Threat LensFile scan report

Is Koaloader.dll safe?

Item: Koaloader.dll
Rating: 3
Author: MalwareTips File Scanner

50/100

Safety rating

Insufficient evidence

Verdict

Unknown

46 of 74 antivirus engines flagged this file, but the available evidence does not yet support a reliable classification.

Verify before using

Do not run this file until the detections can be resolved. Prefer a copy downloaded directly from the publisher's official website.

Read the full analysis

Saved file evidenceAntivirus consensus

46of 74 flagged

Flagged 46No detection 28

Digital specimenKoaloader.dll2665a951793eac577c…1200c890a4cd00

Size2.1 MB

Code signingUnsigned

SandboxRuntime complete

First seen4y ago

Evidence3 priority signals

1 high-confidence signature or behavior rule matched this file.

Before using

Treat the file as unverified and avoid using it until more evidence is available.

If you already used it

Run a full device scan. Do not delete or replace the component manually. Quarantine it with your antivirus or repair the parent software from its official source.

Chapter 02

Intelligence

The saved assessment, checked against the scan evidence and recorded coverage.

Analyst conclusion

46 of 74 antivirus engines flagged this file, but the available evidence does not yet support a reliable classification.

Where this verdict could be wrong1 caveat

The current evidence is incomplete, so both a false positive and a previously unseen threat remain possible.

These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.

Recommended action

Do not run this file until the detections can be resolved. Prefer a copy downloaded directly from the publisher's official website.

Scan transparency

Coverage & freshness

4 of 5 complete

Complete means the check returned a usable result. It does not mean the file is safe.

Antivirus
Complete
46 of 74 engines flagged the file.
Updated Jul 14, 2026, 12:29 PM UTC
Sandbox
Complete
1 isolated runtime environment contributed observations.
Updated Aug 28, 2026, 9:24 PM UTC
Network
Partial
2 runtime contacts were observed without a completed reputation cross-check.
Updated Aug 28, 2026, 9:24 PM UTC
YARA
Complete
2 signature or behavior rules matched.
Updated Aug 28, 2026, 9:24 PM UTC
External intel
Complete
3 of 3 independent reference sources completed.
Updated Aug 28, 2026, 9:24 PM UTC

Chapter 03

Behavior

Plain-English impact first, then the observed runtime evidence.

Runtime flight recorder

Capture complete

1isolated sandbox run
21MITRE ATT&CK techniques
15spawned processes
2network contacts
40filesystem & mutex artifacts

Recorded behavior

Attack story

Runtime observations grouped by analysis stage. Arrows organize the stages; they do not claim chronology or causality.

ObservedDerived

Input file

The submitted object

FileObserved
Koaloader.dll
2665a951793eac577c89d9115aff15b3c69f87af4da15a93a81200c890a4cd00
01Uploaded file

Processes

Runtime execution

ProcessObserved
Observed process
"C:\Windows\System32\rundll32.exe" "C:\Users\<USER>\Desktop\library.dll",#1
02Isolated runtime analysis
ProcessObserved
Observed process
C:\Windows\SysWOW64\WerFault.exe -u -p 3576 -s 712
03Isolated runtime analysis
+1 more recorded observation in Analyst mode

Files

Created or changed

Written fileObserved
Temp
C:\ProgramData\Microsoft\Windows\WER\Temp
04Isolated runtime analysis
Written fileObserved
ef396630-f986-4029-bdee-e49fe8f0dc98
C:\ProgramData\Microsoft\Windows\WER\Temp\ef396630-f986-4029-bdee-e49fe8f0dc98
05Isolated runtime analysis
+1 more recorded observation in Analyst mode

Network

Hosts contacted

Contacted hostObserved
20.189.173.20
Contact observed during runtime.
06Isolated runtime analysis
Contacted hostObserved
20.189.173.21
Contact observed during runtime.
07Isolated runtime analysis
+1 more recorded observation in Analyst mode

7 recorded facts from one runtime window. Every fact remains independently traceable in Analyst mode.

Runtime behaviour

What this file did when executed

This file was detonated in 1 sandbox and its runtime behaviour was observed.

MITRE ATT&CK

Adversary techniques mapped to the MITRE ATT&CK framework.

T1016· Network reconT1018T1027· Obfuscated codeT1027.005· Obfuscated codeT1036T1047T1055· Process injectionT1056· KeyloggingT1057· Lists programsT1071· Application protocolT1082· System reconT1083· Scans your filesT1129· Loads modulesT1218.011T1497· Sandbox evasionT1497.001· Sandbox evasionT1518.001· Checks your AVT1542.003T1560T1562.001· Disables securityT1614

Spawned processes

$(unnamed)

"C:\Windows\System32\rundll32.exe" "C:\Users\<USER>\Desktop\library.dll",#1

$(unnamed)

C:\Windows\SysWOW64\WerFault.exe -u -p 3576 -s 712

$(unnamed)

C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\readme.dll"

$(unnamed)

C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

$(unnamed)

C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\readme.dll",#1

$(unnamed)

C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\readme.dll",#1

$(unnamed)

C:\Windows\SysWOW64\WerFault.exe -u -p 7696 -s 680

$(unnamed)

C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\readme.dll,GetFileVersionInfoA

+7 more processes captured.

Network activity

IP addresses2

20.189.173.20
20.189.173.21

Filesystem & mutexes

Files written15

C:\ProgramData\Microsoft\Windows\WER\Temp
C:\ProgramData\Microsoft\Windows\WER\Temp\ef396630-f986-4029-bdee-e49fe8f0dc98
C:\ProgramData\Microsoft\Windows\WER\ReportQueue
C:\ProgramData\Microsoft\Windows\WER\Temp\80c6830f-c17b-40dc-83d1-799e0c1dbce5
C:\ProgramData\Microsoft\Windows\WER\ReportArchive

+10 more

Files deleted15

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD512.tmp
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD7D3.tmp
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD9A8.tmp
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD512.tmp.dmp
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD7D3.tmp.WERInternalMetadata.xml

+10 more

Mutexes created10

Local\WERReportingForProcess3576
Global\AmiProviderMutex_InventoryApplicationFile
Global\c85a2a09-7373-403b-981c-27d7e5e8bf74
\Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7040
\Sessions\1\BaseNamedObjects\Global\AmiProviderMutex_InventoryApplicationFile

+5 more

Dropped payload

Files this sample writes at runtime

This file drops 10 children at runtime. None are currently flagged malicious in our cache.

10 unseen

54c6ae1271078d253092…3d6a50Never scanned
never seen before
64a924b7c77ecf0d502b…3ae7c0Never scanned
never seen before
6d1b90641f67a00e2e2e…db6941Never scanned
never seen before
e8062d0ad501d1fd5688…d57b7dNever scanned
never seen before
4c9b9cddf88da3f4c1b6…eafb46Never scanned
never seen before
383f643196395ce90dc8…1eab5dNever scanned
never seen before
327abf4291597851c160…4c5a84Never scanned
never seen before
4e526955cd6af2210c1c…f6a913Never scanned
never seen before
8790db1319b51dc169e5…7a5e48Never scanned
never seen before
6cf7f508ed578765979e…d53f03Never scanned
never seen before

Chapter 04

Detection & Forensics

Consensus, attribution, signatures, code structure, prevalence, and identity.

RecordedObserved or authoritative facts

DerivedEvidence-backed analyst inferences

2rule hits recorded
46 / 74engines flagged
1,207sources in submission history

Evidence provenance

Why these facts are shown

Each statement identifies whether it was directly recorded or derived from saved scan facts.

