92e61144e3405c2585cd6b841761953baaef2ff4f2f34427d0b625664073f0fd

Sharing

Copy URL Twitter E-mail

General

Target
booking-activities.1.18.7.1.zip
Size 1.2MB
Sample260910-xwwfzaxtd1
SHA256 92e61144e3405c2585cd6b841761953baaef2ff4f2f34427d0b625664073f0fd
MD5 adc23b84569f4f56d0e8511312086fb3
SHA1 e2e2137bdb589bf4e58e4851f694e6fd82760f31
SHA512 297eba60c7dfc4a605137479090824891fb2c12718ce0938ad0dc1962eebef9b92cab3167f002d98db4e62c0910b2400afdc7372a78353f6a15c62a20383cce5
SSDEEP 24576:srNgpGb8ByxScBbpslnJUo3EJSyTUBckXnyIV1wyYjd5yIRws7Z:srAUwcBlGJ3E8qUBcsyIV10JRwEZ
TLSH
T105452259F59C2938EF0F8A38FC4632AB5498E2C3500139AABE1035FB4FA75DD6750B19
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  booking-activities/class/class-bookings-list.php
- Size 31KB
- SHA256 ef0b73e93b9b86d6a0b93319fcbc67fa536d2096ab5f76658223e79bf9608b2f
- MD5 032ba3b332cd1ecbe6a703ad957f8c98
- SHA1 2a4fee8744d62639160099ce450afb64f7b1bfd7
- SHA512 5507933aa09f6ed9df41d79463bf6b4f6965920e03f7c6f9bc041afe2ef6666bdc8eed16b39cf7619c3b8605c743e79d4f9908a08d521ebff09d5340aa7ac437
- SSDEEP 768:buD4EVMssQJpCbBURzKQw7EiiR4S8Uu+hYFSi9r4d:e4gMssQzCbBURzKQw7EiiR4VV+hk39rA
- TLSH
  T1ABE24086F29D797E02E373B15EB49A07D4BCC531C0022CDAB95CF9317720B6986B8B65
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  booking-activities/class/class-forms-list.php
- Size 21KB
- SHA256 794706611305395a44bbc4c543e56bb9aaec43adc8c12fd783449ab65212915f
- MD5 5039377564e7b09ffdab3dd21c374199
- SHA1 4ba27f2d7e7fbe46dd59dfcd3c97f2059b14a1ac
- SHA512 88b77b7bc2abb737dfa71158d536a35057619382a013d6155517a5add91f9aefd2f023229d70fece9e0acd17871b2da32db96e889debfe4c236bf67ed6473c2c
- SSDEEP 384:Hu0tXywegt/q3nMRkR3pRaWtReaRTCFC1gRwG0g19D+gPM6D4MSKXzJAQ88kC:Hu0tC9g68z0gj+yLD4xKB3kC
- TLSH
  T11FA2A4C7B39EB97E15933241A9F98A19E17CD03090013CDABC5DE504BB74B59CAB8B39
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  booking-activities/class/class-notifications-list.php
- Size 23KB
- SHA256 ce87dc50d807bfaa0c937dcb7279b54313105cfa567644cbf14e4b358fa4829e
- MD5 5aaa2857fcdc293416fa57f31ce89ca9
- SHA1 d491fe04704782b0e1df8502e4a46aca47a59e5e
- SHA512 68180daeebf02453465e31491bf7a6d75ccc24bbbaa00bc419200eda7b6b135b56b6d3a39aa0111104a1c0052cffebaf0eefc061b0149aab77a87d7546df4ca3
- SSDEEP 384:7u5Wh4wh1Ljt/qrBAvge6uqakJuE1iA7i7LfDJzr9+JRyKuSn/dyk04B88Gr6P:7u5Wz1Lj+Bygen7E3i7rFzr9Gtd8W3Ga
- TLSH
  T162B274CBB39FB1BA1AC3B122A9768551D4BFD13490022CC5BACED0007761715CBBBA25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  booking-activities/controller/controller-bookings.php
- Size 92KB
- SHA256 d20e56d73ca20ed2b56413313ab93afb6f140b3bfccee766b6d9178eef0acfda
- MD5 1328596b6ba40c220b5e326a3d33dbb0
- SHA1 54702bff6ffa78f4b7f3f2f61c73523a0e88e920
- SHA512 f823d902c977ca67b336d0a70f697d83400e0070c9097c61c2ad4d1df7abb1d02b2793f2ae1c6133a7c5f88c2f65b9443091e01c4f8ad55f90553cc911ad2908
- SSDEEP 768:p267pTn69PJAjYqTXHqJ8/VH9C/lPxf45twXje2ZUrPa+roA5lGZvT0BMLBKHlMy:pG9fZXqmZvTDKHlMCG/2rz
- TLSH
  T14193105FF0A5A57E87F373B14EB0961B98F4085682420EE6B51D37302761AD48EB8F4E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  booking-activities/controller/controller-forms.php
- Size 93KB
- SHA256 3b2b5cd1309b04c8ea8b1fd7b97731b63b358a5c078bd2bbd22be7fee3e7a25a
- MD5 b631e9ea1563d7bf23719445733222d0
- SHA1 27c9cb380bb06b387bfae77b60fb7394bf25f7a9
- SHA512 f966be5a23c7e4ed703c20f27785f4fa0c5ef8ec8c595787aff73f693017ec774b5de9d451e1c7fb35c1feca0bc16c8dab4c8fe1fcf45fbea52fa599588a7522
- SSDEEP 1536:msMCWZd9CdwlRXqWaKQxbUA8YAaU5Z6CyuapymaAZCQS8MaSZhVCQS8MaSZ4z2Ml:0XqpxPXkuanma0WCMGsn4sz6t8VJeiLF
- TLSH
  T1B293635B7199A53D8663B6B04AF0D32AA7588030CB015EE6FF6C395B37B25C09C94F8D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  booking-activities/controller/controller-notifications.php
- Size 23KB
- SHA256 62735314e2dfa155f3ec3099a111574d16508e70cdb8bcfc854275042c2efc69
- MD5 6437f2ffd3626ec27c1ba9c1b863a524
- SHA1 488769c704c6058a293546855382ba1119f25bd3
- SHA512 0b154447e1ed668eeb91bb7e346f1dbaf506f273fb2ed95fd43bfcd1ff23b15974128c2f67e2ca6a781ca7457bba26486482853828f6daaeb37f3963dc948acd
- SSDEEP 384:9sgRYiMfbEc/A1hDi2v2vzG6wS97n1V4By6GbqRa+qsXJdXqDm257qmn9qZUgnDj:9wQRv2bwS91V4By6OqRa+qWdXq6257q7
- TLSH
  T155B252AFE1AA33BD1FD7A1724C97508AB87F41195D022D916B9F51242F223E4CE63E0D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  booking-activities/controller/controller-settings.php
- Size 29KB
- SHA256 a3c20fc07c4e8c5f7ecb6c9156974deba5cc4ad3ee3b27762d22a7f3422edf53
- MD5 129254a268ad12e9d9f74c75d333628a
- SHA1 73192a1a43e6b9f2327f0443fd139da2249fe196
- SHA512 cfc0a17085934fd53bf4e161135e847f35ca721eafed01622df33bc33700f886d4d8fd41aec3d55f076f3d7a3c1e8da4092400d67ecc6d6d5d938c7e4a9f463f
- SSDEEP 384:n/Rd9w3IRdfdRS9/hRdDnRdgURdC5RdcARdrdRdXiRd1DRdQVRT3Rw3RtpRCARg6:/9VUzD2pZy5icziVL4t7rKGjECB7QhM
- TLSH
  T171D2527EB165763D0B2793318D71960EA03880419421AEF3B97E66163F137DC8DA2E8F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral13 behavioral14
- Target
  booking-activities/controller/controller-templates.php
- Size 81KB
- SHA256 c249c360db2d4bf0db43fb365629576780be5131adcc5210ae582c1b31de4fd4
- MD5 999bb810c58554ed0ba94acde05f32fc
- SHA1 1af7cd4803e6ccb7800230e5fba27951e8e6f314
