KoiVM
- First seen
- 2018-06-01 00:00:00
- Malware type
- loader
- Family
- Malware family
- Profile updated
- 2026-07-07 15:08:43
Context
KoiVM is a .NET virtualization and obfuscation tool commonly used to protect malware and hinder reverse-engineering efforts. It is often leveraged by threat actors to load malicious payloads while concealing the underlying code structure.
Reports & references
- malpedia.caad.fkie.fraunhofer.de — Win.Koivm (report)
- labs.k7computing.com — Koivm Loader Resurfaces With A Bang (report)