Overview

overview

10

Static

static

1

npp.8.6.po...ad.exe

windows7-x64

1

npp.8.6.po...ad.exe

windows10-2004-x64

10

Resubmissions

28/01/2024, 15:06

240128-sg3jhsdhgm6

28/01/2024, 15:00

240128-sdn7qacba76

26/01/2024, 12:16

240126-pfs2xaegbk10

26/01/2024, 12:02

240126-n7p9nadbb21

17/01/2024, 19:57

240117-yn88jadfbj5

17/01/2024, 19:56

240117-ynp5naebg91

16/01/2024, 18:32

240116-w6l5lshdb76

Sharing

Copy URL Twitter E-mail

General

  • Target
    npp.8.6.portable.x64.zip
  • Size 8.2MB
  • Sample240126-pfs2xaegbk
  • SHA256 bef04e3b2b81f2dee39c42ab9be781f3db0059ec722aeee3b5434c2e63512a68
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
wikiloaderbackdoorloader

Malware Config

Extracted

Family

  • wikiloader

C2

  • https://thichgiban.com/8sjdtu.php?id=1

  • https://kashmirworldwide.com/ilw4kl.php?id=1

  • https://thekostenfamilys.com/m1b7o3.php?id=1

  • https://multitraders.net/yv7clr.php?id=1

Targets

    • Target
      npp.8.6.portable.x64/notepad.exe
    • Size 6.8MB
    • SHA256 746bbdd8c754b0ac18a226d2a1cc68792c948033932f5723981a2b5f5684d310
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    wikiloaderbackdoorloader

    • Wikiloader

      Wikiloader is a loader and backdoor written in C++.

      loaderbackdoorwikiloader

    • Suspicious use of NtCreateThreadExHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks