Overview

overview

10

Static

static

10

4952-0-0x0...ry.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4952-0-0x0000000001280000-0x000000000128D000-memory.dmp

  • Size

    52KB

  • MD5

    6364b6cf802f03ae6b8039dd74cbf929

  • SHA1

    332f2050da5b267f31db1cd08b3627259642ebc7

  • SHA256

    ae54d30f6a6b68fbf070724a4f22d58491336413a9261818db251b58b8783903

  • SHA512

    285ac0e2e366f64f694a2641a90d0c2e538a46d995faa9b35ba6b2c5539f94946e7a3da67c6b5a9baa6d3a4cc3b9b37c7418b353b790fd0b098893a796eee51c

  • SSDEEP

    1536:PN/K/fLIH9JNvka2TYh9mRe9FKldBHUQAEA3:kfLIdJNvkaUYh9we9F0dB0xEA

Score
10/10
loaderkoiloader

Malware Config

Extracted

Family

koiloader

C2

http://217.156.66.15/gnathopoda.php

Attributes
  • payload_url

    https://studiolegaledesanctis.eu/wp-content/uploads/2024/07

Signatures

  • Detects KoiLoader payload 1 IoCs
    loader
  • Koiloader family
    koiloader
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 4952-0-0x0000000001280000-0x000000000128D000-memory.dmp
    .exe windows:6 windows x86 arch:x86


    Headers

    Sections