Overview

overview

10

Static

static

1

npp.8.6.4....ad.exe

windows10-2004-x64

10

Resubmissions

27/03/2024, 09:17

240327-k82gjacb8v 10

27/03/2024, 02:33

240327-c2b93aag24 6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9af7cff793aa9a53b890331046d268e3627bb2a6b5613cdb49619c07412ccc03.zip

  • Size

    8.2MB

  • Sample

    240327-k82gjacb8v

  • MD5

    92718e3da8368e0928e9344b45170125

  • SHA1

    4c8743e3392e3e0db3d0c8979213823c747fab9e

  • SHA256

    9af7cff793aa9a53b890331046d268e3627bb2a6b5613cdb49619c07412ccc03

  • SHA512

    d2c7a9d7008f8e1cc4ce20745368841de68f23cab11ed257e17ea6df44b3f81e40d18441a9762c772b8d8a100bf6827912431723ab2c1c56db6ace9f3f621b9d

  • SSDEEP

    196608:E2GWKqkGTSOwUDpZm4NPaRzviayZenDJuOGZWCU/Z73zN7:E2Gb9OwQmeaJiay8NuzWb/Z73p7

Score
10/10
wikiloaderbackdoorloader

Malware Config

Extracted

Family

wikiloader

C2

https://www.alabamacarhorns.com/wp-content/themes/twentytwentyfour/34uo7s.php?id=1

https://13300.org/wp-content/themes/twentytwentythree/t51kkf.php?id=1

https://alternativetracks.com/wp-content/themes/twentytwentyfour/c9wfar.php?id=1

https://www.amysinger.com/wp-content/themes/twentyten/b9un4f.php?id=1

Targets

    • Target

      npp.8.6.4.portable.x64/notepad.exe

    • Size

      6.9MB

    • MD5

      8279706ad64d33bf4eceb2c1becef274

    • SHA1

      582cd15c2d1bf27da142ced63ffe490818bf4fa7

    • SHA256

      712abdd019cd2e4d96cee74d94eafba8f21ffc35c99a656c228a179ba6f5b310

    • SHA512

      69d5f5a2ceaa10a822d24af6c0cfba91804886c7fdb634931c2c6149dec29b98a7770fa7e3cb8630a525c088c39a84382ad30556aa9d4092e4b2e356af39cf9d

    • SSDEEP

      98304:1UZbk6fd56GkLWD9hWfa3s+wuP8ThKV/mo:ybkRVLUhWUz/PIK55

    Score
    10/10
    wikiloaderbackdoorloader

    • Wikiloader

      Wikiloader is a loader and backdoor written in C++.

      loaderbackdoorwikiloader

    • Suspicious use of NtCreateThreadExHideFromDebugger

    behavioral1

MITRE ATT&CK Matrix

Tasks