Overview

overview

10

Static

static

1

Chasebank_...ay.lnk

windows7-x64

3

Chasebank_...ay.lnk

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d87d9ff587e4068e5ccde72a4c9992fbf66e07d25040b2b64f2faecab58dee3e.zip

  • Size

    1KB

  • Sample

    240528-rljfrsgf3t

  • MD5

    c0e73e2594e7ed035cbff8a50722c1a5

  • SHA1

    31f7a3a8facc9e567c71f34d234d8852ed3f6798

  • SHA256

    d87d9ff587e4068e5ccde72a4c9992fbf66e07d25040b2b64f2faecab58dee3e

  • SHA512

    4f69a9d828137b973a80de2527ef9f779c6d245c2cbb8d98aa80d0bb65d0ef2f54d68d8975dd51c4f7e631407392fab755145a94b72c28af22a32433b893e0ee

Score
10/10
koiloaderexecutionloader

Malware Config

Extracted

Family

koiloader

C2

http://5.255.127.243/parietals.php

Attributes
  • payload_url

    https://livingthemiraculouslife.com/assets/js

Targets

    • Target

      Chasebank_Statement_May.lnk

    • Size

      2KB

    • MD5

      6bf403f2f1c9d8382fff6ed5a3041899

    • SHA1

      922df103fec71861594dc918678ad6af27b14851

    • SHA256

      7c8568685a386cfba733f330d0607fc54246801a6ccfc8b67c61acd11a0f695e

    • SHA512

      d235396894b5c82b1a5d282959f65a00bc2dc021fbabf71746994239b14559db09c4ad3be80a9c70829df0bf197407e64a44b88989fd2d420cb98d03119463e8

    Score
    10/10
    executionkoiloaderloader

    • KoiLoader

      KoiLoader is a malware loader written in C++.

      loaderkoiloader

    • Detects KoiLoader payload

      loader

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

2
T1059

PowerShell

1
T1059.001

JavaScript

1
T1059.007

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks