Extracted

Extracted

Extracted

• • Target

    citibank_feb_2025.lnk

  • Size

    1KB

  • MD5

    4faa35703e3c7a20143562b271ceca2f

  • SHA1

    2d87ff75eb532029ab63ed68971471589f28a847

  • SHA256

    7d7319a069e4ce6453f554bd52c6103db586c3615e8f1bbc59748b11b2c9a926

  • SHA512

    ab0659b71b2a6593a288d1fe869f3615dea4eb3684df62670f1bfb38b342a8a529fa933ee78743aa162d474ffaad7b9e381f6c3186d2bed798fb27f3bfa09133

  Score

  10^/10

  executionkoiloaderdefense_evasiondiscoveryloader

  • KoiLoader

    KoiLoader is a malware loader written in C++.

    loaderkoiloader

  • Koiloader family

    koiloader

  • Detects KoiLoader payload

    loader

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Indicator Removal: Clear Persistence

    Clear artifacts associated with previously established persistence like scheduletasks on a host.

    defense_evasion
  behavioral1behavioral2