Overview

overview

10

Static

static

3

74fa49f60a...12.exe

windows7-x64

7

74fa49f60a...12.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    74fa49f60a92b46d4a75f63167e62a12

  • Size

    431KB

  • Sample

    240125-t2ll6sbegm

  • MD5

    74fa49f60a92b46d4a75f63167e62a12

  • SHA1

    f2bb1d660002e095e8026981ea31f872f1535bc9

  • SHA256

    f687f07fb4757f2a43560c7e02e5aaa12f8e50c7ecb4d38a27307d87b8167f8d

  • SHA512

    3fd3b151671cd51cb522f2afbbdb5137525905a85169576abfbf0c8b5880326afa57f51ee272a281474911b593b8e360c62652c30c48942099485fe6b15bb31b

  • SSDEEP

    12288:hN1ASkD/alY8pAEoknoa8KOIT/QBD7Hv6dtb3Uj1:lASEC9pAEoA58BD+dtm1

Score
10/10
kinsingevasionloader

Malware Config

Targets

    • Target

      74fa49f60a92b46d4a75f63167e62a12

    • Size

      431KB

    • MD5

      74fa49f60a92b46d4a75f63167e62a12

    • SHA1

      f2bb1d660002e095e8026981ea31f872f1535bc9

    • SHA256

      f687f07fb4757f2a43560c7e02e5aaa12f8e50c7ecb4d38a27307d87b8167f8d

    • SHA512

      3fd3b151671cd51cb522f2afbbdb5137525905a85169576abfbf0c8b5880326afa57f51ee272a281474911b593b8e360c62652c30c48942099485fe6b15bb31b

    • SSDEEP

      12288:hN1ASkD/alY8pAEoknoa8KOIT/QBD7Hv6dtb3Uj1:lASEC9pAEoA58BD+dtm1

    Score
    10/10
    evasionkinsingloader

    • Kinsing

      Kinsing is a loader written in Golang.

      loaderkinsing

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks