Overview

overview

10

Static

static

1

npp.8.6.4....ad.exe

windows10-2004-x64

10

Resubmissions

21/03/2024, 12:27

240321-pm75eada4v10

21/03/2024, 02:23

240321-cvlj6ahf676

Sharing

Copy URL Twitter E-mail

General

  • Target
    5af95489c5c3c6e2643a4218543e6e39b62ed6c5b4c97cef9c812ba913d4f7f2.zip
  • Size 8.2MB
  • Sample240321-pm75eada4v
  • SHA256 5af95489c5c3c6e2643a4218543e6e39b62ed6c5b4c97cef9c812ba913d4f7f2
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
wikiloaderbackdoorloader

Malware Config

Extracted

Family

  • wikiloader

C2

  • https://www.alabamacarhorns.com/wp-content/themes/twentytwentyfour/34uo7s.php?id=1

  • https://13300.org/wp-content/themes/twentytwentythree/t51kkf.php?id=1

  • https://alternativetracks.com/wp-content/themes/twentytwentyfour/c9wfar.php?id=1

  • https://www.amysinger.com/wp-content/themes/twentyten/b9un4f.php?id=1

Targets

    • Target
      npp.8.6.4.portable.x64/notepad.exe
    • Size 6.9MB
    • SHA256 712abdd019cd2e4d96cee74d94eafba8f21ffc35c99a656c228a179ba6f5b310
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    wikiloaderbackdoorloader

    • Wikiloader

      Wikiloader is a loader and backdoor written in C++.

      loaderbackdoorwikiloader

    • Suspicious use of NtCreateThreadExHideFromDebugger

    behavioral1

MITRE ATT&CK Matrix

Tasks