a163fe8d0d3d89ce00139ca0e0618e109bb7441fae2f733cff6c72fc4d170fb9

Sharing

Copy URL Twitter E-mail

General

Target
latest.zip
Size 27.2MB
Sample260816-g1jd7sel41
SHA256 a163fe8d0d3d89ce00139ca0e0618e109bb7441fae2f733cff6c72fc4d170fb9
MD5 3a634e2e5d90c6d75e91cccf8cefb126
SHA1 b676fb6744910d58180fd58597cc09bb2c5d4a2a
SHA512 ce6581110c9ca04040c8ef4fabb8de0a2563d57751d5ea0db2c33bdef469df6526046a78dea62ff263d68de575a6468ace2fd8b6d10dd89ae33140e818906e6c
SSDEEP 786432:2kcFdUKzzJYE97JKeL4qT1jTfAblQ89r0QAocVDeybyJM:2k2dvzOE97JpU+QZ9rMJLbyJM
TLSH
T1BA572372E63F0A50C69647B48DE5A151F42CA123F60F629BD77D69C4AB684EC3F13A03
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Language

Source

URLs

exe.dropper
http://api.wordpress.org/plugins/info/1.2/

Targets

- Target
  wordpress/readme.html
- Size 7KB
- SHA256 943dab096faccd1bebc64f0fdb0bbb066eb38ffac46261fa154b587b2e71026b
- MD5 2ce2a1951e29c969de54e24634e11396
- SHA1 bd712c6fd62d4a03bb8933729d614d4c715d4aa9
- SHA512 6e6c2996e3bbfae17a3af48049bf360e738b2b960fabf8e13b1692995d19484458c736d3c234a4075857cf774b0ec45658453160a6bd644cd9abb8439db25e30
- SSDEEP 96:CQUK8pz1E/4kF5kyJ0ifN8uueKQMdc8FdcwYKuID9kKCZxjD+9+25tdLwGg1IZzU:n8/SVPmuQ3C/Da7d0JuCidI
- TLSH
  T18DE1A56BB5405376135143B1600621BA733300BEB79D464694DBE62EBBA23B4AF7F0DE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  wordpress/wp-admin/admin-header.php
- Size 9KB
- SHA256 014f8a8852336101ea3b33debd43ac7e2521d1ca55106da7652c81cf2d8f3e2b
- MD5 4a1d8133e129d6c4c2e242c7e7474345
- SHA1 59306fe44b19602680fcd439ca1ac7a20060cda6
- SHA512 d1e2212d33b674f6ea92c41e304fdef7a8197bcf2d49cbcf9ea8da21b992f567f1909dc498b6608780c2eb8452b5dcda8a59c31b7ac1c7dffe6ad08bfe11aeb4
- SSDEEP 192:O/HW3xQB/m4TxU4ddqqQsY65ifPAWoAXZPXtSoVC46q:UW3xQB/mKyYd5iBSoVCXq
- TLSH
  T1B71265441CF2672388A22EC166D5D27C722B410BB3952995BCF941F89B4136C8EFAFC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  wordpress/wp-admin/async-upload.php
- Size 4KB
- SHA256 44b9c4b4b869526c2c5dc9d98ef35b3afe3e2d3110f2ed6f9d82d55455bea832
- MD5 4ae55eb85efc67cacd472096b1b87950
- SHA1 dca06dc6ad3c1501da8b400d27fca5e174085928
- SHA512 95fc0936f434ffe94d654a447bfa5a1e592c6099e5c124f0b2d0e67f42be6fad8ca113ac1fc05298091369cb1d12d7f934a29d3809eaa553e9fec42ab2af67de
- SSDEEP 96:tKikm92NpGSrpPaxACpU4gr4M+sgaOE4Vo6vngDnVovMmDhscCE2ReQLZDGVlv18:t7/92gx76shHaOg+flonLZDGy
- TLSH
  T1D1A175F5A2AC6769512370C5564D842C749DC836F0806C89BC6EE0E0D784D7EF4FAEA7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  wordpress/wp-admin/edit-form-advanced.php
- Size 28KB
- SHA256 ef75741532d1b29a664fd7e279bda90061752fcfe41d9a72956faffa4fb8c88a
- MD5 9da48e8a83f6fc5eaea7dc152344501e
- SHA1 210f97d25157a0e7c556ace2515bfd0e36eb844b
- SHA512 c65078dd8a9537060f7987e2b47eee7a5ef2ecba6f1f5c28193eaada0212cd86e42f3371d7ad5f39fa72258762742e2d74495b95bd0940fc72053dd0a8c09f59
- SSDEEP 768:q9VrD7iE75VXfsX3EiqKb1SceoC0Dm8gIL+t2Oa6QEmNWZSOmB:0VrD7X75Zf83Eiq61ScpC0Dm8gIL+t21
- TLSH
  T174D2F956F1F8126159131682F8C8927CEEBD8055738168EAFCBE54ECB7C32724539FA8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  wordpress/wp-admin/edit-form-blocks.php
- Size 14KB
- SHA256 1e0de4d35d0149a7f24a8c24c74ad639c09fdd18f40597505b9597db62490870
- MD5 de8c0c30d8c95e0f3bd4a345c65fc8db
- SHA1 1679f415867a8dadcd9f9bfe850a8189261e6c9b
- SHA512 870076a72bb530961d3e328122207c480f8724e413a3af28d33a287136f6845e804e3170c1ee742e88bd913536b0426a7656411058434107ec2faaf6c38ebe50
- SSDEEP 192:70DKx7ArZr4Z/PoVuaKcVVlIqEqgtIy+2d2QZH3f3DOBaGbJF+0x23MN259UDqTk:4K5ArZr4Z/Q8cVRQxPDOFrKMeoqTk
- TLSH
  T17C622817A4BCA37A4073369ADC1C81F9ED650485730264E1F8FDCD88674B2D98635FE2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  wordpress/wp-admin/edit-form-comment.php
- Size 8KB
- SHA256 2b2688f5627a87a020cd622a4577a96d34d9f492700412e7915f7fb457b4b9e6
- MD5 07297b9520c636513839b377e0a4d22f
- SHA1 407556eda5e1accbe00ac4db079b56227ccc88ad
- SHA512 44eb1b314633525be6d80b3db6f4d7c1603c5bb9fc40edb56c5d192f6a104f2b2759497e8d3865e5894442a040c139495dbda6e6de1c9bad80a91631453f22a5
- SSDEEP 192:TosxqDLyvTQ/EBU/albNBNRj8yV9p/4iCtoW0MLexXLtkYyPyVKL:TosxqDLsTQ/yUilHjBCSW08rPyc
- TLSH
  T1B602769390E44721C0A33CD12D9867B939C88709E2491C8CAABCC5D86F50FA66D36B9D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  wordpress/wp-admin/edit-tag-form.php
- Size 10KB
- SHA256 98d778683bc93d97c245550d6181f0cd28abd9db959366e6ad52e6b4696b7da6
- MD5 d3d41392ebb0872f012e0e57230ac120
- SHA1 7831cf4ac0811f0feee155d90dc84d084d0e3376
- SHA512 371bb35f2e101c9080c9ab4f236d93cd544cd14cbf525610cf0bfaf1d38cc79703b0b40184c1d8df6d750c83618cc91bee9e46590be1a40e63e4869f3028f4c8
- SSDEEP 96:T4qPPi8wvR0Hi+hmVbmaE2azn47Nve21Jiysa/xdT+g7KA5HK3EIx7a558ZF8C9j:sqXCF4zn47kyBzJqVRaw91YI
- TLSH
  T1612283F759ECA63055530EC03CD2B7493FBDDE2976010CA9FA4ED8989725AE2493AE40
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  wordpress/wp-admin/edit-tags.php
- Size 22KB
- SHA256 fcd401000a326b05e0d398d1a0a093c3daa450cb6f1f3fe1f430753beb5e6e2a
- MD5 fded6fe2e5c50339a33ae9c678124005
- SHA1 e33d880c2b3c01aa5d0ebe73800852d965ce9688
- SHA512 ac8e71b2c32c2869ec5e592519738ccc3931d7fe72a460aba1efdb0916349cfdc770291220c849147beaf6192d35386338f66203687a9fab39458e1c50025eca
- SSDEEP 384:KFifr45F03CfXgsqlqf0rxgrZU46rPhkaLrANi8:KF7SU1qlW0rxgr2VLrAQ8
- TLSH
  T1B7A2E7EAAA9C517013171E80BDD8F35A7E7CC92472411CFA799CC458FB506A64B3AF88
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  wordpress/wp-admin/export.php
- Size 11KB
- SHA256 ee901231d339d23779867ad2bc8af2eca109d85d837f2e9638ecf40b3e006074
- MD5 209aae46126b9fa9c9e08dc43d2d79b5
- SHA1 be21bd8b2921b9fddd455c2c4944060b856a734b
- SHA512 2332c6be304fdb12b11077e00d1f848e758bd734be6317d75cd2cced1d126b448b4008057aab12a36ada969994b4742c4dbce079185a19e6e75aaded47dac848
- SSDEEP 192:f2I9QVgBMvCqjyNNgBtshhIzkeBs3QB8ToFKDOG1XspINm/P0R:eqQVgCv4NXhhxM3BZyJm30R
- TLSH
  T15B3264A3F5EC4B31849B28D416A497F13BEC890591016CC6F42D46ECA7D1D698C3EEEA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  wordpress/wp-admin/images/about-release-badge.svg
- Size 4KB
- SHA256 3763246a6cd0c72afdf37a05dba43bcaee0ac40e15c03589dfa4338dda73dfa2
- MD5 ccea16b5cbfe0d933b206b5e51ad4f3f
- SHA1 638109c3701e8645186c59c6b20a0371f9ccad4a
- SHA512 18644e64009faefce950217ca4d2b9a57dbb36011bdac6f331b4a99e91305d9142873706218fd6dbf61462cc4974177b769b4f4a801c92706ef98485b1f5da3e
- SSDEEP 96:TS0Yl5ShXoBCixRPgFsRmdmarpeJktulRFItfmp2CDB8DImY:TSBlYVJsRpmdm5etuYfmp2+SXY
- TLSH
  T1F4A1D9EE6F740CF0DD9BD3C6FF9100CD650AA4BB54914FA0CA4C9B493892D58C89AE46
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral19 behavioral20
- Target
  wordpress/wp-admin/images/contribute-code.svg
- Size 9KB
- SHA256 5383af9878f5f7647fd4f46aecef497eaed7c16803ffa3071b710a1bfd89dd27
- MD5 b725278c2b638cb79b9dff90f526224c
- SHA1 adc72b808e6eeedad83560ae5ae11e40fb2c664f
- SHA512 35bbfdb5db23262916d7221c05c137f2e0821c6da89c16c7f1d48cdc7eb3b65872ca6335af53d480ef5e30669e0e47f73ad7eb307063e0486960705ca025280e
- SSDEEP 96:3QwY8Rs8V4Qt/n+8uh1QREQw5RGC19Rmt:3uV175Rz1it
- TLSH
  T1AA123FC8672D5528737A2E1E67072ACE00FF6C9CB25C3748EC1F69B5538B59AD42388D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral21 behavioral22
- Target
  wordpress/wp-admin/images/contribute-main.svg
- Size 17KB
- SHA256 d17763d0cf6ac7899dcf6c50075b682e983d0b0ff278e752b13061af2551dcbb
- MD5 abadc35556c6a613bc1632ecb0cbf000
- SHA1 54df7083d150caf86f0e09f3f14b8ca4e2533d00
- SHA512 0d78739db1c6729acf95153b6858c2941c04e75a416bae62722e0e64adba15aad222e5a5ce59a4047bee6dcb0d9707d7854c59674003452a419a1f8c50650fd4
- SSDEEP 96:VfWZZwfbiJYAXf8zffuTptfVJkeU3f8WzfWZZwfbiJYAXf8zffuTptfVJkeU3f8l:5RlkXSoL3JL
- TLSH
  T16D8234C8672D512877762E1EA7072ACE01FF6C9CB54C3748EC1F69B1538B999D82348E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral23 behavioral24
- Target
  wordpress/wp-admin/images/contribute-no-code.svg
- Size 8KB
- SHA256 17cf12d1a2f8693922386a4696d6e4b9786a4afff0dc65f86b014e0a33826212
- MD5 583f8b10a1cb4c6c8a52cf2731ced8ff
- SHA1 063ade614573d3044dd1c650695491d3c85482e0
- SHA512 857d604c8a228f6c9286b3b61d1ed2e9349e06c9af2cb5e86672c865f6efaa6681816dece85f8397d691a92af3b0a1bc79dc6fc2856f0eb5372ae7aa21deb1e6
- SSDEEP 96:0//ahMpMZa9MNI/SdXeYeAlEoAjBh9PwE1DdkgZA:0HahMpMZa9MuuXplEzjhPwEzRZA
- TLSH
  T11A02068CEB987F32AA541B809F51F0C4117B24EDEA647128546C54B8E5EFFAD8D1F0B2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral25 behavioral26
- Target
  wordpress/wp-admin/images/dashboard-background.svg
- Size 3KB
- SHA256 eb55d8055063f46e176b6780b55e8d98b999b9ad3b85fbca55c64b0221480546
- MD5 5b480d6b67f680796a4ba34f4d87c5fc
- SHA1 49ccd7b576475b4adbee1678fa19c1e2a828a75a
- SHA512 9ee1b84a753bd8e5bce782b9f2c370f21f07b81141623a2781b119a1c378de54af37abeaa213f14d1c7c352ff9a2b7a8e4138f4daf9dd447c975495735095d2d
- TLSH
  T137614A6DE6BCAA37D64AC28CD985E4643A1903C766C48241B16E9F9F5F28C830D1F7F0
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral27 behavioral28
- Target
  wordpress/wp-admin/images/freedom-1.svg
- Size 1KB
- SHA256 c641e751bcfb5d44aa4609d9f94c3aa9297f1baf564196b292aff3ee4e90ff72
- MD5 0b28aa39660dddc94f4a1aa117a75db2
- SHA1 ca822ca083e29e2ff15e9be4b50b80ab31a8e2a6
- SHA512 6d6918b9d5a73db24593380dd228093ea5444d631598e73a4418f48db0c3c891b8b12ce6bc693d6ab9cd34eb8e27ad95c496adf34cfa21a4b434be47812abef2
- TLSH
  T12A319AA592BCFD2AD6A1C1EC532BF1E0306E20285356A75859305F3F696A4B33409BB6
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral29 behavioral30
- Target
  wordpress/wp-admin/images/freedom-2.svg
- Size 7KB
- SHA256 59e2923003e08c636372d0a073fa51a7ec5be56e27a7e8456a98f1c65aad5eaf
- MD5 eccb22be2030bf67eb8c483e0389a044
- SHA1 d79e8a8f9d38db79520d395e203e4b0cf63d5eeb
- SHA512 16b170565e575e757778119c1318b48a63d80efb1d7771a4c5d8d12dba89af897111941abaa375570a41ad19ce0470446d99c778db0f5b0f442d14fa35c118fd
- SSDEEP 96:gJMZYjh0aRb/lo2t6xDymli9OYr0cY5lgBGOLbuGoKGQzwruihb55C:gV90aRbBQxDy9OYgcKlgB2equGHC
- TLSH
  T16BF1CBCCA72C81BCBD425FEE632A6410223E79BC31310D746DDD59A0A6E2E1DEE364C1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32