Extracted

Extracted

• • Target

    chase_apr_2025.lnk

  • Size

    1KB

  • MD5

    36a9f6a6fe333f902077a73d990f0a4e

  • SHA1

    906818153a8ff4bf10cfb8615ff6b9021140623c

  • SHA256

    09ef17dc4284a8d1a8b937354bd8137aa9c0d98bffb897bd891ccff854484e43

  • SHA512

    cfc907e28c5069edc9e837b53f13377fbc015e1baba7401d1f3adb0bbdefa1dc95b830da58ef3b84e07ef8e8558d0b9b593e3d5c4c0d258cb50f0c8c73d5f5c7

  Score

  10^/10

  koiloaderdefense_evasiondiscoveryexecutionloader

  • KoiLoader

    KoiLoader is a malware loader written in C++.

    loaderkoiloader

  • Koiloader family

    koiloader

  • Detects KoiLoader payload

    loader

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Indicator Removal: Clear Persistence

    Clear artifacts associated with previously established persistence like scheduletasks on a host.

    defense_evasion
  behavioral1