MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d3e4dfd4d8b165b33574d231be9b1d3c31d243cb145c79987a5f2f59554f4b77. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

KoiLoader

Vendor detections: 19

Intelligence 19 IOCs YARA 5 File information Comments

SHA256 hash:	d3e4dfd4d8b165b33574d231be9b1d3c31d243cb145c79987a5f2f59554f4b77
SHA3-384 hash:	5fffd8659f12d1e7aaac22616c23e730ec846df7abe484ea2f8dbc51ff746d10e5d42ef664b22c8b7b741ae9c421bcff
SHA1 hash:	767b157ab62347c827fcdeb2bbf02b199f038ade
MD5 hash:	484a42c7fea99e95c66a0f3365a51595
humanhash:	march-oranges-seven-lake
File name:	pieletJF.exe
Download:	download sample
Signature	KoiLoader Create hunting rule
File size:	278'528 bytes
First seen:	2025-11-14 13:04:51 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	66deda4204cb009d8c01c3f28c17567f (34 x KoiLoader, 2 x AZORult)
ssdeep	6144:1cqVD6AjBOLIERTEGEwC7BtmcbB389+0iOwVfWw2wgKu+IUbwhuCv:OqVDzoKjCv
Threatray	50 similar samples on MalwareBazaar
TLSH	T16B447CC3B1A51178E532B2770C1FADC85634E4181BCAEECB636A7D1A3FB58414F61C9A
TrID	40.3% (.EXE) Win64 Executable (generic) (10522/11/4) 19.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 17.2% (.EXE) Win32 Executable (generic) (4504/4/1) 7.7% (.EXE) OS/2 Executable (generic) (2029/13) 7.6% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
Reporter	skocherhan
Tags:	exe KoiLoader theoremaoliveoil-com

skocherhan

https://theoremaoliveoil.com/wp-content/uploads/2019/04/pieletJF.exe

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

pieletJF.exe

Verdict:

Suspicious activity

Analysis date:

2025-11-14 07:52:28 UTC

Tags:

anti-evasion

Link:

https://app.any.run/tasks/853b4151-788d-40f7-99f7-b18357bb3e21

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

KoiLoader

Link:

https://www.capesandbox.com/analysis/38204/

Detection(s):

SecuriteInfo.com.Trojan.PWS.Stealer.40606.UNOFFICIAL

Verdict:

Malicious

Score:

94.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6916dfbcbdb0ec3a9dc137d3

Tags:

emotet smarts micro

Result

Verdict:

Malware

Maliciousness:

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

microsoft_visual_cc

Link:

https://www.filescan.io/uploads/691729178f2fc32a22df8b46/reports/ba84f02b-2b00-46ef-ab56-42cfe9fe1890/overview

Verdict:

Malicious

Labled as:

Trojan.Injuke

Link:

https://www.hybrid-analysis.com/sample/d3e4dfd4d8b165b33574d231be9b1d3c31d243cb145c79987a5f2f59554f4b77

Verdict:

Malicious

File Type:

exe x32

First seen:

2025-11-14T04:56:00Z UTC

Last seen:

2025-11-14T10:19:00Z UTC

Hits:

~10

Detections:

VHO:Trojan.Win32.Injuke.gen VHO:Trojan.Win32.Injuke.ovoz Trojan.Win32.Injuke.ovoz

Link:

https://opentip.kaspersky.com/d3e4dfd4d8b165b33574d231be9b1d3c31d243cb145c79987a5f2f59554f4b77/results?tab=lookup

Malware family:

Kpot stealer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/c1c3c4fb-674a-482c-9c78-f8a0afabe03e

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/d3e4dfd4d8b165b33574d231be9b1d3c31d243cb145c79987a5f2f59554f4b77

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PDB Path PE (Portable Executable) PE File Layout Win 32 Exe x86

Link:

https://app.malva.re/file/484a42c7fea99e95c66a0f3365a51595

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d3e4dfd4d8b165b33574d231be9b1d3c31d243cb145c79987a5f2f59554f4b77/

Verdict:

Malicious

Threat:

Family.KOILOADER

Link:

https://tip.neiki.dev/file/d3e4dfd4d8b165b33574d231be9b1d3c31d243cb145c79987a5f2f59554f4b77

Threat name:

Win32.Trojan.KoiLoader

Status:

Malicious

First seen:

2025-11-14 07:52:29 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

32 of 38 (84.21%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=2psn7vgywfs3gnlu2iy35gy5hqy5eq6lcrohtgd2l4xvsvkpjn3q._file

Verdict:

malicious

Label(s):

koiloader

KoiLoader

3a046af1c31c9cebc7bb9065ddd0b5ad9123db196603c0bfc617d880b67da0d9

KoiLoader

7b5ecc5902604d7b2c8e8773f348c94ffeb6451fe90af241613b9f07a37bd914

KoiLoader

843cf9f337afde0f32670eefe73952c8f27d86dc46a6a32c25080e86b0bb5d01

KoiLoader

88d0ac70bbb1e9ac2c91028c5e0aa6f467327686c2fdb48ccfb4b1921ffd8c52

KoiLoader

b24c6d161435627fc07653f9cd7a6e80137ecf5369ac3782624dc352c1d5ccd7

KoiLoader

e959b372163c1ac6c0d5831684ce8e0c639b3fddb7a2c16c346342a9b4fe4d72

KoiLoader

+ 40 additional samples on MalwareBazaar

Result

Malware family:

koiloader

Score:

10/10

Tags:

family:koiloader discovery loader

Link:

https://tria.ge/reports/251114-qbpz5awran/

Behaviour

System Location Discovery: System Language Discovery

Detects KoiLoader payload

KoiLoader

Koiloader family

Malware Config

C2 Extraction:

http://2.58.15.233/maneuverable.php

Verdict:

Suspicious

Tags:

trojan

YARA:

Windows_Generic_Threat_1417511b

Link:

https://app.threat.zone/submission/dea5b7a8-c6d0-4271-94fd-c1aba1eecd25

Unpacked files

SH256 hash:

d3e4dfd4d8b165b33574d231be9b1d3c31d243cb145c79987a5f2f59554f4b77

MD5 hash:

484a42c7fea99e95c66a0f3365a51595

SHA1 hash:

767b157ab62347c827fcdeb2bbf02b199f038ade

Link:

https://www.unpac.me/results/7589f658-02fc-4420-8515-015dac823363/

SH256 hash:

8c2c3416255ebf0fec47395f32d582f6d283e8bffa1c73078dc0f3b194ce8ce0

MD5 hash:

274c77f7d4349223525bb8918f304024

SHA1 hash:

d9362c709898030f7c3cfb6ff5a448b6710d9d89

Detections:

win_koiloader_auto

win_mal_Koi_loader_decrypted

INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

Link:

https://www.unpac.me/results/7589f658-02fc-4420-8515-015dac823363/

Malware family:

KoiLoader

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/d3e4dfd4d8b1/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/d3e4dfd4d8b165b33574d231be9b1d3c31d243cb145c79987a5f2f59554f4b77

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	KoiLoader Create hunting rule
Author:	YungBinary
Description:	KoiLoader

Rule name:	Windows_Generic_Threat_1417511b Create hunting rule
Author:	Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

KoiLoader

exe d3e4dfd4d8b165b33574d231be9b1d3c31d243cb145c79987a5f2f59554f4b77

(this sample)

Cape

https://www.capesandbox.com/analysis/38204/

URLhaus

https://urlhaus.abuse.ch/url/3707697/

Delivery method

Distributed via web download

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample