Overview

overview

10

Static

static

3

74f36167bb...ff.exe

windows7-x64

7

74f36167bb...ff.exe

windows10-2004-x64

10

$PLUGINSDI...se.dll

windows7-x64

3

$PLUGINSDI...se.dll

windows10-2004-x64

10

$PLUGINSDI...se.rtf

windows7-x64

4

$PLUGINSDI...se.rtf

windows10-2004-x64

10

$PLUGINSDI...on.dll

windows7-x64

3

$PLUGINSDI...on.dll

windows10-2004-x64

10

$PLUGINSDIR/Math.dll

windows7-x64

3

$PLUGINSDIR/Math.dll

windows10-2004-x64

10

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

10

$PLUGINSDI...fo.dll

windows7-x64

3

$PLUGINSDI...fo.dll

windows10-2004-x64

10

$PLUGINSDI...ub.exe

windows7-x64

7

$PLUGINSDI...ub.exe

windows10-2004-x64

10

$PLUGINSDI...se.rtf

windows7-x64

4

$PLUGINSDI...se.rtf

windows10-2004-x64

10

$PLUGINSDI...se.rtf

windows7-x64

4

$PLUGINSDI...se.rtf

windows10-2004-x64

10

$PLUGINSDI...ib.dll

windows7-x64

3

$PLUGINSDI...ib.dll

windows10-2004-x64

10

$PLUGINSDI...BL.rtf

windows7-x64

4

$PLUGINSDI...BL.rtf

windows10-2004-x64

10

$PLUGINSDI...CF.rtf

windows7-x64

4

$PLUGINSDI...CF.rtf

windows10-2004-x64

10

$PLUGINSDI...DS.rtf

windows7-x64

4

$PLUGINSDI...DS.rtf

windows10-2004-x64

10

$PLUGINSDI...PC.rtf

windows7-x64

4

$PLUGINSDI...PC.rtf

windows10-2004-x64

10

$PLUGINSDI...IM.rtf

windows7-x64

4

$PLUGINSDI...IM.rtf

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    74f36167bb0157e9231e3e9f7eac08ff

  • Size

    852KB

  • Sample

    240125-trnnsabchn

  • MD5

    74f36167bb0157e9231e3e9f7eac08ff

  • SHA1

    01c13c259b952af84fe0059619965a3c41b8ec89

  • SHA256

    e5314ac3935f65cbdcb843a273978beee3f10825d1d5f9e6c900d408937be232

  • SHA512

    cc1182efc0b4e683e5326e59ff89eed03b03327c78fb2bfaf2eaae038dd1fa8f19d25dd7c8af9f74d6b286553abc0c461198d98d8229c66f817c3e8e285b0342

  • SSDEEP

    24576:OOHUjsjkycf3Eo63cbJd5A88vK9HCvKyp6HPfptX:Ohjs23Eo5bSXvKxCvKyMvRtX

Score
10/10
kinsingloaderspywarestealer

Malware Config

Targets

    • Target

      74f36167bb0157e9231e3e9f7eac08ff

    • Size

      852KB

    • MD5

      74f36167bb0157e9231e3e9f7eac08ff

    • SHA1

      01c13c259b952af84fe0059619965a3c41b8ec89

    • SHA256

      e5314ac3935f65cbdcb843a273978beee3f10825d1d5f9e6c900d408937be232

    • SHA512

      cc1182efc0b4e683e5326e59ff89eed03b03327c78fb2bfaf2eaae038dd1fa8f19d25dd7c8af9f74d6b286553abc0c461198d98d8229c66f817c3e8e285b0342

    • SSDEEP

      24576:OOHUjsjkycf3Eo63cbJd5A88vK9HCvKyp6HPfptX:Ohjs23Eo5bSXvKxCvKyMvRtX

    Score
    10/10
    spywarestealerkinsingloader

    • Kinsing

      Kinsing is a loader written in Golang.

      loaderkinsing

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

    • Target

      $PLUGINSDIR/CustomLicense.dll

    • Size

      4KB

    • MD5

      ca37f2747e04ae09ae9f14852574abef

    • SHA1

      e40bf34907337340520f368575c848ddb62f98c5

    • SHA256

      bbcab5c7e9f4b3f63184b23995e5b335a1c6ca5108aaa1be0eaf3fbf78afc1c4

    • SHA512

      ea781e646313bc458fba0ce66e357818725f385cb6c3383bb9c41dbb5221a6f43e3d8296aa3cbd5e8759d95d87a8eefa5f87665912fbc65c8eb4efcacabfdb60

