1856920cf36f27e10
- SHA512 515bb17468a0c57f350f0d48aca6d680cd4f2ace657770fc79d1a675421e3b658ff92807c58826fa239fb4ca62b3793673ce16aec69685faf10cd3f83093e3b4
- SSDEEP 48:fQs0DXQpb4IUXQpUNDbU+qH2CsoXQpgkI4UXQpF6tTbUlmEGSYl6hBQpwv6hY6hh:YszL2xUeWCWF0K3kvgfDPXjsi
- TLSH
  T18C022E88CA743B1921693A94868C8BB43F62B1F0AFDD648DD0DE6F0443C75ABD974D83
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral23 behavioral24
- Target
  wordpress/wp-admin/images/about-header-privacy.svg
- Size 12KB
- SHA256 5fcca16048c475305dc17d971f8d7dba441b0ee4b47dd8ebcd8498fc37a00fc5
- MD5 efb26a7a22a8af710ceade16b094ec03
- SHA1 2c1040e3d6057da298db3c48ef2a15c0f4321219
- SHA512 c63dd1f07664d6475ab4a9bde2687a87ea37d526a62a8b096e478150dcad37d6afeb5296028e4a94f32894cd6bf6c3fe0d4459ff807e1001003f5b20952521b1
- SSDEEP 384:xQBWYyRb1kDDPh5AgyaTlp8d/crtqnUpiE4IgioprY979+NC7UVpcwd:kWd
- TLSH
  T185428083A2381338B3C7177E314855EC24289D9F7F9EC1687676356BA1E2B991D38F42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral25 behavioral26
- Target
  wordpress/wp-admin/images/freedom-1.svg
- Size 1KB
- SHA256 c641e751bcfb5d44aa4609d9f94c3aa9297f1baf564196b292aff3ee4e90ff72
- MD5 0b28aa39660dddc94f4a1aa117a75db2
- SHA1 ca822ca083e29e2ff15e9be4b50b80ab31a8e2a6
- SHA512 6d6918b9d5a73db24593380dd228093ea5444d631598e73a4418f48db0c3c891b8b12ce6bc693d6ab9cd34eb8e27ad95c496adf34cfa21a4b434be47812abef2
- TLSH
  T12A319AA592BCFD2AD6A1C1EC532BF1E0306E20285356A75859305F3F696A4B33409BB6
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral27 behavioral28
- Target
  wordpress/wp-admin/images/freedom-2.svg
- Size 7KB
- SHA256 59e2923003e08c636372d0a073fa51a7ec5be56e27a7e8456a98f1c65aad5eaf
- MD5 eccb22be2030bf67eb8c483e0389a044
- SHA1 d79e8a8f9d38db79520d395e203e4b0cf63d5eeb
- SHA512 16b170565e575e757778119c1318b48a63d80efb1d7771a4c5d8d12dba89af897111941abaa375570a41ad19ce0470446d99c778db0f5b0f442d14fa35c118fd
- SSDEEP 96:gJMZYjh0aRb/lo2t6xDymli9OYr0cY5lgBGOLbuGoKGQzwruihb55C:gV90aRbBQxDy9OYgcKlgB2equGHC
- TLSH
  T16BF1CBCCA72C81BCBD425FEE632A6410223E79BC31310D746DDD59A0A6E2E1DEE364C1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral29 behavioral30
- Target
  wordpress/wp-admin/images/freedom-3.svg
- Size 1KB
- SHA256 bbe2f5a3f339f85b802cb480da9f29bfad3e8643ec5f241c7612231f6ae42e63
- MD5 96e028c3e7b8ab1a58bc86d69afd316c
- SHA1 8e4fa86147b60ad8ca1a5a432a81b1122a9217e8
- SHA512 1e2e33cb236ac4f3bb095db3b07549d0cc9461452bfcb480a1933fe8629c86b3015b0149efe7ad7330e5eed9c2bf6a27d9219e22d3bbe6af1c40d0a224f3fe41
- TLSH
  T1713138A581FDFD29D761C2EC936BF0F030AF11394342A70859205E7F68262B73459EA2
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32