50e0795f42ee7ba4cad505c6fb5dbb03a0640c302152800ec609917be67eb48b

Sharing

Copy URL Twitter E-mail

General

Target
wordpress-7.1.2-tr_TR.zip
Size 42.7MB
Sample260928-req72aww3j
SHA256 50e0795f42ee7ba4cad505c6fb5dbb03a0640c302152800ec609917be67eb48b
MD5 091e329d9e9daf35854c31dbc2a8aa4f
SHA1 3524ba35dc83b025c0d05c38ef2462f09ab74b53
SHA512 19ebdb502fe959ac018171102c86b64ec25ff23e924ecdfe8eb776fa9ccba5b76086ea15daa2ff35b144889f01baf1bfea0152a91d8366b897592ba635b35ee1
SSDEEP 786432:7/r9Cj9H0eBN62r1CRnowpKNwtUkvuT8lpcQir24zSXWbuieJ:HMBO2r1CR/4N0uyHKr2XWbuhJ
TLSH
T119A723B4DE2E0E40C6CE8E7049EDD105E09DD133F24A995BBB3916849B6D59C3E7B30A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Language

Source

URLs

exe.dropper
http://api.wordpress.org/plugins/info/1.2/

Targets

- Target
  wordpress/readme.html
- Size 9KB
- SHA256 ee30b2ce56b239d09a38dbab6c3e591bb6c83ab8927433a3af7c002020709854
- MD5 94d671fd35b7e943b03bcc604cc0d688
- SHA1 fb9b0df9543712bb944d7f0c9f26608b68f382ab
- SHA512 a156abc7175378722b817bbb6e4b967c7567df4bab7e4c739219d24967b45aa5374775861c09eb9fba7d4396ba3c9f874166ab7e02688625a40abce902e70b0a
- SSDEEP 192:cTX7p73C1ivwVsgqF7ScNavtBbYWPCWKu03dI:cTLp7SigsgqpSPvtBED3y
- TLSH
  T1BC22CB51B8C4E91D9729A3AB8182113EF0DB02D7935CE54FA48F9A23AB453F25DEE04D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  wordpress/wp-admin/admin-header.php
- Size 9KB
- SHA256 8fb11ff7651af5bc17879d026bb6df140008c7548bab3cfc1e2d172a19873c14
- MD5 4e2223c67c2ce063f8101a0b3da4b7bc
- SHA1 5e9f0638501c0930fe72d6fc96ac3b9d344be725
- SHA512 d3022e14c518757b33c7b13cef43a4a0dc90293639d3490c7e968539ba2c03fbdc37573a72148c539d4b5e2c3bbf79709b94833fde45e3fbdc656ca85be07cff
- SSDEEP 192:t/HW3xQB/m4TxU4ddqqQsY6qifPAWoAXZPXtS8VC46q:xW3xQB/mKyYdqiBS8VCXq
- TLSH
  T1D61266441CF2673388A22ED166D5927C752B410BB3D52995BCF941F89B4136C8EFAFC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  wordpress/wp-admin/async-upload.php
- Size 5KB
- SHA256 cbf153ab3aec6d4b01cb58828aceec81d7d429df3f6e3367a78bd5c7f1cb9b78
- MD5 64073faaa1362e61f1bfe9c4a41ddf63
- SHA1 31a257693296708107231ac340cb3ad2cd8b5e40
- SHA512 1e4976ee3cfb5be1116a14b3e7fd6fecf6cdb266e50c3a012c7c0ddc54e0251a7bbe09ad326ae6d8d9930f1dd1b50b3e342311fe7b86532a8f6f0e5fe0dc4468
- SSDEEP 96:tKikm92NpGSrpPaxHQC/RU4gr4M+sgaOE4Vo6vngDnVovMmDhscCk1ReljZD2VVL:t7/92gxL6shHaOg+fVv6jZD2fzT0I
- TLSH
  T1C2C196F5A69C676A513370C4564C842C749D8837F0806C89BC6EE0E0E740D6EE4FBEAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  wordpress/wp-admin/edit-form-advanced.php
- Size 28KB
- SHA256 f728fee60f11b676cf7892eaed524bc063e8cd659b63f095e22dab6f6ff7c667
- MD5 01ec8e7fb7178fdc453f586b9ac6da87
- SHA1 7c631541fa56aca976a2cfc6e2f4109ecfdf2dde
- SHA512 46b519e47d9a46eb290887ad4ed4aae0f2da4caff38e22a58b1d4c0b791eda1285ca51d172251174ef6632e0458f54ffde8aae348b248b8f6ceb9692357d4e3e
- SSDEEP 768:h9VrD7i775VXfsX3EiqKb1SceoC0Dm8gIL+t2Oa6QEmNWZSOmn:XVrD7Q75Zf83Eiq61ScpC0Dm8gIL+t27
- TLSH
  T152D2F956F1F8126159131682F8C8927CEEBD8055738168EAFCBE54ECB7C32724539FA8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  wordpress/wp-admin/edit-form-blocks.php
- Size 15KB
- SHA256 4158fa2c08518f8d2288a3a7228196ff62230e93fb2d76d3c5f234b11c7b3be6
- MD5 a08163b53d56d3da79166d83695b3645
- SHA1 e442605242eaed7cf0adbef48de0352b77773234
- SHA512 e7dbddef5dbcab24283eedbb1769da69eac4b3bfba7b73ba35de446082e09e3d6d2534683b00285319aeb699930cca721b2ca90aab6163fa4fbe82b2809558a2
- SSDEEP 192:O0DKx7ArZr4Z/PoV2zeSA1KcxXXVfLIqEqgtgdxy+2d2QZH3f3DOBaGbJF+0x/ii:RK5ArZr4Z/Q/SAccNFOxPDOFrwMeoqTk
- TLSH
  T185622917A4BC637A5072369AEC0C80B9ED2504867341A4E1F8FDCD88674B1DA8771FE2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  wordpress/wp-admin/edit-form-comment.php
- Size 13KB
- SHA256 3f65988ba8cbcfb1dec89061e0962ab077119232da95fa5648b01780c46d7baf
- MD5 d48e97e874944858c831dc5539179c0a
- SHA1 627bb327fae53bb27cc565b56a623fcb583d97af
- SHA512 76f14e84ab85733762a15714ae89a9f5f95bea4829a5a26f12e6bd6af57983be58d6476c65d89d9e55088394e14385c7a8104a89fc9f60fa5b11479fef0138b4
- SSDEEP 384:yosxqDLsTQbyUilHjBCSW0WM37RXraFxPyohNaRVWT7PdDaFg9c/4lS0uXfpWlWc:yosxqDLsTQbyUilkj0WvPewlW4PyW
- TLSH
  T15E529652A2F8037180D33D912E5C577B75DA8704A1452C9CABBCC1EC2B40FB9AA75FAD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  wordpress/wp-admin/edit-tag-form.php
- Size 10KB
- SHA256 9c6bd65e503881f8ccb19c66cdcbbc75d4b8ecdc8af6c23cce3134283fa95045
- MD5 d2043908b4ab1c1a8b37c5fa5c5a521e
- SHA1 c7bb93fc189adb91295df84be4a97ce5b269aa80
- SHA512 2a654dc7c8b7fb338142a28e7f92b32aae872f3ed18c0ef30bab84a706f698e4ecb77cf3a6020d0d46b9b40df85270623dd596182685b32b2139eb5ce48eccd8
- SSDEEP 96:TXqPPi8wvR0Hi+hmVbmaE2azn47Nve21Jiysa/xdT+g7KA5HK3EIx7a558ZF8C9N:LqXCF4zn47kyBzJqVRaw91Y8
- TLSH
  T1032294F759ECA63055530EC03CD277493FBDDE2976010CA9FA4ED8989725AE2493AF40
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  wordpress/wp-admin/edit-tags.php
- Size 21KB
- SHA256 3695a5c6430d6b61982f90e4fb0298a915ed88f93f11fd4f9f1a1cc075da96f8
- MD5 ea2db0b9a8df5c1434d0d43ccc194882
- SHA1 b6be195d72475cfd3f53135e8a223944de0b8f5a
- SHA512 d752ff8cc5bb71f3db1630823159247ab4932c5a7493cc2f5614d8b7395f7be22104836e99b6a095e95ecca3e486affc620cf1254fbb11e3775c56b1a93e6928
- SSDEEP 384:KFifr45F03CfXgsqlqf0rxgrZU46rPhkaLrAN48:KF7SU1qlW0rxgr2VLrAi8
- TLSH
  T1CBA2F7EAAA9C517013171E80BDD8F35A7E7CC92472411CFA799CC458FB506A64B3AF88
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  wordpress/wp-admin/export.php
- Size 11KB
- SHA256 956911bb9f675c93be60439b84490be4b67571eedecf4224bcfe064c8340b343
- MD5 8f84adce85891be383b351f5d6f28e2b
- SHA1 40fd55d536d0b6a4c610fc547e945e9425763d2e
- SHA512 b12cfe4470688df2484a47b80833dbe15fd7b4f18b8c7fab8d86eb1fed95f8de0a8ab145bc98e60daf0767b70ef12dea4627e1855c6cc79a7bc4ba3ade2d5d0c
- SSDEEP 192:f2INQVgBMvCqjyNNgBtshhIzkeBs3QB8ToFKDOG1XspINm/P0R:eoQVgCv4NXhhxM3BZyJm30R
- TLSH
  T10C3265A3F5EC4B31849B28D516A497F13BEC890591012CC6F42D46ECA7D1D69CC3EEEA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  wordpress/wp-admin/images/about-header-credits-rtl.svg
- Size 1KB
- SHA256 b95c425b8c0e98614502959941afe4f7a649956acb1ee0d44129b7bdceee9249
- MD5 065d8f1427d2d2c97364fdb192669452
- SHA1 dc5626d62c575fb6d4a97cbea7986fcbee076d3e
- SHA512 46a8a205f5ea083f1cd66f5afccb481474bb7a7b7c55b9e62a0b3d145195f991b86176c279be96f6c4bae086531f8cf09c91a33408de5bc849e3d65655c8b7c8
- TLSH
  T19B3114AAF41F9C6BC29DC3DCEF61E8E5100F12BBF0C243A890684B1D1D248D76D18B10
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral19 behavioral20
- Target
  wordpress/wp-admin/images/about-header-credits.svg
- Size 1KB
- SHA256 801777ef9c73e351d17eb4eb6a941d5560c3ee774313161db8bb9bf2b94ce539
- MD5 1de541d898591664696e069d5a072454
- SHA1 f5b86953a13586af77658bccb135db599c0bf9c1
- SHA512 c53e2569d29d160628bd1ba4745c55ecaf3ad088d16abb0efc3816383e8a8b03520c4ddd69fa60af4bb61ec4cb2df070e196f6cb4444e7f4e296227ff5c5a5ea
- TLSH
  T1BA3136A5F45E6DA7D1ADC3BCEF50E8AA110F12AFF1C25364D0988F2D29249E72D1CB50
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral21 behavioral22
- Target
  wordpress/wp-admin/images/about-header-default-rtl.svg
- Size 3KB
- SHA256 52a85ba4ab1ab00d2531aee5473c72c55e9dc0f2d751647a81e5c798a59ba8b7
- MD5 23243bd9b1b02f8c1d51c486723fcaf6
- SHA1 888732191159b3d6e6b5c79627ba6d67328a5c25
- SHA512 714eaf13634b91d5573375d106bcf5a21f11f7f2b9bce3f259c4313eebe49ca85235003cca6c71cf768755915a04dba78c772b7b80fa1241b37c2042f1b5d7ea
- TLSH
  T1AB511239FA2D6937D16EC3ACFE50E4A9226E11DFF18083A5E0585B2E54283C75D4DB60
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral23 behavioral24
- Target
  wordpress/wp-admin/images/about-header-default.svg
- Size 2KB
- SHA256 72a7a9e7b497227f9ecf80a4f8813bb4d1eba8a1fd589b07304c13247bf7c20f
- MD5 b14865f18ecb5bd2631032ac368d5d27
- SHA1 e5a0306c55a5bc2688604102e87e749cc5143c70
- SHA512 e525f96f9bd00d30e027e82d30436e274744091d009cebecda59499af69766159f41d52501b3618ba6bda7ede7f42cd5fdf8d55697503eb2abc374b4ba1b2e92
- TLSH
  T197512339EA2E6937D16EC36CFE50D4A9226E11AFF080C395E4545B2E54183C75D4DB60
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral25 behavioral26
- Target
  wordpress/wp-admin/images/about-header-freedoms-rtl.svg
- Size 1KB
- SHA256 2c709120ed604be8c7f0f2ddc935143a9d046d3e64ddf6045ef3fb0a9c3e1301
- MD5 d7b989bd709048c54ae28616c8412e0a
- SHA1 a58d9e36a05cf7931623f740db12fae207c7555c
- SHA512 e5b6772f4a8007dbef6d277fc77919999643d9cb317ec5df620a6016d5ee59642b67e160566a1d57b092c96e4ede429adc916f7fa2d5b52e6073ec2c1eadd78a
- TLSH
  T1E9211472D93F7523F52CD3BDFD94BCD5604A30F9E14901ADA0446A4C553DB8B1E08A20
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral27 behavioral28
- Target
  wordpress/wp-admin/images/about-header-freedoms.svg
- Size 1KB
- SHA256 e31ccfce78dbe651b1daac1d8323a1a5d944019b6a1a0cd1b860fb1cbedf954b
- MD5 37f31ef61c2cfd9f85412c3e112557b0
- SHA1 43dbdb0ac9cb2132aedfb7295bda5828ce1969c7
- SHA512 e1bb3788e7f4e48b2ca74b417c1f15216cc48c9073f18bc64e6deeeb275f46f5fd20edd70c29ea043ef8d66d6356b961799e0d116346d1f80e80cf453593c29d
- TLSH
  T1B121D236E92F7423D02CD3AAFDB874EA905E65EDE145017DD444BB4C5439BC72A08A78
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral29 behavioral30
- Target
  wordpress/wp-admin/images/about-header-get-involved-rtl.svg
- Size 1021B
- SHA256 509bceb6f2b28e214fdfac27dec34207dddd38f473eab7db98d692554f1a58c5
- MD5 850c55ecf8f8c82e7f1d6c0427a4e53e
- SHA1 132cf2e9be0ddf61271df26c94883eb1e3bd22b7
- SHA512 c7fa4977dac8f96aa1b0b2fc02554b435093b6738b0bc7a9dbce7366530c51a3b54150d4e3322481c59c1b5db266b4ee1656d904159d0176dafca91dde531476
- TLSH
  T130117B71E42E7817F52CE3BDEDE478EA505A30FAD18902EAF440661D553CBCB2A0C220
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32