Resubmissions

08/05/2025, 07:32

250508-jdcz1s1qz2 10

08/05/2025, 07:27

250508-jalgzsy1ay 6

General

  • Target

    https://sites.google.com/view/drive-cx8JrJ/pdf?hid=68545392

  • Sample

    250508-jdcz1s1qz2

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://maconsmallbusinesses.com/wp-content/uploads/2018/08

Extracted

Family

koiloader

C2

http://82.118.16.176/punctulum.php

Attributes
  • payload_url

    https://maconsmallbusinesses.com/wp-content/uploads/2018/08

Targets

    • Target

      https://sites.google.com/view/drive-cx8JrJ/pdf?hid=68545392

    • KoiLoader

      KoiLoader is a malware loader written in C++.

    • KoiStealer

      KoiStealer is an infostealer written in C#.

    • Koiloader family

    • Koistealer family

    • Detects KoiLoader payload

    • Detects KoiStealer payload

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Indicator Removal: Clear Persistence

      Clear artifacts associated with previously established persistence like scheduletasks on a host.

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v16

Tasks