Extracted

• • Target

    npp.8.6.3.portable.x64/notepad.exe

  • Size

    6.9MB

  • MD5

    2cd84602fc2428e0db00dbce5e20dc80

  • SHA1

    965a62dbba7cbb95b6a7694dc33963ffb105819a

  • SHA256

    4e271372528a9b439d99a7376fc1ac9c67884226a2f7bcbe2f68694c80548287

  • SHA512

    a6f715224a5e9ffb35833591bdc5cf1b76da479c2a6fd2108d921526708f918e6d5d2e9569c879d1d4c76e4606cdd271364b6f85acd8c811439bd08b61665fd2

  • SSDEEP

    98304:QtGdbdZUv5vuLYgtbUK5b8PTnwe65w/mod:Rdbvou8guK52TP6525

  Score

  10^/10

  wikiloaderbackdoorloaderpersistence

  • Wikiloader

    Wikiloader is a loader and backdoor written in C++.

    loaderbackdoorwikiloader

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies Installed Components in the registry

    persistence

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral1