15e8882b3f2563fc224a14d3ad8a3eeb5816272f94fa5b84ac1ab2408281a7ba

Sharing

Copy URL Twitter E-mail

General

Target
rasa_.zip
Size 24.7MB
Sample260819-pj7dpsfa47
SHA256 15e8882b3f2563fc224a14d3ad8a3eeb5816272f94fa5b84ac1ab2408281a7ba
MD5 902035787686e283a767fd42541a5664
SHA1 8ad9728f73e6fb4a926a43738f4b8d886244a019
SHA512 c73116de2fd24f122d55f27d1020a85e3a6f73f7ff71a02aec25a8677b27deb63bee7190a5d9816638ea9f5cefa8e0261df0f742a36208518038fd406c9b5386
SSDEEP 393216:l1lJWMvuKF2xwdrm9SUHJ0GeEJy9cfuoOOIkwd7OOI0CR/N870EP7U45kxqAevJy:rj9Pfm9SUp06fxIBrIn3wDvmpmXO
TLSH
T113471231861D44A0CF6EE67685D6164780DEB292EA01BA8EBD14015DDFC93AC3FF371A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Language

Source

URLs

exe.dropper
http://api.wordpress.org/plugins/info/1.0/

Targets

- Target
  Search-Replace-DB-master/index.php
- Size 183KB
- SHA256 15a5ad510a2165158d4fc940892465ff4c46201fbf9994ff59b479082251c03c
- MD5 104c67e82d29cbab92e9cc25f06b5fdf
- SHA1 889e0355a3715bc8ccc5e2f9049531922e9087b3
- SHA512 3c88a6ced8bedab7b449c1be769e1167af5e1021d94f03ef9cfc966db198563f5d422f9f696fe725154160e6aba577eb86b272f65b339571a5dd17a16a24dcf7
- SSDEEP 3072:wEUeZOJEsHolCc33al2pAGsKXlI2p0WPSbDrstfaZJN9bym4:wEUeQJEsIlCIal2p0KP6WgDCyZJN9byf
- TLSH
  T164046CD9B3DD7862872730F9046F510EB23E5836980C8860F96AD9B87CF494D9277F68
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  Search-Replace-DB-master/srdb.class.php
- Size 30KB
- SHA256 f2093daf0ebce471e4aa46c11c17b46cff776eecacaaea0970108c6a515ab683
- MD5 65aebdbefad574263dc5a65530d9f420
- SHA1 cf1365afdf8da6993771f4cc73f62969018de4eb
- SHA512 8c099f687f6df1852076e444872dbbc9c0ecb4b22c1c248cc37d1f465b06d63429eef398810a3355af18e7bcd72c678fd0e7d60c6499c37a332b353803466690
- SSDEEP 768:DH3EUe7hZ8Wn+AKbqz3lLQsjxhWN5aXZqTXB:DH3EUezQAGcpQsjiUZe
- TLSH
  T17FD2C6C6F3CD7E9B1212B1E45E97B19966BC1030226158AAFDCA96203CE007D8779F7C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral3 behavioral4
- Target
  readme.html
- Size 7KB
- SHA256 33f8a9516045537a777d91eb5c009959fcaa787fe2f7712b4938538d173ce634
- MD5 092b5391da31c6e8bb02bf4bc03b6b34
- SHA1 fe0f10cddfc94ef17ce979a5ff867ad18b63e073
- SHA512 9714a9e3bd1d91d165e50925a14880d1343eefd73f3e013c9c7a8062c89147db2219b8690531235939b08294a269d5f51f3e96e608dccb19bc50684dd72095d2
- SSDEEP 96:qUKLApz1z/4kd5kyJpbifN8uueKQPmt+41takKuIDdKCZUjD+9dv5tdYGgzNZz4+:8LA/TtPqmuRQCwDaldY7idI
- TLSH
  T1AEE1B66BB540537A131153B1A006217A733300BEA39D465654EBD62DBBA23B0BF7F4DE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  wp-admin/admin-header.php
- Size 7KB
- SHA256 188e3b226d7c71b6bacb7089af2395b0617b5cf88522bb293ba4227a202471d3
- MD5 741d81821039b1f77f5258b923d38f92
- SHA1 4d3cf368fe248ce7e376a134c22a05f09800db0c
- SHA512 f1badbbe35c720471f1ac63c7ac5fbe0748f025e9490ac3eabe162b9a5b5d28727a13001af19a1a32f3cb000b77769fc97ab2b4616039de65cc35496b504220e
- SSDEEP 192:HUazT3+p/q6v1diqqlGSAitrOXZPX32PYYJF:tzT3+p/qOvbSAi+2PYYf
- TLSH
  T119E1A5415CF2672388A21ED165E2D278352B8517F39228919CF942F99FD1358CEFBEC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  wp-admin/async-upload.php
- Size 4KB
- SHA256 2b6f5ebbd212b54e8046ec69007e597e8d08b33ca8b1341b7bbc0dc83c93560f
- MD5 77a7125b3e8eb3ebc76757c19a2dad76
- SHA1 e666cd333aabb4e846d852e7160cd4e056e4d114
- SHA512 741ced1e5fb36fb96251411de59f55159005b611514ba6cb4e2178457c992c953def0a184ac4eba3e35a55f2ed5b8a04525973c149f630e3f523186d364b867d
- SSDEEP 96:tKzk2SabJRMGxl+0F+WLheLKNabo6BDnbov/DnlCeaz6JWM:tEsKP1FJeyJRTazm
- TLSH
  T1619186F576F8B77A5133B0C84A4C802DA559C913B1809D5C5C9CF4A0DB8496FE0FAEAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  wp-admin/custom-header.php
- Size 44KB
- SHA256 5922841abee469d45dc113e1670814d04ea835c08941a143d3bfc20d532c2cdb
- MD5 09b9c7d41d79fdc40d70e40615d506e5
- SHA1 b66648d776ffb234f06e9e6a9fc9914d4234bb48
- SHA512 2cc569d265b7640383deeec8ef4affbe870fedac37c5b9c326825bff684bc0ba23c796ecc9a2844817547f685fa1ed500df5e34d0683d76944d8ee967ec1c2c6
- SSDEEP 768:qp1TwQYR2OiDDPGaoBKjlmhOtje/RmwO/Tm9xLd6FiQB8uvjuAg:qpyQYRPiDDPKB2lmhOtjeJmwO/TOFuvq
- TLSH
  T11113E768F7BDF23B403324A4E60FAC0E55AEC6145242ABCABD8C90ED59C0D2CD935F85
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  wp-admin/edit-form-advanced.php
- Size 31KB
- SHA256 b0afa74a54e847c845df83371aa57796f5dc35543a0a1a42960f5ddb04e2a86f
- MD5 0818711a5aa58cb41b6aaf0cea8f75ce
- SHA1 29616a06d5795b417dd1f90e9c6e7a06725c4a4f
- SHA512 611e52d1f7df53da8844c7fc1633f8589445ba3737588a8ff56d501dffac1fe66559ba97c7d7eec7775ed05491d7a7eb1e36ccb74eefa6494b0bcd2122a94c85
- SSDEEP 768:gG0mcA1ywD+hVAea70CCX3cPcoC2WuwaxnLL+t9dYAQks5P26uaFfI:30mcA1ywD+L7a7+3QcoC27xnLL+t9dYG
- TLSH
  T140E20916A0F8236154235280F584927DDFBD8451339164E9EDFE94E8BBD32B38935FAC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  wp-admin/edit-form-comment.php
- Size 7KB
- SHA256 65e837d0379800df2785ff3d8a124060553a610c6882f877e37dcb2eafa9725b
- MD5 31ad01b2ba65a4a2e631e422b2581580
- SHA1 7342e532916f40045175a40c60f664465daea823
- SHA512 17461f945d5e1e4a06d95f8fdb44596c6b1a8dcc2b8dbab717d54f8197ae5e4be41485e922aec889c45892ae282cee682ef94d3d3f650aded76092a8ffa3a71d
- SSDEEP 192:qxsxqDLwOTgsOkvub2mNJmyV9yKY+70MLhfLdErYJyj4ByMVA:qxsxqDLZTgrkm22G80DrYUj4B0
- TLSH
  T117E16653A0D44771C0A33CD17D98667938C8CB04E24A1C5C9ABC94D86F50FE6AD3ABED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  wp-admin/edit-tag-form.php
- Size 9KB
- SHA256 b56af52c5b0892af5bf567ca88f7c7b0e56338a3830ec42f840fe86f1827a5d2
- MD5 ef1c04dd95cb42fd3ce8463738951445
- SHA1 33dbf7d53a74b941a8fc61af39aaf2fc22ca97ae
- SHA512 9935aa089bb1d27b8a97f654ec3e5f9a2f0aca38305c4962496bb87544b64ced2f4827671edf5208f7c68acb8f8a3c53e47ac96d9a0b49bf2c6552cdbbd10a32
- SSDEEP 96:h2UJ1VHf8WRF6gVS1CEEx04kNve6Jajrjdx+mmZHn3EIx7t558fFYPF1zMNLHPNT:TJvx6sx04kG+ZHVRtH5kjRGA
- TLSH
  T10E12B7E769ACF53005530EC07CE3B7467FED9E2576121CB9BA8FD8A497218A14937E80
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  wp-admin/edit-tags.php
- Size 19KB
- SHA256 22e26388aab30adc66d33812cbd04a60e9029838bd10afbb113123a9a3e781c4
- MD5 59fae13a8c5dada72eb3e1c612bd946a
- SHA1 cdef2a7e863274198e884dc500cfd109787be910
- SHA512 8ace97b5c0fffbcc60f6a13ef8f6043373224b0e03f0c80aa0642732c2f72414dee57312e103422de5a8607044cc115b0759dccc584cdc61a2aeefe992a44b9c
- SSDEEP 384:z1VWXRfgga00mutanYtUVxCIfhfLrRHDZN:z1wmt00mutaYtqlLrR1N
- TLSH
  T11B92E9E7A698517102235ED1BED4F35B7E28CD3572411CFA3A9CD498FB505A20B3AF88
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  wp-admin/export.php
- Size 10KB
- SHA256 d4897d4be5c283cffeda8b357ed1da674cbd7a8f5d224dc0afb07668c9ec7787
- MD5 9fefc2dfafaccf4644da004bc5db0cfe
- SHA1 235b4da180aecb5709720e4bb8e34a5062f9672a
- SHA512 1aefc86d0a38f76a59beb175b6bddb445f582b01f1f0a4e19e30f7aa820ca0fa35cf7bbea28645fb7e98dc4e91659d94b25c8a8606e7730e31d8a379be7ac0f3
- SSDEEP 192:fDbTqODPvER8Biug0jEnF+rwzkrs41B8ToFAEOZHXspIEsn/yq6:7bT3bvdigs+rJrV1BZx4kg6q6
- TLSH
  T1D522A8A3B4AC4B3184DB28D91194D7F12BEC8D0591062C86D81D46ECA7E1D6DCC2FEFA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  wp-admin/images/wordpress-logo-white.svg
- Size 1KB
- SHA256 a069a75b57617e5a262c71466627b5f05a67d4e70646efe72dda4e1ad6130b41
- MD5 19bdd97150fb43aa862d53500c44e6f7
- SHA1 b288b88784b040847db124ece3bf332e4a4173a9
- SHA512 7c963de397dc51317d5ed7283322ef3a34896a6a4981d55278f3c550c85d27ddd4eaddf91912a535934017709e8aab38d65c4ba72af3225b30ba8a9926763d39
- TLSH
  T108311476D6085394BAA38A58DE338061370F7CFC579E63B12262C37379816D4E4C4D6C
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral23 behavioral24
- Target
  wp-admin/images/wordpress-logo.svg
- Size 1KB
- SHA256 a0bbefd626f1e76f9245ec6c6101b679ba27412b71b32fc43eccda9db40f394b
- MD5 f34ef6259364f7ef0ccf67cd1dddc970
- SHA1 18b563726b3d24a73552791fff91f61077ae1ec5
- SHA512 c4ef2a19b114946484a6fadbe9bcfd80111779a5bfce8fa1d38bc09915a6e660978435f7796b34a7c71668d97c0e87186188ee5ba1704aafa592c22754e63651
- TLSH
  T1D131008D873958FC68A693E4AF30B8A3262C95DA5171D988931D993169D0CC9EB44CD8
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral25 behavioral26
- Target
  wp-admin/import.php
- Size 7KB
- SHA256 d15d97ff30b105ceedbd4fc63bd31ef2cd5d8ec86e40461223672fb7879cd988
- MD5 f3ee1ef15a9a620217059a853d728d7e
- SHA1 8c4904ac6171e480a50082e6f6f9419448044271
- SHA512 859fd84b51d5a887568efbb8a5576b63109be5583949d5869cbf5819f074adfd5329acef222282c8be28b3728ce26b59c6bbda15a86ea6b1289796de9bfaa558
- SSDEEP 192:3Y+S3r40UNkPqidODOPzAQjE24qkxu5WafmN:I+6tUkqRoAWzg/6mN
- TLSH
  T1FAE17473D7DC21360572EAD8069901F522FE45B17301995ABCAF0770BFB7178A97290E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  wp-admin/includes/class-ftp.php
- Size 26KB
- SHA256 5cd4df3749fa29aefca71455d14bf0239a92554b0080004d9b78b81161fc2b4b
- MD5 c9bed1265f9efae3736499726a7a1b2e
- SHA1 6bccf04c8b46c8d6cdf79db8b509f4b76689f3bf
- SHA512 c96c1ad8a4fb81c45e58b5450bb3220fa0cd4ead31e67515214d46ab3c43e4e1fe71e2c7e7d1a9424044d5f585f6a246292ce6637378c037774c5d87bd3409f8
- SSDEEP 768:P6q1jqhlXzMgIXGsObD5gseUrLzFKloqY:SgKD5gyFKloqY
- TLSH
  T11AC21EC3BF9FACD63192D0E94353509FE86CB531686A8C47BDD981343B9832D809E978
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  wp-admin/includes/class-language-pack-upgrader.php
- Size 10KB
- SHA256 ea1007f59f8305065b22700f40e204e9fb1927a5cf01e04e5c1b4d56afee2b4c
- MD5 28ff8ddb3c48d106c7bc05ca5ebc8be5
- SHA1 250f07bec620aff52478352b9307b1e75f32b9eb
- SHA512 ff256004c2675709dcb3cd5038171efef581e99848dc44e6e8de3184b446a18b3649d6e930415e986334594ffb94d561cc5d7199a95557b7697d28922fa65615
- SSDEEP 192:qVO2hGEV1ZECI+yKgnl7su5bSzGrknRgaiP9CnYgUb3ZJYYp:H2g8Z8fqu9SzGrknRIP9CnYgUb3Np
- TLSH
  T1253273C4B7EDF679303311DCB6A8BD91287CE46062212C55F9AE44E457E113D8AAFE38
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Command and Scripting Interpreter: PowerShell

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32