Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

99fe673086...e6.zip

windows10-2004-x64

10

Resubmissions

31/07/2024, 19:49

240731-yjqkmazfqp 10

30/04/2024, 21:42

240430-1kpe3agd3x 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    99fe6730862db95a23d5996996d99d55a809390b152bfdc15d617545016cbbe6.zip

  • Size

    8.5MB

  • Sample

    240731-yjqkmazfqp

  • MD5

    1914923016185375510ebe77c41de172

  • SHA1

    1526594013143e48da425decb19d7b4d00e85dc1

  • SHA256

    99fe6730862db95a23d5996996d99d55a809390b152bfdc15d617545016cbbe6

  • SHA512

    31232130dc9cc78e00dc38cf64c664bb2254afe75c14cb12bdc06d1abe207c3c0f06e9b3301f9910a6b1c07b63d73a4c70557286d0e149ccb600639363859bda

  • SSDEEP

    196608:Lz1xWKqkGTSOwUDLMpvM4KBCmbhOj+UIs1mkSxCBND3R/:LzDb9Ownp/0lTsUnwND3R/

Score
10/10
wikiloaderbackdoorloader

Malware Config

Extracted

Family

wikiloader

C2

https://unokodkelas.cl/wp-content/themes/twentytwenty/pttfrp.php?id=1

https://www.judicialconsulting.es/wp-content/themes/hello-elementor/t745ny.php?id=1

https://polarishousingsystems.com/wp-content/themes/twentytwentyfour/qshgfl.php?id=1

https://barliam.com/ph/wp-content/themes/twentytwentythree/plxka3.php?id=1

Targets

    • Target

      99fe6730862db95a23d5996996d99d55a809390b152bfdc15d617545016cbbe6.zip

    • Size

      8.5MB

    • MD5

      1914923016185375510ebe77c41de172

    • SHA1

      1526594013143e48da425decb19d7b4d00e85dc1

    • SHA256

      99fe6730862db95a23d5996996d99d55a809390b152bfdc15d617545016cbbe6

    • SHA512

      31232130dc9cc78e00dc38cf64c664bb2254afe75c14cb12bdc06d1abe207c3c0f06e9b3301f9910a6b1c07b63d73a4c70557286d0e149ccb600639363859bda

    • SSDEEP

      196608:Lz1xWKqkGTSOwUDLMpvM4KBCmbhOj+UIs1mkSxCBND3R/:LzDb9Ownp/0lTsUnwND3R/

    Score
    10/10
    wikiloaderbackdoorloader

    • Wikiloader

      Wikiloader is a loader and backdoor written in C++.

      loaderbackdoorwikiloader

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of NtCreateThreadExHideFromDebugger

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks