b913a0c603b197077687e8c288e645d781a9e1fd51e8b84181d8bc22fa2e7bdf

Sharing

Copy URL Twitter E-mail

General

Target
menu.zip
Size 18.9MB
Sample260814-prdrcstxdz
SHA256 b913a0c603b197077687e8c288e645d781a9e1fd51e8b84181d8bc22fa2e7bdf
MD5 14bf07cb86ef180eb71a63ff28bcb4cc
SHA1 edd3839ed07ecdadaca6340aca7f68104712e2a1
SHA512 a73c197fd0dc04cc3e362a361941c03f5b31b12dc2e3845d3f39c60192d3c0d805ff6631e15098706b265a1fafb39364fd3415eb6af874beb5de3ea674f207f1
SSDEEP 393216:dE7pJgYIVUTpBnN0WjvO5Z+Ems2ODPUMeXZFaQteIv97nPRt:u7oYIIpBnrjmrmsTPqJFakd7nPr
TLSH
T1E81723B4D27C05E0D58E87378C6E4257C09FC20653117ADAA9B84358FA9E4C92A7F78F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Language

Source

URLs

exe.dropper
http://api.wordpress.org/plugins/info/1.2/

Targets

- Target
  liesmich.html
- Size 8KB
- SHA256 349897b22cd043d3512b3d628cb287337aef1a248e548433acb995b48b0a0fe0
- MD5 618ea35fd4e46585d19ba25e973d20e0
- SHA1 21fbd17c64344902ef52811a3bb04e469cf855b6
- SHA512 78134fc0edfa09ed5a05c4b8d73aca3ac0015df465894caebc29c0c5a9bd4271deee2e06c01cea07f12d7da18c98cf53f1bd9c6a4571b73bba52703c8d9b2031
- SSDEEP 96:PXcymUYkrqH4dojNFqsE7ui+Wb7LM/thTKvOCXlHoumrt9TxtPXiLuIiWXkZlq/w:PX9Ykrm3QfvLARAnU1qCQFXwuYdl
- TLSH
  T15C02B673F4C6532A9741F36571002D3E7236E1FFA38D171A40DBD2276A866F08EAD19A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  menu/slide-menu.ie.js
- Size 30KB
- SHA256 658514a062bc25c23a72755a065452c84fb4aa4fecdf00f5540c2e3bec394626
- MD5 9dea6f6359ee1609034246775c70c75d
- SHA1 bd1056764d1c2cc48842e06cf71903dc0c5d9602
- SHA512 b82da3b0196477b39b70130712afc3a3778800ed4a05d3a0f9a26f8d7023035b3134a3cff02f6d98407340ab455a5d6d2ce950dbb75f5a284c0d82b43aa809ed
- SSDEEP 768:8Ts/ro/TfMLHRToA/jFhnmO5fCb66JxhBsW0+:8Y9mQUz2Qp
- TLSH
  T138E29589F69570F143EB60F8016F860FF2B69855B08AC5C1E266E9D1AC7D88E5063F7C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  menu/slide-menu.js
- Size 17KB
- SHA256 6eb0998bc0813a2665c9e771fa4d94cdde5111e31dc097ee22e927e786efee54
- MD5 0705d382ade69b14fdcf47168854a71f
- SHA1 a3d0bb39c5e8e6c1100aa0ca8cb90adb162d42c8
- SHA512 cb74b67a0c69ef2bc252fbf78eb8fcd38f78b541ed5dc5c006bfb9f8c81c976953f8bd7f41744bf717f3808fd844df5ea64648ad9c9daf7abc8a756987428540
- SSDEEP 384:8kuLpH9mOTDPhxJwa40bNAzJKku2//8eyia8YmG/CedFy0DoYud4yfU7SZp7oT4C:8kcxJ2oNAzJKkf//85ijYmGqedk0Dods
- TLSH
  T19372A6CAB29574B103FB50BD016F870EF2769895708A88C4F666E9D5AC788CE5063F7C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  readme.html
- Size 7KB
- SHA256 9cfb57e8855c2c72998c724d512914dcabd04aa7e7b38a23bd70a2e657bfaae8
- MD5 bb5d8bd5e5cbf6e788df2b613656e61c
- SHA1 3d0694d6cccd12395ddf567009ec3dd762759b1c
- SHA512 a149cb7f7dae4d7e410e7d2f0435fdd6f4cb7ea953bb619347bfd8e51e6c4f7168adff09eb3de9a7f2fd0ee432095d35218b83b40780ff9183887379cc97d5c0
- SSDEEP 96:4UK8pz1E/4kF5kyJ0ifN8uueKQetcU4wtcwTKuID9kKCZxjD+9+25tdLwGg1IZzj:68/SVPmuF3C/Da7d0euCidI
- TLSH
  T131E1856BB540537A135143B1600621BEB33300BEB79D4646549BE62EBBA23B4AF7F0DD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  wp-admin/admin-header.php
- Size 8KB
- SHA256 e0328ca96981b646f8616b7571fea5997070e66948855abf88c751b6cc83e19b
- MD5 0a5784e5a6ecc175fddef9594b96c7f9
- SHA1 ffe30cf6ba19729c853dda8a0807efdc81538b0b
- SHA512 5afac0987a2be56aab255bc4f413530d34784243248c5384a723ccb945c0b3e36079cdb92830200e32808a0d8e812ee4821dbfe69547bda7c2c8f51f06b321b6
- SSDEEP 192:h/H43xQB/m4TxU4ddqqQsY65ifPyWoAXZPXtSoVC46q:943xQB/mKyYd5iDSoVCXq
- TLSH
  T1EA1255452DF2672388A22DD166D1D278762B420BB3D52855BCF941F89B4136C8EFAFC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  wp-admin/async-upload.php
- Size 4KB
- SHA256 7dfab663df16c2d8d25834b7368b9632001abcfe6662478e6205a7cc5614d739
- MD5 f051354b8265bfc5b95c542372ea8a00
- SHA1 fc73711b93b0255b263f031d85a52f664ebb00c2
- SHA512 e686eace9c55e5825751e0d04d86d3e60e191b011f4cd7e76ff60cba709744eafc616fa828b3e9a5eb0847389f7454b656d739e2ec2b81e6c68c27dc312365f8
- SSDEEP 96:tKikv2f2NpGSrpPaxACeP8M4RoOqg754Vo6vngDnVovMmDhscCJgjE0ZDW9QgM:t7Vf2gx4P8HCil+f+QE0ZD9
- TLSH
  T1BFA175F1A2EC6766513371C45609842C649DCC37F490AC99BC2EE0E0D680D6EF4FAEA7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  wp-admin/edit-form-advanced.php
- Size 28KB
- SHA256 2ccc534f00501e630149b75560d7859a9d3e91e222bd72575831dbb3e68546d5
- MD5 587d688ef00a2b4650b87553561aaab9
- SHA1 c3f96e41edf22d938402e5771e302f070d3b5f95
- SHA512 90d2ddcd70655cc4c4961ff85b5bd184beb842effcea65b017c70f8b7781c82e9191a5b39215be41adcadb5854ce7a87018596e34527b7f2004c36293016b54a
- SSDEEP 768:D9VrD7o895VXfsX3EeqKb1Scvu568gIL+t2Oa6QEmbWZnSjmB:xVrD7195Zf83Eeq61Scz8gIL+t2Oa6Q4
- TLSH
  T17CD21856F1F4136159131682F8C4927CEEBD8455338158EAECBE94ECB7C3272463AFA8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  wp-admin/edit-form-blocks.php
- Size 10KB
- SHA256 4412cbcc34366092041539be0105612f942a42b8c56b76449041cfae14d209d7
- MD5 9fb84c959dc2ebd6ba40f4df1441aebb
- SHA1 d1f9b4c751111321556f9f36a4fc990a3d999cc8
- SHA512 b568353ecfae293cfbc61ec4f467f8440f275a6bd0be82ea156f917124339f4f79d077f554204ff8b4ad9840792f3bfb7611d08bbcd6bedbb0e5ca093d2e20e8
- SSDEEP 192:M0DKaZp9AVx+2BjZH3f3DOBaGbJF+0x23nk2A+:rKaZp9AVxPDOFrKne+
- TLSH
  T151321A07A4BCA37940222695DC1CC5BDAC31098A3741A0E1F9FEDD885B4B1D68B30FF6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  wp-admin/edit-form-comment.php
- Size 8KB
- SHA256 b994079a3e1cbdb637866dc7f22f9c1c645f4186633ea91822bde117e9b78e3a
- MD5 05a28a3e49baaa396a40730b08e76ff9
- SHA1 f30c37b3481833953d5ed7647930bb879fcfde8a
- SHA512 625402537ace95e3d1fe167009e47d3b60ee0c8db8eb16e06ab9e7c49f625678f879a66e898b1759a811167a0e0441929313a6ad680e50e3ed4d8031e1b6bfaa
- SSDEEP 192:TosxqDLyvTQ/fuBU/albNBNRj8yV9p/4iCtoW0MLexXLtkYyPyVKL:TosxqDLsTQ/fIUilHjBCSW08rPyc
- TLSH
  T17D02769390E44721C0A33CD12D9867B939C88709E2491C8CAABCC5D86F50FA66D36B9D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  wp-admin/edit-tag-form.php
- Size 10KB
- SHA256 1b842e7e8e3841c4976aed04c51465bf2be291efe9f4b043c4913883a8ad74b9
- MD5 5209d1229b274fb900b265e5b8da8dab
- SHA1 97c7058f13da9357cbdf1d78b59db6b9e00104c2
- SHA512 bc73627e54139c9d4c34372da70a75ad343907726df262c78090524554f3b756631b8d2d9bb226c3c84c88e54b7bcd0575f4cf67327b8eb0e6f1d2e4b57d7a83
- SSDEEP 96:T4qPBwi8wvRzkg+VaE2azn47Nve21Jiysa/xdT+g7KA5HK3EIx7a558ZF8C9q+iM:sqZnkbzn47kyBzJqVRaw91YI
- TLSH
  T1F12284F769ACA63054530EC03DD277493FBDDE1976010CA5FA4FD8989721AE2492BE40
