Extracted

Extracted

Extracted

Extracted

• • Target

    215ff81b6f3a50e48d9f5acfb89f5ea3a1afd59dddbb0666f7ce97a922f60326.lnk

  • Size

    3KB

  • MD5

    34ee898cb6c5ae305685129bd0b02ceb

  • SHA1

    72c04950fa82ea474c945f31dc3e7a32635689ae

  • SHA256

    215ff81b6f3a50e48d9f5acfb89f5ea3a1afd59dddbb0666f7ce97a922f60326

  • SHA512

    7bf440741559ffffda909092e32329635eed5a5afd31316f58a4080f8855c57d9399f4b25d6535a490e5c28727586209e3ff7c44c4d2e947c837ab58272b976d

  Score

  10^/10

  executionkoiloaderdefense_evasiondiscoveryloader

  • KoiLoader

    KoiLoader is a malware loader written in C++.

    loaderkoiloader

  • Koiloader family

    koiloader

  • Detects KoiLoader payload

    loader

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Indicator Removal: Clear Persistence

    Clear artifacts associated with previously established persistence like scheduletasks on a host.

    defense_evasion
  behavioral1behavioral2