01
1 high-confidence signature or behavior rule matched this file.
Verdict inputView chapter
ProvenanceDerived
SourceSignature and behavior rules
Observed atAug 28, 2026, 9:24 PM UTC
02
46 of 74 antivirus engines flagged the file, including AhnLab-V3 and Alibaba.
Verdict inputView chapter
ProvenanceObserved
SourceAntivirus analysis
Observed atJul 14, 2026, 12:29 PM UTC
03
The hash has a long, established submission history across 1,207 sources.
View chapter
ProvenanceDerived
SourceSubmission history
Observed atJan 15, 2023, 5:16 PM UTC
04
Scanned file: Koaloader.dll — 2665a951793eac577c89d9115aff15b3c69f87af4da15a93a81200c890a4cd00
View chapter
ProvenanceObserved
SourceUploaded file
Observed atAug 28, 2026, 8:54 PM UTC
05
Observed process — "C:\Windows\System32\rundll32.exe" "C:\Users\<USER>\Desktop\library.dll",#1
View chapter
ProvenanceObserved
SourceIsolated runtime analysis
Observed atAug 28, 2026, 9:24 PM UTC
06
Observed process — C:\Windows\SysWOW64\WerFault.exe -u -p 3576 -s 712
View chapter
ProvenanceObserved
SourceIsolated runtime analysis
Observed atAug 28, 2026, 9:24 PM UTC
07
File written: Temp — C:\ProgramData\Microsoft\Windows\WER\Temp
View chapter
ProvenanceObserved
SourceIsolated runtime analysis
Observed atAug 28, 2026, 9:24 PM UTC
08
File written: ef396630-f986-4029-bdee-e49fe8f0dc98 — C:\ProgramData\Microsoft\Windows\WER\Temp\ef396630-f986-4029-bdee-e49fe8f0dc98
View chapter
ProvenanceObserved
SourceIsolated runtime analysis
Observed atAug 28, 2026, 9:24 PM UTC
09
Contacted host: 20.189.173.20 — Contact observed during runtime.
View chapter
ProvenanceObserved
SourceIsolated runtime analysis
Observed atAug 28, 2026, 9:24 PM UTC
10
Contacted host: 20.189.173.21 — Contact observed during runtime.
View chapter
ProvenanceObserved
SourceIsolated runtime analysis
Observed atAug 28, 2026, 9:24 PM UTC

Evidence map

Detection sources at a glance

4 completed · 0 unavailable

Antivirus

Threat match

46/74 flagged

Malware samples

No match

no match

Researcher rules

No match

no match

Reference software

No match

no match

Threat attribution

koder

The available sources did not agree on a named threat category.

External intelligence

No researcher-database hits

MalwareBazaar, YARAify, and CIRCL hashlookup completed and returned no entries for this hash.

Rule-based evidence

Signatures and behavior heuristics

A community signature or high-severity behavioral heuristic matched. Signatures identify known patterns; heuristics are strong leads but are not proof on their own.

2 heuristics

MITRE ATT&CK profile

Defense evasion× 1C2× 1

Behavior heuristics

Deterministic patterns derived from scan data and observed runtime behavior

ProcessInjection
T1055
high
The saved runtime evidence maps this activity to MITRE T1055 (Process Injection). The mapping supports possible process injection, but it does not prove the exact injection method or the operator's intent.
Evidence
"C:\Windows\System32\rundll32.exe" "C:\Users\<USER>\Desktop\library.dll",#1
DirectIpC2
T1071
medium
The sample contacted an external IP address directly and no application domain was recorded. Direct-IP traffic also occurs in legitimate installers and infrastructure, so this is supporting context only and requires corroboration from host reputation and other runtime evidence.
Evidence
20.189.173.20 · 20.189.173.21

Antivirus consensus

46 of 74 engines flagged this file

46 malicious0 suspicious28 not flagged

Tier-117 engines

12flagged

Tier-240 engines

22flagged

Low-trust17 engines

12flagged

AhnLab-V3malicious

Trojan/Win.Generic.R658986

Alibabamalicious

Trojan:Win32/Tnega.e408b27c

alibabacloudmalicious

Trojan:Win/Agent_AGen.AUP

ALYacmalicious

Generic.Trojan.Koder.Marte.A.16B3CFD5

Antiy-AVLmalicious

Trojan/Win32.Phonzy

Arcabitmalicious

Generic.Trojan.Koder.Marte.A.16B3CFD5

Avastmalicious

Win32:MalwareX-gen [Bd]

AVGmalicious

Win32:MalwareX-gen [Bd]

BitDefendermalicious

Generic.Trojan.Koder.Marte.A.16B3CFD5

Bkavmalicious

W32.Malware.B2E806F

CrowdStrikemalicious

win/malicious_confidence_100% (W)

CTXmalicious

dll.trojan.generic

Cylancemalicious

Unsafe

Cynetmalicious

Malicious (score: 100)

Elasticmalicious

malicious (high confidence)

Emsisoftmalicious

Generic.Trojan.Koder.Marte.A.16B3CFD5 (B)

Fortinetmalicious

W32/Agent.AAWO!tr

GDatamalicious

Generic.Trojan.Koder.Marte.A.16B3CFD5

Googlemalicious

Detected

Gridinsoftmalicious

Trojan.Win32.Wacatac.cl

huorongmalicious

Trojan/Agent.cnao!crit

Ikarusmalicious

PUA.KoalaLoader

K7AntiVirusmalicious

Trojan ( 005d57831 )

K7GWmalicious

Trojan ( 005d57831 )

Lionicmalicious

Trojan.Win32.Koder.4!c

Malwarebytesmalicious

Generic.Trojan.Malicious.DDS

MaxSecuremalicious

Trojan.Malware.198243764.susgen

McAfeeDmalicious

Trojan:Win/Dllhijacking.EAA

Microsoftmalicious

Trojan:Win32/Tnega!MSR

MicroWorld-eScanmalicious

Generic.Trojan.Koder.Marte.A.16B3CFD5

Paloaltomalicious

generic.ml

Pandamalicious

Trj/Chgt.AD

Risingmalicious

Trojan.Agent!8.B1E (CLOUD)

Skyhighmalicious

GenericRXVF-HH!7E92B09EE4FE

Sophosmalicious

Mal/Generic-S

Symantecmalicious

ML.Attribute.HighConfidence

TACHYONmalicious

Trojan/W32.Forwarded.Gen

Tencentmalicious

Malware.Win32.Gencirc.10bea0e5

TrellixENSmalicious

GenericRXVF-HH!7E92B09EE4FE

TrendMicromalicious

TROJ_GEN.R06BC0PAO23

TrendMicro-HouseCallmalicious

TROJ_GEN.R06BC0PAO23

Varistmalicious

W32/S-7753c51c!Eldorado

VBA32malicious

Trojan.DllHijacking

VIPREmalicious

Generic.Trojan.Koder.Marte.A.16B3CFD5

ViRobotmalicious

Trojan.Win.Z.Agent.2179072

Yandexmalicious

Trojan.Agent_AGen!91OrZBKIV6M

View all 74 engine results

AhnLab-V3DET

AlibabaDET

alibabacloudDET

ALYacDET

Antiy-AVLDET

ArcabitDET

AvastDET

AVGDET

BitDefenderDET

BkavDET

CrowdStrikeDET

CTXDET

CylanceDET

CynetDET

ElasticDET

EmsisoftDET

FortinetDET

GDataDET

GoogleDET

GridinsoftDET

huorongDET

IkarusDET

K7AntiVirusDET

K7GWDET

LionicDET

MalwarebytesDET

MaxSecureDET

McAfeeDDET

MicrosoftDET

MicroWorld-eScanDET

PaloaltoDET

PandaDET

RisingDET

SkyhighDET

SophosDET

SymantecDET

TACHYONDET

TencentDET

TrellixENSDET

TrendMicroDET

TrendMicro-HouseCallDET

VaristDET

VBA32DET

VIPREDET

ViRobotDET

YandexDET

AcronisOK

APEXOK

Avast-Mobiletyp

AviraOK

BitDefenderFalxtyp

CAT-QuickHealOK

ClamAVOK

CMCOK

DrWebOK

ESET-NOD32OK

F-SecureOK

JiangminOK

KasperskyOK

KingsoftOK

NANO-AntivirusOK

SangforOK

SentinelOneOK

SUPERAntiSpywareOK

SymantecMobileInsighttyp

tehtrisOK

TrapmineOK

Trustlooktyp

VirITOK

WebrootOK

XcitiumOK

ZillyaOK

ZoneAlarmOK

ZonerOK

PE forensics

Section entropy & packers

No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.

