MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3523653959c0083b7e106a71dd99acc03ccf09cb3452b9b65dcf17005917e389. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


KoiStealer


Vendor detections: 10


Intelligence 10 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3523653959c0083b7e106a71dd99acc03ccf09cb3452b9b65dcf17005917e389
SHA3-384 hash: 4db762371a9fbaa4eed0e71b02e3aa23e12812afeca80c73588b287783c5bc7676c5fcc479cab4864fe67dcca987142d
SHA1 hash: d6f39e006f6eb3a3e2e3df6d448950d1f9948c7b
MD5 hash: 0e441e5a6db5f30f438ec363a00a68f3
humanhash: timing-high-hamper-october
File name:bank_statement_04_2025.zip
Download: download sample
Signature KoiStealer
Create hunting rule
File size:809 bytes
First seen:2025-05-10 00:44:06 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24:9M+tdsGxpJ/vsBKN6mTDQS7i21GPq5UtWDXP9he+8tdc:9lAGtvsi6sUS7RGy5UtOXnt
TLSH T1B90186852A26F4CDCDFE9E34034E8BE6082190C52109FEB7043885AB1C3751DD9CF825
Magika zip
Reporter Brad_malware
Tags:Koi KoiLoader KoiStealer zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
795
Origin country :
US US
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:bank_statement_04_2025.lnk
File size:1'415 bytes
SHA256 hash: 9e41baef8d2a8abc30a7e1dd1a946222b204d7d3183139cd793d1920c704e23d
MD5 hash: a7727b666db4909929ecb590fae94ec8
MIME type:application/octet-stream
Signature KoiStealer
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Lnk_Zip_1.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.30777.LnkHeur.UNOFFICIAL
Create hunting rule

TwinWave.EvilLNK.LOLBinOddLookPSHELL.20220711.UNOFFICIAL
Create hunting rule

TwinWave.EvilLNK.OddLook.202207213.UNOFFICIAL
Create hunting rule

TwinWave.EvilLNK.KingForADaypshell.20231121.UNOFFICIAL
Create hunting rule

TwinWave.EvilLNK.KingForADayDownloaders.20231121.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Zip.LNK-1.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=681ea2624a59e5a2ce037db2
Tags:
autorun cobalt emotet spoof
Result
Verdict:
Malicious
File Type:
LNK File - Malicious
Link:
https://app.docguard.net/3523653959c0083b7e106a71dd99acc03ccf09cb3452b9b65dcf17005917e389/results/dashboard
Payload URLs
URL
File name
https://www.wilkinsonbeane.com/css/slider/ynebhc.php';
LNK File
Behaviour
BlacklistAPI detected
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
fingerprint masquerade
Link:
https://www.filescan.io/uploads/681ea15abab2591d065569d7/reports/4f9f35c5-9de7-4591-ac75-4b4f5c566677/overview
Verdict:
Suspicious
Labled as:
Troj/LnkObf
Link:
https://www.hybrid-analysis.com/sample/3523653959c0083b7e106a71dd99acc03ccf09cb3452b9b65dcf17005917e389
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/3523653959c0083b7e106a71dd99acc03ccf09cb3452b9b65dcf17005917e389
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3523653959c0083b7e106a71dd99acc03ccf09cb3452b9b65dcf17005917e389/
Threat name:
Shortcut.Trojan.Vigorf
Create hunting rule
Status:
Malicious
First seen:
2025-05-10 00:44:12 UTC
File Type:
Binary (Archive)
Extracted files:
1
AV detection:
13 of 24 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gurwkokzyaedw7qqnjy53gnmya6m6colgrjltns5z4lqawix4oeq._file
Result
Malware family:
koistealer
Create hunting rule
Score:
  10/10
Tags:
family:koiloader family:koistealer defense_evasion discovery execution loader stealer
Link:
https://tria.ge/reports/250510-gsnzqavvcx/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Command and Scripting Interpreter: JavaScript
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Indicator Removal: Clear Persistence
Checks computer location settings
Blocklisted process makes network request
Command and Scripting Interpreter: PowerShell
Detects KoiLoader payload
Detects KoiStealer payload
KoiLoader
KoiStealer
Koiloader family
Koistealer family
Malware Config
C2 Extraction:
http://185.62.56.10/trounced.php
Dropper Extraction:
https://www.wilkinsonbeane.com/css/slider
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3523653959c0083b7e106a71dd99acc03ccf09cb3452b9b65dcf17005917e389

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Download_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies download artefacts in shortcut (LNK) files.
Rule name:PS_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies PowerShell artefacts in shortcut (LNK) files.
Rule name:Script_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies scripting artefacts in shortcut (LNK) files.
Rule name:SUSP_LNK_PowerShell
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects the reference to powershell inside an lnk file, which is suspicious
Rule name:SUSP_ZIP_LNK_PhishAttachment
Create hunting rule
Author:ignacior
Description:Detects suspicius tiny ZIP files with malicious lnk files
Reference:Internal Research
Rule name:SUSP_ZIP_LNK_PhishAttachment_Pattern_Jun22_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects suspicious tiny ZIP files with phishing attachment characteristics
Reference:Internal Research
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments