Loading malware…
WikiLoader is a Windows malware downloader used to install additional payloads and associated with e-crime delivery operations targeting organizations, especially in Italy. First observed in late 2022, it has been linked to campaigns conducted by TA544 and TA551, and its use by multiple actors suggests it is shared or rented rather than exclusive to a single group. Observed follow-on payloads include Ursnif, including GroupID 5050 variants.
WikiLoader is notable for heavy obfuscation and layered execution. Reported variants use packed or highly obfuscated DLL stages, dynamic API resolution through Process Environment Block walking, encoded strings, shellcode decryption, and thread-context manipulation to transfer execution into decrypted payloads. It employs indirect syscalls, anti-hooking checks against native APIs, long stalling loops, internet-connectivity validation, and anti-sandbox logic such as terminating when environmental checks do not match expected real-world behavior. Some analyzed samples also injected shellcode into legitimate processes, modified code in loaded modules, and used explorer.exe process injection as part of later-stage execution.
Later variants gathered basic host information, encoded it, and transmitted it to command-and-control infrastructure via HTTP cookies before retrieving additional stage material. WikiLoader has also been observed retrieving path or decryption data from compromised web pages and using that information to obtain subsequent payloads. Public reporting indicates active development across multiple versions, with changes including more complex syscall handling, stronger obfuscation, artifact deletion, MQTT-based retrieval in one version lineage, and host-information exfiltration in later builds.
Observed delivery chains include malicious email campaigns using macro-enabled Excel attachments, OneNote attachments with embedded executables, and PDF lures leading to archived JavaScript downloaders. Campaign themes have included spoofed Italian government and courier communications as well as accounting-related lures. WikiLoader is best characterized as a sophisticated downloader focused on stealthy execution, environmental evasion, and reliable delivery of second-stage malware for financially motivated threat actors.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Proofpoint identified a new malware we call WikiLoader... WikiLoader is a sophisticated downloader with the objective of installing a second malware payload.
Proofpoint identified a new malware we call WikiLoader... WikiLoader is a sophisticated downloader with the objective of installing a second malware payload.
34 distinct techniques documented for this family, organized by ATT&CK tactic.
Campaigns began with emails containing either Microsoft Excel attachments, Microsoft OneNote attachments, or PDF attachments.
The Microsoft Excel attachments contained characteristic VBA macros which, if enabled by the recipient, would download and execute...WikiLoader.
If the JavaScript was executed by the recipient, it led to the download and execution of the packed downloader, WikiLoader.
Deobfuscation of strings through even positioned characters. The obfuscation is simple and is only based on getting the character sitting in an even position.
Stage 1 is the packed DLL. The use of packed downloaders is a common technique employed by threat actors to evade detection and analysis.
Using similar method to load API, the malware retrieves GetProcAddress() from the PEB. Retrieving once again API via PEB walking
To avoid this, from Process Hacker I opened the section created by CreateToolHelp32SnapShot and modified the hex values to match svchost.exe, and it worked.
NtSetContextThread -> Inside the context object in memory there is pointer referencing the start of injected code which will be the threads RIP.
Stage 3 is encrypted via a single byte XOR key and placed at the end of the stage 2 shellcode. Stage 2 finds a reference to the start of stage 3, decrypts it via the XOR key and transfers execution.
Function Used to load native API to perform indirect syscalls: ntdll.dll
Long busy loop to slow down execution. Anti analysis checks for common malware analysis tools (x64dbg.exe, pe-bear, process hacker etc.)
The loader then checks GetTickCount64... If the value returned is less than 125, the loader will make a request to a specified, hardcoded URL.
Full execution of the loader takes almost an hour given the abundance of busy loops.
For this, from the PEB it fetches the following API: CreateToolHelp32SnapShot Process32First Process32Next.
Gathers system information to send to C2 ... GetComputerNameA GetUserNameA IsUserAnAdmin GetUserDefaultUILanguage GetSystemTime
Long busy loop to slow down execution. Anti analysis checks for common malware analysis tools (x64dbg.exe, pe-bear, process hacker etc.)
The loader then checks GetTickCount64... If the value returned is less than 125, the loader will make a request to a specified, hardcoded URL.
On 11 July 2023, researchers identified additional changes to the actively developed malware in the protocol used for reaching compromised webhosts, exfiltration of host information via HTTP cookies... The second filename is pulled via the MQTT protocol rather than reaching the compromised webhosts.
Malware attempts to connect to the 8 hard-coded URLs and read the page... The requests are made to the URLs with cookie Cookie: jfkUg=75888210 + [BASE64 ENCODED SYSTEM DATA]
The second filename is pulled via the MQTT protocol rather than reaching the compromised webhosts.
the pages contain a tag containing the string "gmail", inside there is another obfuscated URL which contains the next stage payload.
61 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as another IAB-used malware exhibiting similar sandbox-evasion trends; no additional technical details provided in this content.
Referenced as another notable malware used by initial access brokers with similar evasion trends.
A newly identified, actively developed downloader/loader used in multiple campaigns, primarily targeting Italian organizations. It employs heavy obfuscation, indirect syscalls, staged shellcode, anti-analysis checks such as Wikipedia connectivity validation and bogus domain lookups, and retrieves later payload stages from compromised web hosts and Discord CDN resources.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.