Unpacked

Section entropy5 sections

.text

6.62

.rdata

5.14

.data

4.92

.rsrc

3.74

.reloc

6.66

0.0Packed threshold 7.28.0

Prevalence

How widely this file has been seen

Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.

Common & old

Unique uploaders

1,207

Hundreds of people have uploaded this — common.

Total submissions

1,388

Includes repeat uploads by the same source.

First seen

4y ago

Jan 15, 2023

Prevalence quadrant

Rare · New

Needs evidence-led scrutiny

Common · New

Just-released software

Rare · Old

Niche or internal tooling

here

Common · Old

Often established software

File identity

Fingerprint and provenance

File name: Koaloader.dll
Format: Win32 DLL
Code signing: No verified publisher
Size: 2.1 MB
Last analyzed: Aug 28, 2026, 9:24 PM UTC

SHA-256

2665a951793eac577c89d9115aff15b3c69f87af4da15a93a81200c890a4cd00

Chapter 05

Safety & FAQ

Complete recovery guidance and answers for the next decision.

What to do now

There isn't enough information to give this file a clear rating.

Recovery step 01
Be cautious — an unknown rating is not the same as a clean bill of health.
Recovery step 02
Use it only as part of software obtained from the developer's official site or another source you independently trust.
Recovery step 03
When in doubt, don't use it — or scan it again later once it's more widely seen.

Safety FAQ

Direct answers grounded in the saved verdict and evidence in this report.

5 evidence-based answers

Is Koaloader.dll safe? What is it?

Evidence-based answer

We can't give Koaloader.dll a confident verdict yet. 46 of 74 antivirus engines flagged it, but the scan lacks enough reputation, identity, or observed-behaviour context for a reliable final call. Treat it as untrusted for now: don't use it unless you're certain of the source.

What is Koaloader.dll?

Evidence-based answer

Koaloader.dll is a Windows library or loadable module, about 2.1 MB. We identify a file by its cryptographic hash rather than its name, because the same filename can be reused by completely different files — the hash below is the reliable fingerprint.

How many antivirus engines detected Koaloader.dll?

Evidence-based answer

46 of 74 antivirus engines flagged Koaloader.dll, 46 of them as outright malicious. The raw count alone does not establish safety or danger; we also weigh which engines flagged it and corroborating behavior, identity, reputation, and rule evidence.

What is the SHA-256 hash of Koaloader.dll?

Evidence-based answer

The SHA-256 hash of Koaloader.dll is 2665a951793eac577c89d9115aff15b3c69f87af4da15a93a81200c890a4cd00, and its MD5 is 7e92b09ee4fe34c50415140a0c1130ab. This hash is the file's unique fingerprint — two files with the same SHA-256 are identical. Use it to confirm you're looking at exactly this file (not just one with the same name) when comparing against antivirus databases or a download's published checksum.

How up to date is this analysis of Koaloader.dll?

Evidence-based answer

This report reflects the scan run on August 28, 2026. Because a file's hash never changes, the identity of Koaloader.dll is fixed — but antivirus coverage improves over time, so a file that looks clean today can pick up detections later (and vice-versa). If you need the latest picture, MalwareTips staff can re-run the analysis from scratch.

Chapter 06

Community

Member reviews and reports for this exact file hash.

Is Koaloader.dll safe?

46 of 74 antivirus engines flagged this file, but the available evidence does not yet support a reliable classification.

Recommended next actions

Before using

If you already used it

What We Detected

Coverage & freshness

Antivirus

Sandbox

Network

YARA

External intel

Runtime flight recorder

Attack story

Koaloader.dll

Observed process

Observed process

Temp

ef396630-f986-4029-bdee-e49fe8f0dc98

20.189.173.20

20.189.173.21

Why these facts are shown

Detection sources at a glance

Fingerprint and provenance

What to do now