General
-
Target
d87d9ff587e4068e5ccde72a4c9992fbf66e07d25040b2b64f2faecab58dee3e.zip
-
Size
1KB
-
Sample
240528-b1hvsahh8t
-
MD5
c0e73e2594e7ed035cbff8a50722c1a5
-
SHA1
31f7a3a8facc9e567c71f34d234d8852ed3f6798
-
SHA256
d87d9ff587e4068e5ccde72a4c9992fbf66e07d25040b2b64f2faecab58dee3e
-
SHA512
4f69a9d828137b973a80de2527ef9f779c6d245c2cbb8d98aa80d0bb65d0ef2f54d68d8975dd51c4f7e631407392fab755145a94b72c28af22a32433b893e0ee
Static task
static1
Behavioral task
behavioral1
Sample
Chasebank_Statement_May.lnk
Resource
win7-20240221-en
Malware Config
Extracted
koiloader
http://5.255.127.243/parietals.php
-
payload_url
https://livingthemiraculouslife.com/assets/js
Targets
-
-
Target
Chasebank_Statement_May.lnk
-
Size
2KB
-
MD5
6bf403f2f1c9d8382fff6ed5a3041899
-
SHA1
922df103fec71861594dc918678ad6af27b14851
-
SHA256
7c8568685a386cfba733f330d0607fc54246801a6ccfc8b67c61acd11a0f695e
-
SHA512
d235396894b5c82b1a5d282959f65a00bc2dc021fbabf71746994239b14559db09c4ad3be80a9c70829df0bf197407e64a44b88989fd2d420cb98d03119463e8
-
Detects KoiLoader payload
-
Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
-
Blocklisted process makes network request
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-