Extracted

Extracted

• • Target

    chase_march_2025.lnk

  • Size

    1KB

  • MD5

    7d09c2f9087b81928f92fc87b635c008

  • SHA1

    a1db6b387af8021ad097f41586fb86680420e22e

  • SHA256

    311d17e119c43e123a8dc7178ec01366835e6b59300ac1c72b7dd2b5e7aaa9c0

  • SHA512

    5c214d877970eb70bb467fa95778ff35df4ade687bf0d3b54798441861b014fc3a4a65b07ed7474a7127591f214ca2437e91423fc8feb2929019b615cd3334ef

  Score

  10^/10

  koiloaderdefense_evasiondiscoveryexecutionloader

  • KoiLoader

    KoiLoader is a malware loader written in C++.

    loaderkoiloader

  • Koiloader family

    koiloader

  • Detects KoiLoader payload

    loader

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Indicator Removal: Clear Persistence

    Clear artifacts associated with previously established persistence like scheduletasks on a host.

    defense_evasion
  behavioral1