Overview

overview

10

Static

static

1

01_11_2024_stmnt.lnk

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    01_11_2024_stmnt.pdf.zip
  • Size 1KB
  • Sample241108-vbwj5avmax
  • SHA256 f2a993d66e959f8358bcb7023095655856c9f9a172c20a1b92042077a05a7916
  • MD5 SHA1 SHA512
Score
10/10
koiloaderdefense_evasiondiscoveryexecutionloader

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • ps1.dropper

    https://www.scuoladanzalibellula.it/wp-content/uploads/2020/04/stomachersjkl.php
  • exe.dropper

    https://www.scuoladanzalibellula.it/wp-content/uploads/2020/04/destineziteQaJxo.php

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    https://www.scuoladanzalibellula.it/wp-content/uploads/2020/04/nonmajoritieskvr.php
  • exe.dropper

    https://www.scuoladanzalibellula.it/wp-content/uploads/2020/04/uninwreathedslZC.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    https://www.scuoladanzalibellula.it/wp-content/uploads/2020/04/nonmajoritieskvr.php
  • exe.dropper

    https://www.scuoladanzalibellula.it/wp-content/uploads/2020/04/uninwreathedslZC.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    https://www.scuoladanzalibellula.it/wp-content/uploads/2020/04/nonmajoritieskvr.php
  • exe.dropper

    https://www.scuoladanzalibellula.it/wp-content/uploads/2020/04/uninwreathedslZC.ps1

Extracted

Family

  • koiloader

C2

  • http://82.118.19.30/stripper.php

Attributes
  • payload_url

    https://www.scuoladanzalibellula.it/wp-content/uploads/2020/04

Targets

    • Target
      01_11_2024_stmnt.lnk
    • Size 3KB
    • SHA256 12d59541e4ce7bdfe5c346151de3fec00f2d096d662b9762d50a36097d41829e
    • MD5 SHA1 SHA512
    Score
    10/10
    koiloaderdefense_evasiondiscoveryexecutionloader

    • KoiLoader

      KoiLoader is a malware loader written in C++.

      loaderkoiloader

    • Koiloader family

      koiloader

    • Detects KoiLoader payload

      loader

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

      execution

    • Indicator Removal: Clear Persistence

      Clear artifacts associated with previously established persistence like scheduletasks on a host.

      defense_evasion
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks