Extracted

Extracted

• • Target

    02f27282ecc90843bd932d731c87426f78e4f88d79c66374ae06c6d1641c73cb.lnk

  • Size

    1KB

  • MD5

    202ee916a0113699880cc2e48a73d353

  • SHA1

    85d9b74b2afa5bf0320e746a2871ef614159db2e

  • SHA256

    02f27282ecc90843bd932d731c87426f78e4f88d79c66374ae06c6d1641c73cb

  • SHA512

    c729137c2680e98e9686d6a2368e184fc38897032d0d0bf1e1c5a84530cc45208bfc60085be768c027d4ce52b627a7f308458ac5ed480c32289bc5a0d7c0a35e

  Score

  10^/10

  executionkoiloaderdefense_evasiondiscoveryloader

  • KoiLoader

    KoiLoader is a malware loader written in C++.

    loaderkoiloader

  • Koiloader family

    koiloader

  • Detects KoiLoader payload

    loader

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Indicator Removal: Clear Persistence

    Clear artifacts associated with previously established persistence like scheduletasks on a host.

    defense_evasion
  behavioral1behavioral2