Overview

overview

10

Static

static

1

02c4d594c1...bc.exe

windows7-x64

8

02c4d594c1...bc.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    02c4d594c19a55d3ea2ab26766333d20441d364829d133f473864f6c4616f0bc

  • Size

    234KB

  • Sample

    240125-th2t2sacd5

  • MD5

    d51091dcf809f6f1285058e0bb1781b3

  • SHA1

    e7c1a4170dcbe2f131889e40ac3375f9ee6519ff

  • SHA256

    02c4d594c19a55d3ea2ab26766333d20441d364829d133f473864f6c4616f0bc

  • SHA512

    41aa7d7d40a8eb4b3a731c3a46c0d9c926f2671550bab3928521d0b4f4583622d9e49de5d7ad19b8060114106fb680719fcfe5ef6fe7ef1ef9e874f01540c484

  • SSDEEP

    3072:HwzvOYZi5YP/aKav6UvK9aobNI2B+JlIjDe7kal2n1TWl9o1B0C98CqtVFiDflu1:oiiP/aK999H/B+rTBV+UdvrEFp7hKY8

Score
10/10
kinsingloaderpersistenceupx

Malware Config

Targets

    • Target

      02c4d594c19a55d3ea2ab26766333d20441d364829d133f473864f6c4616f0bc

    • Size

      234KB

    • MD5

      d51091dcf809f6f1285058e0bb1781b3

    • SHA1

      e7c1a4170dcbe2f131889e40ac3375f9ee6519ff

    • SHA256

      02c4d594c19a55d3ea2ab26766333d20441d364829d133f473864f6c4616f0bc

    • SHA512

      41aa7d7d40a8eb4b3a731c3a46c0d9c926f2671550bab3928521d0b4f4583622d9e49de5d7ad19b8060114106fb680719fcfe5ef6fe7ef1ef9e874f01540c484

    • SSDEEP

      3072:HwzvOYZi5YP/aKav6UvK9aobNI2B+JlIjDe7kal2n1TWl9o1B0C98CqtVFiDflu1:oiiP/aK999H/B+rTBV+UdvrEFp7hKY8

    Score
    10/10
    persistenceupxkinsingloader

    • Kinsing

      Kinsing is a loader written in Golang.

      loaderkinsing

    • Modifies AppInit DLL entries

      persistence

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks