Extracted

• • Target

    01022024_2134_wkldr_s2.bin

  • Size

    101KB

  • MD5

    76b14ca3b3d43d16563b4c06f3645ef3

  • SHA1

    9af64f5d5b9a918ebae6074200b37c7ff1369580

  • SHA256

    34f5759b0e7604dfcc245643aabdac6e24deb01976ee6b0a33b56ac50569c31f

  • SHA512

    e7659ede8fe819ad527edbf5ed96985b181f2b488f8638aa0fbdb0c3e26ae20784f8308ea0a7b358983e548da086628a4fc741cb91f0c567727a77f8f1c41ac5

  • SSDEEP

    3072:Tje2jdA5l+AtDCzGTGW3hevBm3DC5a7tG44x0iNVr5L+omPqUbb5HvT:Tje2jK5lLZCzbugBCux7PI

  Score

  10^/10

  wikiloaderbackdoorloaderpersistence

  • Wikiloader

    Wikiloader is a loader and backdoor written in C++.

    loaderbackdoorwikiloader

  • Modifies Installed Components in the registry

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral1behavioral2