    Score
    10/10
    kinsingloader
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/DefaultTab_license.rtf

    • Size

      14KB

    • MD5

      b97839b3cfe1f7e62ef09d5a2815ed81

    • SHA1

      e569ba28d4a88a6e23551b96b3cec0e710b99487

    • SHA256

      f2c89065a00e08202756cb383d3092b685dcec2075314f494df71bf8ec01fd11

    • SHA512

      227a2a1b5322dd183ca7463aec8613447b8670e97011e26286d2718571ca76a6206493aee2bb3c747bdd28892ee9820e3da58e3e69e0d42051e26b112aabc221

    • SSDEEP

      384:ZrPL4Pgxpgc7u2ucXCN6CCnNA9NDrclFyLkH4A2:9Og3gwu2u3N6CCnNAfAjHS

    Score
    10/10
    kinsingloader
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/GetVersion.dll

    • Size

      6KB

    • MD5

      5264f7d6d89d1dc04955cfb391798446

    • SHA1

      211d8d3e7c2b2f57f54a11cb8bc4fa536df08acc

    • SHA256

      7d76c7dd8f7cd5a87e0118dacb434db3971a049501e22a5f4b947154621ab3d4

    • SHA512

      80d27ee2f87e2822bd5c8c55cc3d1e49beebb86d8557c92b52b7cbea9f27882d80e59eefa25e414eecee268a9a6193b6b50b748de33c778b007cde24ef8bcfb7

    • SSDEEP

      96:E12Z84uiwpGTVTDSpaHYfniz0R3GhCvXY6Ix5vdR7pBi46AQ5Vu4:2STVTGwYhR3GhCvy5vH7pBi46AQ5Vu

    Score
    10/10
    kinsingloader
    behavioral7behavioral8

    • Target

      $PLUGINSDIR/Math.dll

    • Size

      66KB

    • MD5

      b140459077c7c39be4bef249c2f84535

    • SHA1

      c56498241c2ddafb01961596da16d08d1b11cd35

    • SHA256

      0598f7d83db44929b7170c1285457b52b4281185f63ced102e709bf065f10d67

    • SHA512

      fbcb19a951d96a216d73b6b3e005338bbb6e11332c6cc8c3f179ccd420b4db0e5682dc4245bd120dcb67bc70960eab368e74c68c7c165a485a12a7d0d8a00328

    • SSDEEP

      1536:0P43WZ4Ql60gam+2MwRmPeqFVHbQH0ZZ1Iet:0wU609VMH0T/t

    Score
    10/10
    kinsingloader
    behavioral10behavioral9

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      c17103ae9072a06da581dec998343fc1

    • SHA1

      b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

    • SHA256

      dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

    • SHA512

      d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

    • SSDEEP

      192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw

    Score
    10/10
    kinsingloader
    behavioral11behavioral12

    • Target

      $PLUGINSDIR/UserInfo.dll

    • Size

      4KB

    • MD5

      7579ade7ae1747a31960a228ce02e666

    • SHA1

      8ec8571a296737e819dcf86353a43fcf8ec63351

    • SHA256

      564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5

    • SHA512

      a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b

    Score
    10/10
    kinsingloader
    behavioral13behavioral14

    • Target

      $PLUGINSDIR/dllstub.exe

    • Size

      145KB

    • MD5

      7aa4254f40175172892359532d75e686

    • SHA1

      1d6e5294beb14a33fb7af206703faebdb889b6e2

    • SHA256

      f2be7c620524d4a824c0c43ec794c893f0552c88b7eb298e780400db02626120

    • SHA512

      da40e2487aea15960c56e9bec06f6c7e146f102d7f10c56e419d96c9eeacdbcf9a185d8e47aef57e3a7177cd2bd42a587c79e31597b69a8c24df8cb135fc397a

    • SSDEEP

      3072:sgXdZt9P6D3XJINhDmvKywTpU4OuvnpB1xTZG5jk2kNhD8:se34ODmvKyw1U47BpZtND8

    Score
    10/10
    kinsingloader

    • Kinsing

      Kinsing is a loader written in Golang.

