kinsing | 321c221f6886487af722f5130018f7d4e259e1ce1f4c5ba1e1b820fbc8cecd18 | Triage

Submit
Reports

Overview

overview

Static

static

3

321c221f68...18.exe

windows7-x64

7

321c221f68...18.exe

windows10-2004-x64

Sharing

General

Target

321c221f6886487af722f5130018f7d4e259e1ce1f4c5ba1e1b820fbc8cecd18
Size

4.5MB
Sample

240125-szekeaagbk
MD5

edc9881fb8cb97d661a7eacd1e354772
SHA1

69c52fac385b6a5022c91ff6f1b43ffa05fc1dbe
SHA256

321c221f6886487af722f5130018f7d4e259e1ce1f4c5ba1e1b820fbc8cecd18
SHA512

73040495547beae4b62078d71642a53b4fb198fdf63511f00d76602e830d4be1248eec93872a5ec3a24e22b0e375c95fc98346c7aa01cfbf31cd1aaa8223d61d
SSDEEP

98304:TcLUHGONrwxm2lvozNrxzsW8iJdR2S0wJWSSBOi8zG8b7qlfMJg:TcLUmOxHegzNCW8iJXg587b7qBOg

Score

10^/10

kinsing discovery evasion loader trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

321c221f6886487af722f5130018f7d4e259e1ce1f4c5ba1e1b820fbc8cecd18.exe

Resource

win7-20231129-en

discovery evasion trojan

windows7-x64

13 signatures

150 seconds

Behavioral task

behavioral2

Sample

321c221f6886487af722f5130018f7d4e259e1ce1f4c5ba1e1b820fbc8cecd18.exe

Resource

win10v2004-20231222-en

kinsing discovery loader

windows10-2004-x64

16 signatures

150 seconds

Malware Config

Targets

- Target
  
  321c221f6886487af722f5130018f7d4e259e1ce1f4c5ba1e1b820fbc8cecd18
- Size
  
  4.5MB
- MD5
  
  edc9881fb8cb97d661a7eacd1e354772
- SHA1
  
  69c52fac385b6a5022c91ff6f1b43ffa05fc1dbe
- SHA256
  
  321c221f6886487af722f5130018f7d4e259e1ce1f4c5ba1e1b820fbc8cecd18
- SHA512
  
  73040495547beae4b62078d71642a53b4fb198fdf63511f00d76602e830d4be1248eec93872a5ec3a24e22b0e375c95fc98346c7aa01cfbf31cd1aaa8223d61d
- SSDEEP
  
  98304:TcLUHGONrwxm2lvozNrxzsW8iJdR2S0wJWSSBOi8zG8b7qlfMJg:TcLUmOxHegzNCW8iJXg587b7qBOg
Score

10^/10

discovery evasion trojan kinsing loader
- Kinsing
  Kinsing is a loader written in Golang.
  loader kinsing
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Drops desktop.ini file(s)
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasiontrojan

behavioral2

kinsingdiscoveryloader

© 2018-2024

Terms | Privacy