- SHA512 c56eac6ae2b46e5fcc150bcb90a09aebda8c8df7fcb9e849de3b16d34f83abc48584c5d3b001343935cf541c1a8f04e5859ecb30d7572b264bc06afc4461d62a
- SSDEEP 1536:kAI1fsMjQiokq+9uoij7BkPLRHaU4pHVZ/hHyZ/ZvkH6Uuio8soQo:EDRHOH9HF/
- TLSH
  T1648314AD2169F97DC7FB31B847B0CA0BE97401E597820AF6764C1E4827219E09D7CE4E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  booking-activities/controller/controller-woocommerce-backend.php
- Size 30KB
- SHA256 efbbe62db3faa682193ee7a1763b3e198b1660058d18d2c4e1da64dde316f75b
- MD5 d1db9fb08fa10a8e198c9e855ea9967c
- SHA1 6d9578e17a9b1a69ebc49a6e8fbd55025b4b4cd5
- SHA512 bfb86b68d932b5dfd16d6c818724de902620d9fa626d978c9d8a89c249aefef2f8c30ed07d0935576d4b1cb4f75d76744c32fdd05f2fe9c49bb83c271a61dec0
- SSDEEP 768:BN42CkxS0Jb1+PyAe8FH6vhdhyDNryGNqDxJVnOJNa:SRe8h6vfhyDNryGNqDpnOJA
- TLSH
  T11BD231A7F3AC753D12FA33B10D85825FB8DD642293910EA56C2D3B3826222D45DB5B1E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  booking-activities/controller/controller-woocommerce-blocks.php
- Size 6KB
- SHA256 a9038c7888aa21ec42ceebb1630a7de97bb148d4555de4145e210946db4c0826
- MD5 52668393e6a7fe5eef155b8ca1321128
- SHA1 c504d3d7c77d9e88a9dafa3e56dd186d09036501
- SHA512 aa092b4e489b1428ef87669d38b4a9c30117d6e5bc92e23ded6b8af0ede9ccfa581e65b8370649656daa23e5c2f50266a2579c6613a394f2a2d3638c432710bb
- SSDEEP 192:YACCCS5CDbHxh3nhASvQpA5uEhVpb7qYffLqWO2:WVVkGbeEqWO2
- TLSH
  T146E122DBB4BAE1BE43E673219D7099A5FC7C8021834108E4F80EB5153B195CA8F23B5E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  booking-activities/controller/controller-woocommerce-bookings.php
- Size 71KB
- SHA256 508452b83e725c5c3dab373f9403540b13e1b20766a5bbd40d1b1a5b9c444005
- MD5 f6a06d20c625bc09bf992e95be3a0b64
- SHA1 6bc4e701c6491977df2fcbd47263b6bbdc81a1d9
- SHA512 61d72b6bd7e8910a6032c44c57641a2a42efead563e7b54f1618928f949708588e0ea1e568a4ae69b858926e232dcd5c10ecf528a2a68afd544629324ca85399
- SSDEEP 1536:jGV9d8HpTh5WvYcZHOE9VjVNVfV6hGtKL4EMLAQykMYAVMBAY3:jGVuTcZHOE9VjVNVfV66KL4EEJhCEZ3
- TLSH
  T1CD731F5BF0B9713E47F6F3705E759E6BA8E8C051D1022EE8B90C76343661BE489B4A0D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  booking-activities/controller/controller-woocommerce-forms.php
- Size 41KB
- SHA256 b527cb2b75093151cb7657903be0aaac708077b69bd3814d0d2478441a7e5c13
- MD5 8f004f560eb37c939f738fab286ed602
- SHA1 90bb9d0606352e0a4fc80a72439432c13ec4c6be
- SHA512 d682b801a53566bde05ca89bbe8bda9901863ff2a743bc6a96935cfb6354256507e919b429dbb949257888ec1a3464ccdb9aabd01ca8112d87036109cb1bd706
- SSDEEP 768:HBdVa2NgVLOJuq6SSUGNU3SY7Nlj6+xSUzdoZ/A5/N94:hdVa2iVLOJuqbSUGPYxlW+ss6A/s
- TLSH
  T1291373DAF0BE653D21A356700AF0E187FE38445092C21CEDBA4D3E461771B918BA6F4E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  booking-activities/controller/controller-woocommerce-frontend.php
- Size 102KB
- SHA256 a75b7996ae2a89e8b375930427bc629c45e357a382a717b15d9991126cb7945b
- MD5 71561fa976a1fd55c82120c6e32bc330
- SHA1 1918abb50c891121fcca2d80c26244d90a574b90
- SHA512 720ea195d1d4c1d1b57953bbe47515931c67f69de2219d15fec55ffabf9ba97238818962720a3b13dbf4177c60c232e282800b41cc6f76de9addd6d7f6ea5f64
- SSDEEP 1536:m8tFCDnktzKCEwfARt/bnbtFQMxac/MCFWBQfDhjhNpzdq0pXDXwqFmj4Aqk7Bkd:m8q3TBNa8RFWBQfDhjhxDyj2
- TLSH
  T15FA352A7F5F4713E12E27B705D816ACBBEAC4413D2411CEDA90C76282B117DA8B71B1E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  booking-activities/css/fonts/booking_activities_icons.svg
- Size 31KB
- SHA256 ee7598fb728bdf0f0a71f800b557a0c14ecfb84cde672376377f3f8838af8c3c
- MD5 7bafee62b73b30569d2e386f0d9f8373
- SHA1 8a2c668f13afec96baa4e585f316ea379f7680e6
- SHA512 2d769a398fca8c13ae03f5467c38a4ed39a3cab8a18089178a518090588465bb1a7fa2253a52b52fa6e50bdd68464973b407a949adb5953a40056d48a95dc03f
- SSDEEP 768:LQ92VdzEifbifbsCQWTVE6rwKXHV06oPgfiX4s0CFyGZtb4KFsmi:k92k6CdQWTVjrweHV06oh0CFp3FHi
- TLSH
  T13BE2B6F11233B7DFADC0EC967550365062B81067BFAD02C4EB5EA92F087ABA15874E71
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral27 behavioral28
- Target
  booking-activities/functions/functions-booking-system.php
- Size 251KB
- SHA256 3b1ea72e47411fae1e8fcba96af054b19d32ccfa76c6104ce274b57c43ff26b3
- MD5 104ff02b2d16b7728421c8945c810227
- SHA1 1cf9295f94b4d3e7799efca9b273f80c8bf1f801
- SHA512 e303e7f1f5bd813686473d356caa29f60ac374bc8764c5921650aeb6d9c2083eda7dde236496c4f2728d6fb008c7372f1d8275c664157a718e3ebd272f5992d1
- SSDEEP 6144:eUhs0sebhz/+E6+KX1iL20kUrZS1sdJ4iWVUqAGHkkHgf7m5MUKkHXHN7XHFZ1vz:eUhs0sebB/+E6+yVUqAGHkkHgf7m5MU3
- TLSH
  T1934464D3D3E94A3D54BF32B90B81D707D63C42B1A5421CA97A4E2C982B65B74D078BCE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  booking-activities/functions/functions-bookings.php
- Size 168KB
- SHA256 b160c787239ad68136d9c1370a6f3ba2117dced2304daca5818b46db583200b6
- MD5 bf9e8ff3ee10707fbba23450a6723130
- SHA1 f5a2057874b71a3a3d525e9275d65425ca4d4d08
- SHA512 063023be1120911c3e09099aaec10b2004a35cc32bb50fc215d171d10cba91314424b4b8287ef5ccf3700c53dc707e616ea0f4b2ea43ebeca79cb1bae7e87f06
- SSDEEP 3072:TMIMRoqctOOkFfy3ugFygg/9DGPFLBwDKKZ0TIBN1mSUsNJA9K5IuNd3QCv6A+9a:w5yQy3uf/ew3Vv6zNaNnOU66GW
- TLSH
  T1C8F39357F1AA613E47E373B00EB0D51BD8F8C56191021DE9791D3A352B21BE88AB8F4D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Command and Scripting Interpreter: PowerShell

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32