      loaderkinsing

    • Loads dropped DLL

    behavioral15behavioral16

    • Target

      $PLUGINSDIR/frg_license.rtf

    • Size

      57KB

    • MD5

      7be0f88cc380caaf3efc805e14eb3c9b

    • SHA1

      28cfb260e938a81bd4eada0099e397ec83f2e619

    • SHA256

      5101a990a7d78e415958a8e803fae4b4a1de3601d9fb37dbb55f85e0644a85a3

    • SHA512

      a307c461dbb171f88972e2220a07f307a1f006f00a0369a935fb33c9af4d4cef62cc2e05ec9a9d84376778556ed201d10884319fbf9b35581bce71cbbf771c4c

    • SSDEEP

      768:GH6OyQAoYRJQQA5Vq7MYQQA5VqKMPQQA5Vq7MPQQA5VqUMPQQA5VqT81O3idRfOE:SpsxIUhd

    Score
    10/10
    kinsingloader
    behavioral17behavioral18

    • Target

      $PLUGINSDIR/gc_license.rtf

    • Size

      14KB

    • MD5

      5190bd8d892384b72d0a7f5eb4364eb0

    • SHA1

      4960e2af31f9dc90f6c8f864b8fb865150e76e97

    • SHA256

      cd47392546a0b63061e33a431debd341f21755d794b59d14b6272ae895725db3

    • SHA512

      718bd94078f78f074d6dee299aadd12041e1b7cee9a51aa8ce320477845d627259da76239ac1f10a87dd90135c1a9c83f65ddd6dc1eac4d18ef210a3cd2b6295

    • SSDEEP

      384:PMxEXYxvXulMRXk///JGGl/q7yJQCTLDJTLSjYC12xx:VXYx2lW0/3JGGl/q76QCTPJTWYC12xx

    Score
    10/10
    kinsingloader
    behavioral19behavioral20

    • Target

      $PLUGINSDIR/intlib.dll

    • Size

      24KB

    • MD5

      1efbbf5a54eb145a1a422046fd8dfb2c

    • SHA1

      ec4efd0a95bb72fd4cf47423647e33e5a3fddf26

    • SHA256

      983859570099b941c19d5eb9755eda19dd21f63e8ccad70f6e93f055c329d341

    • SHA512

      7fdeba8c961f3507162eb59fb8b9b934812d449cc85c924f61722a099618d771fed91cfb3944e10479280b73648a9a5cbb23482d7b7f8bfb130f23e8fd6c15fb

    • SSDEEP

      384:XErRo4TdlKCdUk6qz46qu2vPqUcnlSHmkuPJOiya4fF0Ac9khYLMkIX0+GvBgK3M:XiRoW7Kc5bBq1qNlSHmkuPJOJa4f4CD

    Score
    10/10
    kinsingloader
    behavioral21behavioral22

    • Target

      $PLUGINSDIR/license_BL.rtf

    • Size

      80KB

    • MD5

      007d1fccfd621cf3a8a829b1103c5f62

    • SHA1

      8f42d5f6644f933091ead409f414505ddf9789ae

    • SHA256

      cc6534428c6239f68d39ec82d1325c24e17e7e8085acd36ba1a61bbe22c4d4f6

    • SHA512

      0e03304c05f002e2bbd4321794b53da7bc37a4d55f56599e742d03b000fcf39435892d73f0947b3e885c15d7e1c3aee6c6f19228b41df9411ddca2c694d8f970

    • SSDEEP

      768:+M6bkuFuQAF6XcONYwIcCNftkpLvRYMHX6YXL5UMHX6YhL5UMHX6YyLvRYMHX6Ya:ZyBcDe+vISM93jWPUUOR

    Score
    10/10
    kinsingloader
    behavioral23behavioral24

    • Target

      $PLUGINSDIR/license_CF.rtf

    • Size

      624KB

    • MD5

      9bebf7fd933735c89253d8b55f4ba475

    • SHA1

      41d5716ce0615948695a2f57e39b544a6d9fb26f

    • SHA256

      359e418dba50c9249620bf3fd9a7a09ce5987377099e8ac793d805b9a33fa2f7

    • SHA512

      94c6d473030a9cd9c68e2d7d8bd53d40bbcacf575ec04ed45fba5a659c8c29fa7897ed7e1e2ea6b06413b6582ddbf6e7b8f61af2725d73ab3b8cc3ce4f39bb60

    • SSDEEP

      1536:bDbJpGL0DM1MvZPbVhEClfIBUrmYglv3g0URXJTrW1Ta3ugUm7:z7vZPbVhEClfIBUrmY2g0UBZEaerm7

    Score
    10/10
    kinsingloader
    behavioral25behavioral26

    • Target

      $PLUGINSDIR/license_GDS.rtf

    • Size

      29KB

    • MD5

      572c844641b7c89bd8e5c4b09db51eec

    • SHA1

      7db62a97beda7fc9082e324ac0bcef1fb6ddd8d3

    • SHA256

      9e4ada9fb4257e97feb8582c94f3a90c9a789d90c8cc45191eeffe7e90cf51c3

    • SHA512

      74209b504f03749121dc76e95057981d5130f4fed5b718f64e95634ad0f32ebc611a61e7761d338eb470dddaf85c70897eb9132f57b181afe5139f248bf69547

    • SSDEEP

      768:sWpF1sXIAbjZ+SjluFI7csb5ftkhL5UMHX6YZr/+nvwMwA2/Rk/CusmUHo:7L+fwR/q/lx

    Score
    10/10
    kinsingloader
    behavioral27behavioral28

    • Target

      $PLUGINSDIR/license_MLPC.rtf

    • Size

      48KB

    • MD5

      281d9ee1023a271ae94baa4f5311d642

    • SHA1

      e6f5436a259e38c2ba6ce1836cce802d68bea3c3

    • SHA256

      759b483399086ba4ed71d29144a8be3a46cf5a6dacca1c4f3c2d369c20f203f3

    • SHA512

      f06e2462688dfbbc22895b9109ceb651e44ea1cb8d47be213b31c98aabd8a76a93b004c7cc53db8e8efd77782f51b667363ada6709e1d1aefb16ba3cc71a7fee

    • SSDEEP

      768:I9rCh1UH4PgB4/Js24HbovQRDS7RK5rQvYXS77K5rQvYXS7UK5rQvYXS7TGl0nuG:+xDhEIl4BUrmuPSthlyCimOLUBu

    Score
    10/10
    kinsingloader
    behavioral29behavioral30

    • Target

      $PLUGINSDIR/license_SIM.rtf

    • Size

      78KB

    • MD5

      d3f90435b5e612a477c61daff6efa179

    • SHA1

      d172f773197878d9fa428852f19fd9beaad8e1fd

    • SHA256

      ef07f15e5a4d4495e86d5ec3056cee1bf88d081787d4c94c1246526116d89c53

    • SHA512

      4294bb15ac0dbbdfce3ed56f111b8ca0ff9fa8aec048f7489fbaffb30cc8a33fd413ace79edd38055b915f542714f521d075478e8a61299ba0512c8038d58aac

    • SSDEEP

      768:+M6bkuFuQAF6Xc/JMar+lvbRLc5rQvYXS7RK5rQvYXS77K5rQvYXS7UK5rQvYXSX:ZjVhEClfIBUrmYgttBAqXbX1QWA

    Score
    10/10
    kinsingloader
    behavioral31behavioral32

MITRE ATT&CK Enterprise v15

Tasks

static1

Score
3/10

behavioral1

spywarestealer
Score
7/10

behavioral2

kinsingloaderspywarestealer
Score
10/10

behavioral3

Score
3/10

behavioral4

kinsingloader
Score
10/10

behavioral5

Score
4/10

behavioral6

kinsingloader
Score
10/10

behavioral7

Score
3/10

behavioral8

kinsingloader
Score
10/10

behavioral9

Score
3/10

behavioral10

kinsingloader
Score
10/10

behavioral11

Score
3/10

behavioral12

kinsingloader
Score
10/10

behavioral13

Score
3/10

behavioral14

kinsingloader
Score
10/10

behavioral15

Score
7/10

behavioral16

kinsingloader
Score
10/10

behavioral17

Score
4/10

behavioral18

kinsingloader
Score
10/10

behavioral19

Score
4/10

behavioral20

kinsingloader
Score
10/10

behavioral21

Score
3/10

behavioral22

kinsingloader
Score
10/10

behavioral23

Score
4/10

behavioral24

kinsingloader
Score
10/10

behavioral25

Score
4/10

behavioral26

kinsingloader
Score
10/10

behavioral27

Score
4/10

behavioral28

kinsingloader
Score
10/10

behavioral29

Score
4/10

behavioral30

kinsingloader
Score
10/10

behavioral31

Score
4/10

behavioral32

kinsingloader
Score
10/10