Extracted

Extracted

• • Target

    chase_march_2025.lnk

  • Size

    1KB

  • MD5

    c8819ed5f7f4a9b309e01db14b458a60

  • SHA1

    1b78c2b3627814971f73c7fa2696d1119154ea07

  • SHA256

    5d736786036eeeaeb7a7c8b3652c76ca4c61a845619004e0b9bb679971da6a48

  • SHA512

    72e7d619453b60df925f2f593bb9ff3156c717e97354f1de6025f9de67c8ec7713dccc01988928072b271f20eca35168023fed06f084376db47b2a07be424f78

  Score

  10^/10

  koiloaderdefense_evasiondiscoveryexecutionloader

  • KoiLoader

    KoiLoader is a malware loader written in C++.

    loaderkoiloader

  • Koiloader family

    koiloader

  • Detects KoiLoader payload

    loader

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Indicator Removal: Clear Persistence

    Clear artifacts associated with previously established persistence like scheduletasks on a host.

    defense_evasion
  behavioral1