2aa79782eb5071735cc52b7b71b241504dfb0eb788c583f3cad94747025e4140

Sharing

Copy URL Twitter E-mail

General

Target
wordpress-6.7.1-fa_IR.zip
Size 34.2MB
Sample260826-psqsbayhrf
SHA256 2aa79782eb5071735cc52b7b71b241504dfb0eb788c583f3cad94747025e4140
MD5 1cfeab2ec0090e83287ece1d9ba992b5
SHA1 2d4ac7b2d247cd6e1e756b0f547706272bb7dc58
SHA512 cce3a63d92f67505ea3dfa01eca7225a7cf919e627e9fa1a5f04b08e30d1d4d83b53f64d977c52302a04e6b64e25172e341400c97013112b811bd7ad0d338191
SSDEEP 786432:md8B3CTjSjGz36rae7bukWcwR+kdqCwLJsT+BqgTK1kF9qKt7t:68sTjSjGGN79WnoCBITht
TLSH
T105772335EE2E0F41C29D4E7089EDD200E09D9132E24FAA9BAB395544976C59D3E7F30B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Language

Source

URLs

exe.dropper
http://api.wordpress.org/plugins/info/1.2/

Targets

- Target
  wordpress/readme.html
- Size 7KB
- SHA256 587d471315f941cbde21046760a35cb3668c7720d0029af3145e0e4188227439
- MD5 1f04dd54c5f57fc8d031b14b4696023e
- SHA1 c02b50a386fabcea8e244f694180cb4a02d33fe8
- SHA512 0c339edbdf449b8081d4df5b9cef016ac0435e3a43ce038e79dccf4366bbce0a1196df6c5524a204e173ce2327ea17a6da892b258cae6f217d673d604efce363
- SSDEEP 96:4UK8pz1E/4kF5kyJ0ifN8uueKQMdc8FdcwYKuID9kKCZxjD+9+25tdLwGg1IZz6+:68/SVPmuQ3C/Da7d0euCidI
- TLSH
  T196E1956BB5405376135143B1600621BA733300BEA79D4646949BE62EBBA23B4AF7F0DE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  wordpress/wp-admin/admin-header.php
- Size 8KB
- SHA256 b711bcf08edccef51b29b5883bae6215bf1165f0153c4c70b33f1dcc4a40aaf6
- MD5 e263a6e698df6f4483f1d63a0733dffd
- SHA1 4aa873ddb884e5738e5c4d983dfd54f12ea48d17
- SHA512 2acd2adb6f6a05d849638532e93e9f3c182d6a62aa326281d0de1a2ef92753d611e780d39f84bae63c084c40478f1607e4f6540be66507a6d44be270528f07bc
- SSDEEP 192:h/HW3xQB/m4TxU4ddqqQsY65ifPmWoAXZPXtSoVC46q:9W3xQB/mKyYd5iHSoVCXq
- TLSH
  T1A01255552CF2673388A22DD166D19278762B420BB3D52855BCF941F89B4136C8EFAFC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  wordpress/wp-admin/async-upload.php
- Size 4KB
- SHA256 b00af0d6ee9153b41f487003f3fc74f3808355856afa91466ca3e6477875471b
- MD5 e56071456ef8aaec9090387cd000f97e
- SHA1 d21ed4ad73e1813832d5b09feab6a8935d8e3425
- SHA512 a9abdb58c433ee65e2c7e43c1e8fb52f1a91c25065c72a9669d320158000b0f827500029e386d091ee94fe7a83b6bb02ed499d3a7532528dc818c9f0767e93ef
- SSDEEP 96:tKikv2f2NpGSrpPaxACpU4gr4M+RgaOE4Vo6vngDnVovMmDhscCkRejE0ZDGVli8:t7Vf2gx76shqaOg+fXmE0ZDGF
- TLSH
  T1FAA186F1A2AC6766513370C4564D842C649DCC37B4806C99BC2EE4E0DA84D2EF4FBEA7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  wordpress/wp-admin/edit-form-advanced.php
- Size 28KB
- SHA256 cdb359818e03c8f60589b5a2e09db69197479a19290795597c0cd71c109a85b7
- MD5 e20570fe58fe2dabc3384abf474b94ce
- SHA1 1c86d116414c62dba265b4e446a78d530efa51b6
- SHA512 50d2029ec42a81446c2d00d06da3fcca82b41a734d8ff203015fc2c61d735622d786be44fb041dc3323ba2f79e04383f018ca3818b82b3a99a9578254a3b4108
- SSDEEP 768:Y9VrD7o895VXfsX3EiqKb1SceoC0Dm8gIL+t2Oa6QEmtWZmOmB:SVrD7195Zf83Eiq61ScpC0Dm8gIL+t2P
- TLSH
  T130D2E956F1F8126159131682F8C8927CEEBD8055738158EAFCBE54ECB7C3272453AFA8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  wordpress/wp-admin/edit-form-blocks.php
- Size 12KB
- SHA256 3935654072f1314d61b86c95ec2be74d49baad5c18b8a8f781ac8f1b07494b46
- MD5 56f8439b6b116b14baa74ff17ff7af15
- SHA1 e99498ee1b551161338f2c5770998f7e934cff89
- SHA512 cbd0a0bf79500f803929a0824fe4510d87894eb2971ea9221fd5c1f0bac90719c5ec2e0c53cad9e261bb11c5b3fd3b0358f4351609ebf3ea73a7b8666f89b225
- SSDEEP 192:70DKcZr4Z/ynVlIqEqgtIy+2d2QZH3f3DOBaGbJF+0x23MN259UDqTk:4KcZr4Z/ynRQxPDOFrKMeoqTk
- TLSH
  T134521917A4BCA37A00733695DC1C85F9AC650486B301A4E1F9FECD886B471E98A31FF6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  wordpress/wp-admin/edit-form-comment.php
- Size 8KB
- SHA256 b994079a3e1cbdb637866dc7f22f9c1c645f4186633ea91822bde117e9b78e3a
- MD5 05a28a3e49baaa396a40730b08e76ff9
- SHA1 f30c37b3481833953d5ed7647930bb879fcfde8a
- SHA512 625402537ace95e3d1fe167009e47d3b60ee0c8db8eb16e06ab9e7c49f625678f879a66e898b1759a811167a0e0441929313a6ad680e50e3ed4d8031e1b6bfaa
- SSDEEP 192:TosxqDLyvTQ/fuBU/albNBNRj8yV9p/4iCtoW0MLexXLtkYyPyVKL:TosxqDLsTQ/fIUilHjBCSW08rPyc
- TLSH
  T17D02769390E44721C0A33CD12D9867B939C88709E2491C8CAABCC5D86F50FA66D36B9D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  wordpress/wp-admin/edit-tag-form.php
- Size 10KB
- SHA256 2e7650eb284feae284317861a2fe1ade4fb1cbbc15d27412f6ca7d8726e2f26d
- MD5 753931a48f65cc8582a2bdb892b1d344
- SHA1 efbdfe3965c655bd4d523b6f1bfa6915c5c1fcb6
- SHA512 e9af6896b7b16821ecc1474cc2afd971c4b1927b8a7c55746ecf417deb3e1d20407c335e92dc545dcb059b24c18938872450a5a4f9f3981a347f0a1057f5c12a
- SSDEEP 96:T4qPGi8wvR0Hi+hmVbmaE2azn47Nve21Jiysa/xdT+g7KA5HK3EIx7a558ZF8C9j:sqGCF4zn47kyBzJqVRaw91YI
- TLSH
  T1722283F759ECA63055530EC03CD2B7493FBDDE2976010CA9FA4ED8989725AE2493AE40
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  wordpress/wp-admin/edit-tags.php
- Size 21KB
- SHA256 b132e5ffba19a6ad37dc37c68da2cecee9ef5c3c4aadd9566f529c51b78a4c62
- MD5 c9bf785542dbcc67d70eb612615cefad
- SHA1 6fa4ca2c35045f3f996b9752cae89d97c75cab9d
- SHA512 2cfc8ef62fab6e62f226c3bd88fe30f704cafb3f23a452e8c5f6b899ef829e14390e3090a8d9d628bc3714aa6990b06cb4a65cdb5bbce5218a6d39d67aee416c
- SSDEEP 384:KFifr45FN3CfXgsqlqf0rxgrZU46rPhkaLrANi8:KF7bU1qlW0rxgr2VLrAQ8
- TLSH
  T1E8A2E7EABA9C517013171E80BDD8F35A7E7CC92472411CFA799CC458FB506A64B3AF88
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  wordpress/wp-admin/export.php
- Size 11KB
- SHA256 ee901231d339d23779867ad2bc8af2eca109d85d837f2e9638ecf40b3e006074
- MD5 209aae46126b9fa9c9e08dc43d2d79b5
- SHA1 be21bd8b2921b9fddd455c2c4944060b856a734b
- SHA512 2332c6be304fdb12b11077e00d1f848e758bd734be6317d75cd2cced1d126b448b4008057aab12a36ada969994b4742c4dbce079185a19e6e75aaded47dac848
- SSDEEP 192:f2I9QVgBMvCqjyNNgBtshhIzkeBs3QB8ToFKDOG1XspINm/P0R:eqQVgCv4NXhhxM3BZyJm30R
- TLSH
  T15B3264A3F5EC4B31849B28D416A497F13BEC890591016CC6F42D46ECA7D1D698C3EEEA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  wordpress/wp-admin/images/about-release-badge.svg
- Size 1KB
- SHA256 a6f18ca303f01dd08e9c2d348dcb5dc1cead624fc516e7e10e20550306e82351
- MD5 6fae3927855d6ffdf11307c04d7ec3bd
- SHA1 80a5d72980e450ce8718e4d211a65a907194bfef
- SHA512 a666b0e1175d94e4bf4f934064fcfdd0f754367bbea72d1354c3df1dc1a491fc9c5f17c898fac3f9ba7c205b83574eb96b865a6ef08c6fba7699d8c506918839
- TLSH
  T1824154DE6778D1ECA0C31B2FDF3009856B5FA4F96A2841D0C16D170864CBDC8E689C14
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral19 behavioral20
- Target
  wordpress/wp-admin/images/contribute-code.svg
- Size 9KB
- SHA256 5383af9878f5f7647fd4f46aecef497eaed7c16803ffa3071b710a1bfd89dd27
- MD5 b725278c2b638cb79b9dff90f526224c
- SHA1 adc72b808e6eeedad83560ae5ae11e40fb2c664f
- SHA512 35bbfdb5db23262916d7221c05c137f2e0821c6da89c16c7f1d48cdc7eb3b65872ca6335af53d480ef5e30669e0e47f73ad7eb307063e0486960705ca025280e
- SSDEEP 96:3QwY8Rs8V4Qt/n+8uh1QREQw5RGC19Rmt:3uV175Rz1it
- TLSH
  T1AA123FC8672D5528737A2E1E67072ACE00FF6C9CB25C3748EC1F69B5538B59AD42388D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral21 behavioral22
- Target
  wordpress/wp-admin/images/contribute-main.svg
- Size 17KB
- SHA256 d17763d0cf6ac7899dcf6c50075b682e983d0b0ff278e752b13061af2551dcbb
- MD5 abadc35556c6a613bc1632ecb0cbf000
- SHA1 54df7083d150caf86f0e09f3f14b8ca4e2533d00
- SHA512 0d78739db1c6729acf95153b6858c2941c04e75a416bae62722e0e64adba15aad222e5a5ce59a4047bee6dcb0d9707d7854c59674003452a419a1f8c50650fd4
- SSDEEP 96:VfWZZwfbiJYAXf8zffuTptfVJkeU3f8WzfWZZwfbiJYAXf8zffuTptfVJkeU3f8l:5RlkXSoL3JL
