kinsing | 2e979470b3d1dce627499d443d3cc32e1f13c426836672f6cb8c776130d65879 | Triage

Sharing

General

Target

74ffc0a1c80aaf9c6ed0d41d11ccdf8a
Size

1000KB
Sample

240125-t8l7aaahe4
MD5

74ffc0a1c80aaf9c6ed0d41d11ccdf8a
SHA1

0ab7486015e53edc9dc1b7c08b7120cb32165dec
SHA256

2e979470b3d1dce627499d443d3cc32e1f13c426836672f6cb8c776130d65879
SHA512

b4a93ca848d34000337c96630a10f5ad294b2ef993ecebd25876e572a7bc568daca534b50d196e966d76840e6392a70205026f712e8f260f9f67482a8ad9eaa8
SSDEEP

24576:hFD6uKoaNNYxPA1Piah2b1Ao3QDGu1B+5vMiqt0gj2ed:fKoaNNYxYwah2d3KGcqOL

Score

10^/10

kinsing loader

Malware Config

Targets

- Target
  
  74ffc0a1c80aaf9c6ed0d41d11ccdf8a
- Size
  
  1000KB
- MD5
  
  74ffc0a1c80aaf9c6ed0d41d11ccdf8a
- SHA1
  
  0ab7486015e53edc9dc1b7c08b7120cb32165dec
- SHA256
  
  2e979470b3d1dce627499d443d3cc32e1f13c426836672f6cb8c776130d65879
- SHA512
  
  b4a93ca848d34000337c96630a10f5ad294b2ef993ecebd25876e572a7bc568daca534b50d196e966d76840e6392a70205026f712e8f260f9f67482a8ad9eaa8
- SSDEEP
  
  24576:hFD6uKoaNNYxPA1Piah2b1Ao3QDGu1B+5vMiqt0gj2ed:fKoaNNYxYwah2d3KGcqOL
Score

10^/10

kinsing loader
- Kinsing
  Kinsing is a loader written in Golang.
  loader kinsing
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2