koiloader | 236d15aa8210dffa1e5fc94aa88395b5ccd4fe23e9f3641816f38384bee0ed71

Analysis

user interaction
yes
max time kernel
100s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 02:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
thyreocoridaeoAf.exe
Size 189KB
Sample260804-cvjessen8s
SHA256 236d15aa8210dffa1e5fc94aa88395b5ccd4fe23e9f3641816f38384bee0ed71
MD5 1e776abe2adc830216738ea68b43b274
SHA1 fcad7e2fbd01cf0d53e778e418bdaf7d378c6354
SHA512 2e48f72728e6271c4a459534d2f3f39e9c870c9e9c9be66f434a929ffc96b53093c8b689b0c64770741242151da3e596e27751a8d026c9f1390e52e4d825d521
SSDEEP 3072:QA+MPNsjU+g/Pu92PkWMW50y4jrv34ClUCeG+82dYrQxvMI/btQmVGCFS8J7Cv:XJPxktlKG+82d0Qx0+uYGCFF7Cv
TLSH
T1B5146C8172E59436DA66553A4DA4CCB48DFEF83057C38DDF13290EAD8EB8080993397B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery koiloader loader

Malware Config

Extracted

Family

koiloader

http://92.60.77.147/orthochlorite.php

Attributes

payload_url
https://immobiliareapi.it/wp-content/uploads/2021

Signatures

Family: KoiLoader
KoiLoader is a malware loader written in C++.
loader koiloader

Detects KoiLoader payload 1 IoCs

loader

resource	yara_rule
behavioral1/memory/4164-0-0x0000000000FB0000-0x0000000000FBD000-memory.dmp	family_koi_loader

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	thyreocoridaeoAf.exe

C:\Users\Admin\AppData\Local\Temp\thyreocoridaeoAf.exe
"C:\Users\Admin\AppData\Local\Temp\thyreocoridaeoAf.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4164-0-0x0000000000FB0000-0x0000000000FBD000-memory.dmp

Download