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  wp-admin/edit-tags.php
- Size 21KB
- SHA256 65c6a6838612191ee6cdb66f2a2872a07e6ac79e7b7d904fac8e3cd1adf6ded1
- MD5 b357ecc6a9ef40bbed68de561cdd03ba
- SHA1 1924ce50caac66b744156bf9c874fd8cb676d98d
- SHA512 29f585723d30bf78947c2c24f03e79695acad65c97300d4603dc2a63eb9275678a97802484236cf901e33450b365a50348950e0a892d789b5a56e72b0128aab6
- SSDEEP 384:KQifr45FN3CfXgsqlcrxgrZU46rPhkaLrANi8:KQ7bU1qlcrxgr2VLrAQ8
- TLSH
  T14AA2F7EAAA9C527013131E80BDD8F35A7E7CC92472411CFA799CD458FB506A64B3AF84
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  wp-admin/export.php
- Size 10KB
- SHA256 274f67f5c95da37f3d494beb3804c2fc759b915c7d469a1c03c9197b31dd4c14
- MD5 a2df7275a1e59ec88efc821ec9ee9a29
- SHA1 42e138a371feb26204f8a6bdc8fdb18d7f6a248d
- SHA512 51ed1c70dcf0256568600ab980ed899095c5bb1789dfd34f7da644f0c313c5d9f2f5491b7ddd6014b6cf6e1d7d82501ac45668d42ce5e6ab1afb525e6d15bd30
- SSDEEP 192:f2I9QVgBMvCqjyjNgBLnvhhIzkeBs3QB8ToFriOG1XspIEm/P0R:eqQVgCv4j8hhxM3BZg4m30R
- TLSH
  T1F63286A3F5E84B31849B28D416A497F13BEC890591016CC6F81D46ECA7D1D6D8C3FEEA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  wp-admin/images/about-header-about.svg
- Size 3KB
- SHA256 e2b1a872cb80ed9e8723a6ce69bf42208f65eb11671d2aa75b01cd6eea795019
- MD5 f44b3fe36309c257aca49237daf64675
- SHA1 e9767b9b073a885b62835cac0bee0c0db3ea5b97
- SHA512 f05ce8ae8b077e4c40acdb19aebf590853ee1a3ce8a0571a1e7b8402a634585d4b4a197af1ee63dd80e86da62cda39face400a280943575682efa2fcc1ac06ee
- TLSH
  T12551AF69E30C9E77E66AC3ECEC82B025219B129775C4C38AA575DF2F9464C830C5E7E4
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral25 behavioral26
- Target
  wp-admin/images/about-header-contribute.svg
- Size 2KB
- SHA256 5072438a4daf4a3c496714f2e4e28aa3154888840b0f02547b82f51a5b8e726c
- MD5 72bf83f83b2aae398dfc5e2a892a16ba
- SHA1 1dda9d8f6bae624ba48ac4f277432e702c59539e
- SHA512 11b5f01498e1622428c3785292b5dcf358655499e84c2e1830a77a08f244430ef8e9e4dd0741380c0133c14dc95814decb5a090c372af1bca08791e9c23157f1
- TLSH
  T1B4418825F30DD837E22EC19CDFCBA414524A92A742C5629AE0E8DF6FE6349D3081E795
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral27 behavioral28
- Target
  wp-admin/images/about-header-credits.svg
- Size 2KB
- SHA256 80529fc32f1a94c34ffb32e5e4158ffd99c4f5c717fd4111cdf2aeca93004083
- MD5 d11ad7517565b9c5d4cdd7a4d19055c6
- SHA1 c00f74e89edfd63b497a99cd01b8cdf840520102
- SHA512 222540fa8062844cc86b19574f2876c1a61d128d678db0ed623002ca258076b12497f963ddf2b24ef3c117430e2b21d864688317485aa0db3a8f36a4feb50e50
- TLSH
  T17441BB29E61DDC37E229C3DCEE82F014224B12A785C58289E494DF1F9528ED30D0F76A
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral29 behavioral30
- Target
  wp-admin/images/about-header-freedoms.svg
- Size 3KB
- SHA256 34c0a531b187b12207932a8ef6fe66ae1ccd93d2c84ac986e06c406c154c979e
- MD5 ea7b05ecdf3261f34c123960fb8b66fa
- SHA1 310683e6dd9d284b4ffa2696005c29d105db0bce
- SHA512 53ba4a470eddfb2271cfbbde3b55078cc5490de7892c9387a80e1ab1e5023544790e1149ae261f287764eecf0d4776ca31edf822f36abe40046eee51ccbec655
- TLSH
  T184613065F30D9957E3BBCB8CDE45F864820F24BB364286C8D4B9E73A0C68F5A8C1E455
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32