Extracted

Extracted

Extracted

Extracted

• • Target

    e02e837f8b43f14dd1de0c924fb9c7c2ead99fe1589bfb5126f120be5bc8599b.lnk

  • Size

    3KB

  • MD5

    ef8150f41db3c25684ff13470182898f

  • SHA1

    6a10b98d8cd2fb0fa641d282ea30fc196638b8cd

  • SHA256

    e02e837f8b43f14dd1de0c924fb9c7c2ead99fe1589bfb5126f120be5bc8599b

  • SHA512

    d7937781c09595c1b0c4a058929579a7499b7e28c67ef48f3ab6704a4c3b2b80cea38a1452f275e0b1205ddbabeeceaadf3c3fcd84be8fb6270904859eeff6c3

  Score

  10^/10

  executionkoiloaderdefense_evasiondiscoveryloader

  • KoiLoader

    KoiLoader is a malware loader written in C++.

    loaderkoiloader

  • Koiloader family

    koiloader

  • Detects KoiLoader payload

    loader

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Indicator Removal: Clear Persistence

    Clear artifacts associated with previously established persistence like scheduletasks on a host.

    defense_evasion
  behavioral1behavioral2