Overview

overview

10

Static

static

10

2024-01-25...er.exe

windows7-x64

9

2024-01-25...er.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-01-25_635074331b22720dc167130b5d9689f8_cryptolocker

  • Size

    84KB

  • Sample

    240125-s1wkbahha6

  • MD5

    635074331b22720dc167130b5d9689f8

  • SHA1

    ee774be8d1a5c4b11107bc38e12d04c69753bd21

  • SHA256

    b296ee98ab66956634dc3d0017808c6271ea4bf7ed6707a2086548e993d00453

  • SHA512

    eee5f73fd785556be822a5d80c81649900320edccb4071ebe771c8719da721f3a91457930c6d25b11548d73055699018c8d07be79f01f0c1bc7a120a8c19d047

  • SSDEEP

    768:qkmnjFom/kLyMro2GtOOtEvwDpjeY10Y/YMsvlMdwPK80GQuchoIgtIcFo:qkmnpomddpMOtEvwDpjJGYQbN/PKwMgs

Score
10/10
kinsingloaderupx

Malware Config

Targets

    • Target

      2024-01-25_635074331b22720dc167130b5d9689f8_cryptolocker

    • Size

      84KB

    • MD5

      635074331b22720dc167130b5d9689f8

    • SHA1

      ee774be8d1a5c4b11107bc38e12d04c69753bd21

    • SHA256

      b296ee98ab66956634dc3d0017808c6271ea4bf7ed6707a2086548e993d00453

    • SHA512

      eee5f73fd785556be822a5d80c81649900320edccb4071ebe771c8719da721f3a91457930c6d25b11548d73055699018c8d07be79f01f0c1bc7a120a8c19d047

    • SSDEEP

      768:qkmnjFom/kLyMro2GtOOtEvwDpjeY10Y/YMsvlMdwPK80GQuchoIgtIcFo:qkmnpomddpMOtEvwDpjJGYQbN/PKwMgs

    Score
    10/10
    upxkinsingloader

    • Kinsing

      Kinsing is a loader written in Golang.

      loaderkinsing

    • Detection of CryptoLocker Variants

    • Detection of Cryptolocker Samples

    • UPX dump on OEP (original entry point)

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks