Overview

overview

10

Static

static

10

GlobalProt...64.exe

windows7-x64

1

GlobalProt...64.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    94a0a69a771e1a869c76ce556a1d10068a916d59.zip
  • Size 61.4MB
  • Sample240830-vs55wsvgne
  • SHA256 67edf175321f92df454c58fc64babaf1905a2843b0fe7105a3d5c6146c0e9898
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
wikiloaderbackdoorjnlploader

Malware Config

Extracted

Rule
Java Network Launch Protocol (JNLP)
C2

  • $$codebase/$$codebasesuit.jnlp?whitelabel=$$whitelabel

Extracted

Family

  • wikiloader

C2

  • https://carniceriamartinezadria.com/wp-content/themes/twentytwentyfour/rleoec.php?id=1

  • https://jlholgado.com/wp-content/themes/twentytwentyfour/zca2ck.php?id=1

  • https://elpgtextil.com/wp-content/themes/twentytwentyfour/44snwx.php?id=1

  • https://arbeitsschutz-mmk.de/plugins/search/contacts/chrndi.php?id=1

Targets

    • Target
      GlobalProtect64/GlobalProtect64.exe
    • Size 359KB
    • SHA256 bd8016b895b404f43e1d6614b564927385d74534cef319c0ea5236dd9ed00b2f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    wikiloaderbackdoorloader

    • Wikiloader

      Wikiloader is a loader and backdoor written in C++.

      loaderbackdoorwikiloader

    • Suspicious use of NtCreateThreadExHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks