kinsing | c8d2ebd7c1154ab735edd09b522a81fd7ba30e2a8a068816f99f70e528b345e3 | Triage

Sharing

General

Target

74eb3ff3e97c504327f444040ca090db
Size

188KB
Sample

240125-tf61zsabh5
MD5

74eb3ff3e97c504327f444040ca090db
SHA1

5d698f7fdaac68db7eb1c78360fe74dc334783df
SHA256

c8d2ebd7c1154ab735edd09b522a81fd7ba30e2a8a068816f99f70e528b345e3
SHA512

9da5fc64a3ec60b8b91f23d4ebbcb7c1e5035561f1dd1c056ae97c77474b30455657ec2759c1b3a1b1d154333f51a24e585cbd07dc249d7b3c6cc54486780e1e
SSDEEP

3072:+T6gGr7qc5PS/mxFg+Ws9CUeXfgDyUcPYKiRh30jOV+iMJzUVaJ8a:+Ottx6gouv0O+dUVp

Score

10^/10

kinsing collection loader persistence

Malware Config

Targets

- Target
  
  74eb3ff3e97c504327f444040ca090db
- Size
  
  188KB
- MD5
  
  74eb3ff3e97c504327f444040ca090db
- SHA1
  
  5d698f7fdaac68db7eb1c78360fe74dc334783df
- SHA256
  
  c8d2ebd7c1154ab735edd09b522a81fd7ba30e2a8a068816f99f70e528b345e3
- SHA512
  
  9da5fc64a3ec60b8b91f23d4ebbcb7c1e5035561f1dd1c056ae97c77474b30455657ec2759c1b3a1b1d154333f51a24e585cbd07dc249d7b3c6cc54486780e1e
- SSDEEP
  
  3072:+T6gGr7qc5PS/mxFg+Ws9CUeXfgDyUcPYKiRh30jOV+iMJzUVaJ8a:+Ottx6gouv0O+dUVp
Score

10^/10

collection persistence kinsing loader
- Kinsing
  Kinsing is a loader written in Golang.
  loader kinsing
- Accesses Microsoft Outlook accounts
  collection
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

collectionpersistence

behavioral2

kinsingcollectionloaderpersistence