Overview

overview

10

Static

static

1

b3ea8b2b09...b9.exe

windows7-x64

7

b3ea8b2b09...b9.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b3ea8b2b094a3a5cc391fed2de9da24738e28ba87c90901869f349da0b51feb9

  • Size

    243KB

  • Sample

    240125-sywsasafhr

  • MD5

    c438937b3059fe33f600179c872145ee

  • SHA1

    95b3ede118e4b8d7c0a338a7edadbfcef3622b86

  • SHA256

    b3ea8b2b094a3a5cc391fed2de9da24738e28ba87c90901869f349da0b51feb9

  • SHA512

    2c7c64bc005e42afadbd05c0df097c888964ffb9cf4cb485d039417feaa3bd3b2c07f69f4c7a4c16e88a4c98f06a9e39cb4a99a4ccf8249267d7f477f6880783

  • SSDEEP

    6144:14iP/aK2h9nw/B+3ChmBV+UdvrEFp7hKiu:1RP/aK23eB+yYBjvrEH77u

Score
10/10
kinsingloaderpersistenceupx

Malware Config

Targets

    • Target

      b3ea8b2b094a3a5cc391fed2de9da24738e28ba87c90901869f349da0b51feb9

    • Size

      243KB

    • MD5

      c438937b3059fe33f600179c872145ee

    • SHA1

      95b3ede118e4b8d7c0a338a7edadbfcef3622b86

    • SHA256

      b3ea8b2b094a3a5cc391fed2de9da24738e28ba87c90901869f349da0b51feb9

    • SHA512

      2c7c64bc005e42afadbd05c0df097c888964ffb9cf4cb485d039417feaa3bd3b2c07f69f4c7a4c16e88a4c98f06a9e39cb4a99a4ccf8249267d7f477f6880783

    • SSDEEP

      6144:14iP/aK2h9nw/B+3ChmBV+UdvrEFp7hKiu:1RP/aK23eB+yYBjvrEH77u

    Score
    10/10
    upxkinsingloaderpersistence

    • Kinsing

      Kinsing is a loader written in Golang.

      loaderkinsing

    • Modifies AppInit DLL entries

      persistence

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks