Overview

overview

10

Static

static

10

2024-01-25...er.exe

windows7-x64

9

2024-01-25...er.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-01-25_abde678804abc1e48e4299bbc79c2ae1_cryptolocker

  • Size

    100KB

  • Sample

    240125-s76nvsahel

  • MD5

    abde678804abc1e48e4299bbc79c2ae1

  • SHA1

    4d03fa2e7d3c7c3af1ba55176d5063b2f886dbcb

  • SHA256

    95289b2331840ab5b827779e7484064defba457eab240df2d4354d98bf9a6712

  • SHA512

    3f9c2e86245a345f1e6284ecd39370a0c44096660d2406d62f0cd9b3e9bc2300a63469567047885ac3470d2c21e1ac72ea1337ace3b6d9de0c18cdae78a0b3b4

  • SSDEEP

    768:XS5nQJ24LR1bytOOtEvwDpjNbZ7uyA36S7MpxRiWjzUNoz:i5nkFGMOtEvwDpjNbwQEIikgN0

Score
10/10
kinsingloader

Malware Config

Targets

    • Target

      2024-01-25_abde678804abc1e48e4299bbc79c2ae1_cryptolocker

    • Size

      100KB

    • MD5

      abde678804abc1e48e4299bbc79c2ae1

    • SHA1

      4d03fa2e7d3c7c3af1ba55176d5063b2f886dbcb

    • SHA256

      95289b2331840ab5b827779e7484064defba457eab240df2d4354d98bf9a6712

    • SHA512

      3f9c2e86245a345f1e6284ecd39370a0c44096660d2406d62f0cd9b3e9bc2300a63469567047885ac3470d2c21e1ac72ea1337ace3b6d9de0c18cdae78a0b3b4

    • SSDEEP

      768:XS5nQJ24LR1bytOOtEvwDpjNbZ7uyA36S7MpxRiWjzUNoz:i5nkFGMOtEvwDpjNbwQEIikgN0

    Score
    10/10
    kinsingloader

    • Kinsing

      Kinsing is a loader written in Golang.

      loaderkinsing

    • Detection of CryptoLocker Variants

    • Detection of Cryptolocker Samples

    • Detects executables built or packed with MPress PE compressor

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks