WikiLoader - это сложный загрузчик, целью которого является установка второй полезной нагрузки вредоносного ПО. Вредоносная программа содержит интересные техники уклонения и пользовательскую реализацию кода, что затрудняет ее обнаружение и анализ
Indicators of Compromise
URLs
- https://artofpinball.fr/iiniid21.php?id=1
- https://automaticamentes.com/eCommerce
- https://automaticamentes.com/maintenance
- https://baywatchrent.fr/doihn12ijok21.php?id=1
- https://cdn.discordapp.com/attachments/1063894486901587979/1186331439340462090/v5b2.zip?ex=6592dc40&is=65806740&hm=673bdc5de5ba021e862fd39ba5247e92d416989fe779f8f7efce4143c85b34b0&
- https://cdn.discordapp.com/attachments/1170771441797566586/1174334633442291753/CCleaner.zip
- https://cdn.discordapp.com/attachments/1178661999073308722/1178746503800565770/dkoij12ndk1222.zip
- https://gya.com.bo/diubg12uin.php?id=1
- https://hangdrums.fr/pofoiwjeniofj12.php?id=1
- https://la-box-de-ginette.fr/iuhd9081j2dk21.php?id=1
- https://loventi.fr/ioj9d122.php?id=1
- https://mon-carnet-de-sante.fr/pqoicjein2.php?id=1
- https://ocube-consulting.fr/ofiuewq20o1.php?id=1
- https://onucleo.com.br/uhyvbdkjqwd.php?id=1
- https://reservation-taxig7.fr/oijppp1.php?id=1
- https://respostrong.com/appropriate-document
- https://respostrong.com/Logistics
- https://respostrong.com/ONEView
- https://sarl-walter.fr/okldmp1p2.php?id=1
- https://stags.bluekai.com/site/55241?redir=https://supportlights.com/appropriate
- https://supportlights.com/appropriate
- https://supportlights.com/CustomerResources
- https://verdemanzana.com.bo/idub12ud21.php?id=1
- https://wfc2.wiredforchange.com/dia/track.jsp?url=automaticamentes.com/maintenance
- https://www.crash-it.it/duyg12d.php?id=1
- https://www.electricite-carbonnier.fr/aaiund21dowww.php?id=1
- https://www.myoo.fr/okldmp1p2.php?id=1
- https://www.profsiena.it/ij0ddd.php?id=1
- https://www.rocher-notaires.fr/hjdj0dwo.php?id=1
SHA256
- 02f83db96dab784b58a52f3d21cac3c2f54638274d5e50303c676b6318114495
- 04000e5047b7195b11edf23f4c3a8c32fe7661ffec461139908ae4be4e179df3
- 1da26335f6b97cd216dd6188f607c6cd4169e99eca04bbacec75d22086045e75
- 32f13566e971a0e674407446b5735dbddb05e19dc96fdb57909a4c19f783f346
- 44289f86ed92181b750f49d0f6fc4f5be39dfcf3083c384cb0f531cbafd7576f
- 46cce8711f3857896a9a1c01d26da35ff7172cd399f9b821cd7da80d52d33fcf
- 7bae29a13839b2ad19368bff6c1af0099c6073302218e59019065852b5ba6736
- 80b33a175007e37759bc6f1ad34f8c88aafd45dc03fe452168db85ffec490809
- 85f8ab04c660547596cafd7335b0a57b0a55a4a7a6bb0b26bf249cdce6ef7046
- 880ab4ff495259f9f9ed395da29c009494c8243a987b55c6f08ed3bca6a76849
- b6d39183d106ffcd129541dfa8bed0bae54b61ce406e698be7faff5d779b7c32
- c6bc86a956c779ebf8333dad76ccfdb0cd9b4a18b24051a426fc0cec78e18814
- cf6d2322e1a9ea3d1b05171942922d5627b202d15ed33b9673ace501ebb47f92
- f14934239ed7038b8e3955e2b6f54fffd30d02fb3283c05be77bfe8ec7f6d521
