Overview

overview

10

Static

static

10

2024-01-25...er.exe

windows7-x64

9

2024-01-25...er.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-01-25_64fdc64c044746f778439ba1b1b97902_cryptolocker

  • Size

    104KB

  • Sample

    240125-t49rsabfdk

  • MD5

    64fdc64c044746f778439ba1b1b97902

  • SHA1

    d6070f79ac131f2484e733e96a371c7ec32871b4

  • SHA256

    73c33b3fd2aabc6066343750b520c791031afc832869269a926a936ac36ad414

  • SHA512

    9797a23b97ce2247903134c7a8c0954e89c7fdc23b7a9f4240a99ac9fc4cc522df460af762c87f320c0e63f0de7462fee7ec31f7393d66f83e68098b7a7ae5f3

  • SSDEEP

    1536:P8mnK6QFElP6n+gymddpMOtEvwDpjIHsalRn5iF1j6Gkslc:1nK6a+qdOOtEvwDpjy

Score
10/10
kinsingloaderupx

Malware Config

Targets

    • Target

      2024-01-25_64fdc64c044746f778439ba1b1b97902_cryptolocker

    • Size

      104KB

    • MD5

      64fdc64c044746f778439ba1b1b97902

    • SHA1

      d6070f79ac131f2484e733e96a371c7ec32871b4

    • SHA256

      73c33b3fd2aabc6066343750b520c791031afc832869269a926a936ac36ad414

    • SHA512

      9797a23b97ce2247903134c7a8c0954e89c7fdc23b7a9f4240a99ac9fc4cc522df460af762c87f320c0e63f0de7462fee7ec31f7393d66f83e68098b7a7ae5f3

    • SSDEEP

      1536:P8mnK6QFElP6n+gymddpMOtEvwDpjIHsalRn5iF1j6Gkslc:1nK6a+qdOOtEvwDpjy

    Score
    10/10
    upxkinsingloader

    • Kinsing

      Kinsing is a loader written in Golang.

      loaderkinsing

    • Detection of CryptoLocker Variants

    • Detection of Cryptolocker Samples

    • UPX dump on OEP (original entry point)

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks