3e04b7cd804fba481bca2456d65e9ea144684794cbd0fb41414c548bed94e862

Sharing

Copy URL Twitter E-mail

General

Target
productsofindia.zip
Size 47.4MB
Sample260930-pterfavy5m
SHA256 3e04b7cd804fba481bca2456d65e9ea144684794cbd0fb41414c548bed94e862
MD5 33ee5c1e5e2908d7596303bae06105dc
SHA1 2caec6550c30d3cf753094e69053e8232a8ee440
SHA512 30d8b7e618f15ce50b126093a82fc8987b564736c10c0de9df610171f72e2b39e193031c9c542a50facdd1754d5b9a7db41c8a1bafc2458daa4919fb51369b94
SSDEEP 786432:YJy1AAViMQRup7gDf24BXpsFsXH5OvtoGRbEIf7+bvDqZy1pY7fiJen37:YJIAmiMl7gTDlpsFsXZOvtoGRbEy78Lo
TLSH
T17BB722B1D63D0895CB5E8936EA9CAEC3D4998612634EFCEF7B15111DC6CF2462B7220C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Language

Source

URLs

exe.dropper
http://api.wordpress.org/plugins/info/1.2/

Targets

- Target
  productsofindia/readme.html
- Size 7KB
- SHA256 75de713715da0ed3d926a025c4b5f1fe8c205ea76a75232fee5bf8efb0ebcd40
- MD5 8734f564e795dad3f234b79f58e899d0
- SHA1 04d6776545c2a53b85de070ce5ad2a93de2abeff
- SHA512 d87442dfb5bee91ea3973ad4d3afbbba2f8d2849f0dc046e8ffe6db1cef628d2de2a04a93d77198aeaef9006ae3db012bf4b97eef76ad297f8e8994b5419791e
- SSDEEP 96:4UKLApz1z/4kR5kyJpbifN8uueKQPmt441tcqkKuIDdKCZUjD+9+v5tdYGgzIZzl:6LA/TZPqmuGQCwDaCdYUidI
- TLSH
  T1E3E1C66BB540437A171153B1A006217A773300BEA39C465654EBE62DBBA23B0BF7F4DE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  productsofindia/wp-admin/admin-header.php
- Size 7KB
- SHA256 e23404bbddc4c5aadbb371048ecd037340a6ed8c38355dbf7c6f431a054f6f7c
- MD5 57a8aa41ce3a2f65c8a9e04f828159f4
- SHA1 74dbcef03b5e02d74a1a4731efbcf7f08bb603fd
- SHA512 1a2aa9606ecdfc06e432c1a95ae343e754a8f9b31d933f294785918279d1d1605a2f7b91fa2da2367b4e167f00f900aa1f84d42176d5e78632d5097a370ce9f2
- SSDEEP 192:D/HDzTcn3/o4fx/diqql1Y6AifPEcXZPXt/d+C4fd5:DDzTcn3/oivOdAiE8/d+CAd5
- TLSH
  T18DF176415CF2676388A229D166E1D27C362B450BF3922895ACF541F99F8136C8DFBFC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  productsofindia/wp-admin/async-upload.php
- Size 3KB
- SHA256 b423aa533ff06d735b4610b1340aea4fb4c1eda18fe54cae62b1994de6785df1
- MD5 f9e165d508dd62dd7a470a4b3b408517
- SHA1 cece11d9383346eb142d96241c56f6068e4fd630
- SHA512 77ec0f830a94fa8c7cec564a6e7e87c70192c9e2b2ad022a2be26573925fa1f0b94cec810b3e96c7a852af10eb2bd8bb916111437c2c3501d579a686ea269917
- TLSH
  T1D77176F4B6E8A796117371C49649842D585D8413F580AD9C9C2CE4E0EA8096EA0FAFEB
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  productsofindia/wp-admin/custom-header.php
- Size 46KB
- SHA256 6f4e198da32bdfdfdb6739058d77f195a7440bfccccdf476591993821bb797fc
- MD5 015cd40ef213047c12beca088834c376
- SHA1 87b39c0499857eb7e74c53c0e66e21676642fee2
- SHA512 9e716762ab05c68ecd00538681f8e737a9c3fa0c72283af56e39cc450dfcd76bc9029da28670ae83f680850b4af1c6c7329f5ff834a55f6b8c8906d1f429babd
- SSDEEP 768:rpTRqm90UEOYqgbm2g/WjlmsHlevJCO/TlA5JpnjFiQpLvuajuYh:rp4m90ROYqgbK/ClmsHleRCO/TYJNDvp
- TLSH
  T1AD23B564F7BDF277403324A0EA1FAC4E85AEC5245241AADBBD8C90DD5AC0D2CE934F95
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  productsofindia/wp-admin/edit-form-advanced.php
- Size 27KB
- SHA256 77394b61455ad2eac44f6b7120130567c68eda5f657f435dd708c0cb852e5979
- MD5 fdbb42caab217da1c0fb6351bebfb27e
- SHA1 7dfada3fdacab23968c681e6a3f9a2d56376b30e
- SHA512 9c5d700b0b67958a39129de6eb703a92abbb79bf4d32d6806e7d033c71253df0a35f970f279acd3159f8a725c704aa4dd40b8528f2996a6a2f035e61b44b3cbb
- SSDEEP 768:KQ8lo1S1fTf7X3cPF1pECu5a8gIL+t2Oh6QkmD0xnSgxK:Z8loS1bfb3QF1pEm8gIL+t2Oh6QkmDc6
- TLSH
  T1FDC2F716F1F4236255131682F484927CDEBD8455738264EEECBE94ECBB83272453AFAC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  productsofindia/wp-admin/edit-form-blocks.php
- Size 12KB
- SHA256 13e0a4e8d3f32696dd03a4c9168c743f374d9c034a700b3bc0e46f46c56f89b7
- MD5 8fe1a2f462581b5578955b20dab93905
- SHA1 975689981ea13357aa3d8387a0fcadba4978741a
- SHA512 a308a59dae168f36b65090b8d8fedff01990c60bdaebe31704f7f987ed242638af8b82df1cd907a5afa38927c9d63adab95da3c8fb3a155085e05bba0d8bd8ab
- SSDEEP 192:YDrYq7aJAXMKC6k6ZG3E3OuOqO2stLgk44INKA+:grYq7aJARRry6d5OltMR4IT+
- TLSH
  T17C52E72764BC933950622998ED1C81B86D684807375291F2FDFFBC546B4B2E98332FE5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  productsofindia/wp-admin/edit-form-comment.php
- Size 7KB
- SHA256 3521fbd798e401c8a39267b78e5e8d030222814656e1874c2248407f7551904a
- MD5 bea511037a1f6271ae0acb393ba7edad
- SHA1 9f70236bbd7b6f676381cc4fce2d173dfdf8e673
- SHA512 3433ad2c6465dd07aa6d52aee081e5f6bf986fb1f38cce7974429812cd5928eb18d1deeb639053a41062730a5d9437d13cfbf395c8e29e89e967f7b67b80ea13
- SSDEEP 192:mosxqDLsvTQtuBkvalRNJmyV9yKat+P0ML8XLJkiyPyVKL:mosxqDLqTQtIkylh4tO089Pyc
- TLSH
  T1B1F15542A0D44771C0E33CD17D98667978C8CB04E24A2C9CAABD84D86F50FB56D3ABED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  productsofindia/wp-admin/edit-tag-form.php
- Size 9KB
- SHA256 da715691b4abe886e8cbf19c615c422b2cc6433bd4b6441b503c8b7cda02585b
- MD5 018eedbacff80f7830e22d9bbae43ede
- SHA1 43695b5c8ec10d9c838b93d6a5aa4160c300ecda
- SHA512 4f1301242a63fa08f8ec98c008938ea80bff6b32e1691eb5f9dd610d4446936ab389f0971b2aefb79a5420fda4acf34bc8605c95ad29b235a94bb2b0ce3b7ec6
- SSDEEP 96:hsm1eHf8HRzkgVVaEEDb4NNve7JiysaIjdT+g59Hn3CIx7t558fFuFXeMyLQP026:2mY8klDb4NvyW9HDRtlOpqFI
- TLSH
  T1D812C7F6699CB63045521EC07DE277467FEDDE2576010CB9FA4FD8A897208B2093BE80
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  productsofindia/wp-admin/edit-tags.php
- Size 20KB
- SHA256 cc04d78e2fd1d8d1e162493e03adbb6cd6278d7f6aaa60727d4a3d0ebfddd58e
- MD5 6c4888fc9ad6b1dbca49f0af0d9375e7
- SHA1 fa5c5972bca765074f5620669367874a5973dc9a
- SHA512 8e837b10aa11c2f078335eede7244b2ce77da92c2eda098cc31bdeee2c0ae1529dc71e54ca2d9d5ec2085c4907188ce71c6a0b16858ad4cd7bd837e739cf02f7
- SSDEEP 384:tzifrwO3T3sfXg8q4syrdgrJI1S3IebhLrLYDN:tzAb67q4syrdgrH1LrLkN
- TLSH
  T11D92D6EAE69C627112135E80BDD8E25B7E7CC93436411CFE799CD058FB505760A3AF88
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  productsofindia/wp-admin/export.php
- Size 10KB
- SHA256 1ef0ef044db6082fda7717b6acdf309ef174f829b55fa05fc3076602829309b1
- MD5 855cfc01ecc31687fe7af74ef1d3755c
- SHA1 ae013ea2c23a7009a1572a33c0a481df77b2070b
- SHA512 cf15f5ca3a2f9ba3572dbce764ccc0427f0a916d227248672e96fe232d43edd5dc6392d294e862d60428e7ec54df6405e0e947ca0533bd332ea8e73eb4878103
- SSDEEP 192:fJHWPgBMv9RseiZg0HY8nvKhwzkrs31B8ToFriOGHXspIEm/H6:h2PgCvviHH5KhJroBZg2mP6
- TLSH
  T1DF3276A3F5E84B3184DB28D415A496F12AEC8D0591012CC6F41D46ECA7D1D69CC3FFEA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  productsofindia/wp-admin/images/wordpress-logo-white.svg
- Size 1KB
- SHA256 a069a75b57617e5a262c71466627b5f05a67d4e70646efe72dda4e1ad6130b41
- MD5 19bdd97150fb43aa862d53500c44e6f7
- SHA1 b288b88784b040847db124ece3bf332e4a4173a9
- SHA512 7c963de397dc51317d5ed7283322ef3a34896a6a4981d55278f3c550c85d27ddd4eaddf91912a535934017709e8aab38d65c4ba72af3225b30ba8a9926763d39
- TLSH
  T108311476D6085394BAA38A58DE338061370F7CFC579E63B12262C37379816D4E4C4D6C
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral21 behavioral22
- Target
  productsofindia/wp-admin/images/wordpress-logo.svg
- Size 1KB
- SHA256 a0bbefd626f1e76f9245ec6c6101b679ba27412b71b32fc43eccda9db40f394b
- MD5 f34ef6259364f7ef0ccf67cd1dddc970
- SHA1 18b563726b3d24a73552791fff91f61077ae1ec5
- SHA512 c4ef2a19b114946484a6fadbe9bcfd80111779a5bfce8fa1d38bc09915a6e660978435f7796b34a7c71668d97c0e87186188ee5ba1704aafa592c22754e63651
- TLSH
  T1D131008D873958FC68A693E4AF30B8A3262C95DA5171D988931D993169D0CC9EB44CD8
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral23 behavioral24
- Target
  productsofindia/wp-admin/import.php
- Size 7KB
- SHA256 34ecf87242884fbb6c3f61d4b103326b58b870bfc2498d150615f3d917e41630
- MD5 692e2842c89539bc47d94422b049a427
- SHA1 7a493eff3273503e64575304cf32c2030e7dec6f
- SHA512 39fd3eccbdc6b06b5b7123a5d6253e0aea938a29b5fe4c488128a230ba3745976789ef5ea9a175719d58d4f8737716db646987717e35b608a71c5044bb16c954
- SSDEEP 192:Phgb3a4iPkP1diDOPzAwWT2V2zlBJ5kmN:pgj0GeoALqVIgmN
- TLSH
  T149E16563E7DC11370572EAC8199901F521FE41B1730199AAB8AF0774BFA7138A976E0D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  productsofindia/wp-admin/includes/ajax-actions.php
- Size 134KB
- SHA256 ce4496fc710e8b17fa3c8f680504e96dfa58492a64572e392c90ccf8f02bf238
- MD5 8ac43d9c938250479674da426da34e21
- SHA1 3dbde0897c98f7e971087054c69548e95c7825b7
- SHA512 498dd951759c2d7476362ef363f5202231ce48e5536c3f018ac9ad3bba054f61ee275efe01bad5efa949fa81526752021042da599111e5f09e39a889a9fd7caa
- SSDEEP 3072:1uh28entme7hiyBpvu3MBABXswvJK2TEzABUIWVGQ/flIFb5Ty:1ZntXW3MeHvQ2TEzAuIMcFFTy
- TLSH
  T1CAD3C595D6FC613B413330A19E2840AA3CBC0572B1410DDEBE7D68587F506AEEA7EF58
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  productsofindia/wp-admin/includes/class-core-upgrader.php
- Size 14KB
- SHA256 217e698715451a730940c1087d45f227fc37f30214a6384704037f41d970063d
- MD5 ce4653a3a4aabc8f4e93607e06a6dcb5
- SHA1 f980a928a0fabc301bd31979bdda50e0907839b3
- SHA512 87c8ad0e3f0a28a03119f8b8fecf340c5dca5873eb0d005934b324235b639b5d1e46127915fa5b87e1f19f291f17e7c4bfce27a4bede6e3a971cc5f38324b833
- SSDEEP 384:7HqcH+62xDayguDNtzBL7kczgOkPFNNVDUPpjcDQU3jSXGpCm5KsJZc3dK:7KE+jxeahtzBL7ZzgOkPFPVyjcUcjSWH
- TLSH
  T1AF5282D4A7CDA6BB44317298DD5461B8723C98BE515818D5FC9C0A64B38013EAB3FF2E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  productsofindia/wp-admin/includes/class-ftp.php
- Size 26KB
- SHA256 27d68baa00a5367b238682278b86e29c08ed14c90da53662429c0080d6d2e21c
- MD5 12ac36c3d84c1685b0c42c74289f99da
- SHA1 37acf9023e5ef2943f69d806efd92a44fff6ac5a
- SHA512 0710d67d8b56f25c969fc242019440bf1173e37c3cd97dc50437626574e59999fe75edc1348eff7f8a787fe4010a09573fde36736b9bb1d7f858a907bb70aa8e
- SSDEEP 768:F6q1jqhlXzMgIXGsObD5gseUrLzFFloSY:8gKD5gyFFloSY
- TLSH
  T1ABC21EC3BF9FACD63592D0E94353905FE86CB531686A8C47BDD981343B9832D809E978
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Enumerates connected drives

Enumerates connected drives

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32