- TLSH
  T16D8234C8672D512877762E1EA7072ACE01FF6C9CB54C3748EC1F69B1538B999D82348E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral23 behavioral24
- Target
  wordpress/wp-admin/images/contribute-no-code.svg
- Size 8KB
- SHA256 17cf12d1a2f8693922386a4696d6e4b9786a4afff0dc65f86b014e0a33826212
- MD5 583f8b10a1cb4c6c8a52cf2731ced8ff
- SHA1 063ade614573d3044dd1c650695491d3c85482e0
- SHA512 857d604c8a228f6c9286b3b61d1ed2e9349e06c9af2cb5e86672c865f6efaa6681816dece85f8397d691a92af3b0a1bc79dc6fc2856f0eb5372ae7aa21deb1e6
- SSDEEP 96:0//ahMpMZa9MNI/SdXeYeAlEoAjBh9PwE1DdkgZA:0HahMpMZa9MuuXplEzjhPwEzRZA
- TLSH
  T11A02068CEB987F32AA541B809F51F0C4117B24EDEA647128546C54B8E5EFFAD8D1F0B2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral25 behavioral26
- Target
  wordpress/wp-admin/images/dashboard-background.svg
- Size 3KB
- SHA256 eb55d8055063f46e176b6780b55e8d98b999b9ad3b85fbca55c64b0221480546
- MD5 5b480d6b67f680796a4ba34f4d87c5fc
- SHA1 49ccd7b576475b4adbee1678fa19c1e2a828a75a
- SHA512 9ee1b84a753bd8e5bce782b9f2c370f21f07b81141623a2781b119a1c378de54af37abeaa213f14d1c7c352ff9a2b7a8e4138f4daf9dd447c975495735095d2d
- TLSH
  T137614A6DE6BCAA37D64AC28CD985E4643A1903C766C48241B16E9F9F5F28C830D1F7F0
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral27 behavioral28
- Target
  wordpress/wp-admin/images/freedom-1.svg
- Size 1KB
- SHA256 c641e751bcfb5d44aa4609d9f94c3aa9297f1baf564196b292aff3ee4e90ff72
- MD5 0b28aa39660dddc94f4a1aa117a75db2
- SHA1 ca822ca083e29e2ff15e9be4b50b80ab31a8e2a6
- SHA512 6d6918b9d5a73db24593380dd228093ea5444d631598e73a4418f48db0c3c891b8b12ce6bc693d6ab9cd34eb8e27ad95c496adf34cfa21a4b434be47812abef2
- TLSH
  T12A319AA592BCFD2AD6A1C1EC532BF1E0306E20285356A75859305F3F696A4B33409BB6
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral29 behavioral30
- Target
  wordpress/wp-admin/images/freedom-2.svg
- Size 7KB
- SHA256 59e2923003e08c636372d0a073fa51a7ec5be56e27a7e8456a98f1c65aad5eaf
- MD5 eccb22be2030bf67eb8c483e0389a044
- SHA1 d79e8a8f9d38db79520d395e203e4b0cf63d5eeb
- SHA512 16b170565e575e757778119c1318b48a63d80efb1d7771a4c5d8d12dba89af897111941abaa375570a41ad19ce0470446d99c778db0f5b0f442d14fa35c118fd
- SSDEEP 96:gJMZYjh0aRb/lo2t6xDymli9OYr0cY5lgBGOLbuGoKGQzwruihb55C:gV90aRbBQxDy9OYgcKlgB2equGHC
- TLSH
  T16BF1CBCCA72C81BCBD425FEE632A6410223E79BC31310D746DDD59A0A6E2E1DEE364C1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware discovery spyware
- Loads dropped DLL
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32