Overview

overview

10

Static

static

3

PHOTO-GOLAYA.exe

windows7-x64

8

PHOTO-GOLAYA.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    74f2a6406642b79a516e873a379fbf4b

  • Size

    124KB

  • Sample

    240125-tqvqpsbcgl

  • MD5

    74f2a6406642b79a516e873a379fbf4b

  • SHA1

    609f0748426d094b5555bb3f7a20a04a2ac40672

  • SHA256

    dc21b5ce1f8e1518045def5cb1a6917ac894bb679dd6cc8082f5b24375c94b2b

  • SHA512

    94489a45dab36d96f19b764859def4b51143578ad4e31bfb9b8106826ef9033265164b4dc48b8c0481f3ee19e09cfb9c057058a83dcb53b31ee5ba90d75a2882

  • SSDEEP

    3072:Vl0img13tG90HdQ3SqtRaAUjfdaBdE3SrmnbmO2M41Mmi:VljpD9Q3TtRq7Unrwy1Mmi

Score
10/10
kinsingdiscoveryloader

Malware Config

Targets

    • Target

      PHOTO-GOLAYA.exe

    • Size

      238KB

    • MD5

      466171c86c39f1266019f1386b78ad45

    • SHA1

      cf50984c43232cffb00e181597be92b5a118c65e

    • SHA256

      af2f6bc331ddbf6401b342e21947f949a92143d7f8dea3e6a1dcefca18bcefb2

    • SHA512

      162f43193b6e387ae9bbe77b099d62ad473f47b7dbfddb8e94fe75b3b7003035dadd9bb2e7069e8009eba74a6206784f54999f29ff5ea5a7463b086382018b4b

    • SSDEEP

      3072:QBAp5XhKpN4eOyVTGfhEClj8jTk+0h5TlWnC+Cgw5CKHG:HbXE9OiTGfhEClq9IlWzJJUG

    Score
    10/10
    discoverykinsingloader

    • Kinsing

      Kinsing is a loader written in Golang.

      loaderkinsing

    • Blocklisted process makes network request

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks