kinsing | 4e84e2831364f0a0b9c7d552e58b9706d0de6fae139942207af33f515dcae40b | Triage

Sharing

General

Target

74f37fe4cd2c65109465b9998183a657
Size

96KB
Sample

240125-trxlpabchr
MD5

74f37fe4cd2c65109465b9998183a657
SHA1

9419ff643ebd890e108c2732a40f9b3628b35a71
SHA256

4e84e2831364f0a0b9c7d552e58b9706d0de6fae139942207af33f515dcae40b
SHA512

95651b579b497f8a3f4b0eb42f90bd8a722a50b38e3b6c22133ae2390e68bad21d74f7fdc4a45fc43c8aa798c5775e87bf6cb20a6e1ed9c7e80ecb9b302b4a81
SSDEEP

1536:TE6gioIKlNjVMa3kWq46O4ont1jlZikJ4EjkBYCBsiq5u4CzUahE7jwaaHw7Kojw:IEra3kWtfnt1xZiYGBrqJI5U5jwaaHwm

Score

10^/10

kinsing ramnit banker evasion loader persistence spyware stealer trojan worm

Malware Config

Targets

- Target
  
  74f37fe4cd2c65109465b9998183a657
- Size
  
  96KB
- MD5
  
  74f37fe4cd2c65109465b9998183a657
- SHA1
  
  9419ff643ebd890e108c2732a40f9b3628b35a71
- SHA256
  
  4e84e2831364f0a0b9c7d552e58b9706d0de6fae139942207af33f515dcae40b
- SHA512
  
  95651b579b497f8a3f4b0eb42f90bd8a722a50b38e3b6c22133ae2390e68bad21d74f7fdc4a45fc43c8aa798c5775e87bf6cb20a6e1ed9c7e80ecb9b302b4a81
- SSDEEP
  
  1536:TE6gioIKlNjVMa3kWq46O4ont1jlZikJ4EjkBYCBsiq5u4CzUahE7jwaaHw7Kojw:IEra3kWtfnt1xZiYGBrqJI5U5jwaaHwm
Score

10^/10

ramnit banker evasion persistence spyware stealer trojan worm kinsing loader
- Kinsing
  Kinsing is a loader written in Golang.
  loader kinsing
- Modifies WinLogon for persistence
  persistence
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- UAC bypass
  evasion trojan
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ramnitbankerevasionpersistencespywarestealertrojanworm

behavioral2

kinsingramnitbankerloaderspywarestealertrojanworm