General
-
Target
7c8568685a386cfba733f330d0607fc54246801a6ccfc8b67c61acd11a0f695e.lnk
-
Size
2KB
-
Sample
240529-qyrr8sha73
-
MD5
6bf403f2f1c9d8382fff6ed5a3041899
-
SHA1
922df103fec71861594dc918678ad6af27b14851
-
SHA256
7c8568685a386cfba733f330d0607fc54246801a6ccfc8b67c61acd11a0f695e
-
SHA512
d235396894b5c82b1a5d282959f65a00bc2dc021fbabf71746994239b14559db09c4ad3be80a9c70829df0bf197407e64a44b88989fd2d420cb98d03119463e8
Static task
static1
Behavioral task
behavioral1
Sample
7c8568685a386cfba733f330d0607fc54246801a6ccfc8b67c61acd11a0f695e.lnk
Resource
win7-20240215-en
Malware Config
Extracted
koiloader
http://62.133.60.249/ground.php
-
payload_url
https://livingthemiraculouslife.com/assets/js
Targets
-
-
Target
7c8568685a386cfba733f330d0607fc54246801a6ccfc8b67c61acd11a0f695e.lnk
-
Size
2KB
-
MD5
6bf403f2f1c9d8382fff6ed5a3041899
-
SHA1
922df103fec71861594dc918678ad6af27b14851
-
SHA256
7c8568685a386cfba733f330d0607fc54246801a6ccfc8b67c61acd11a0f695e
-
SHA512
d235396894b5c82b1a5d282959f65a00bc2dc021fbabf71746994239b14559db09c4ad3be80a9c70829df0bf197407e64a44b88989fd2d420cb98d03119463e8
-
Detects KoiLoader payload
-
Blocklisted process makes network request
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-