Overview

overview

10

Static

static

3

74f381edf4...cf.exe

windows7-x64

7

74f381edf4...cf.exe

windows10-2004-x64

10

$PLUGINSDI...er.exe

windows7-x64

7

$PLUGINSDI...er.exe

windows10-2004-x64

10

$PLUGINSDI...se.rtf

windows7-x64

4

$PLUGINSDI...se.rtf

windows10-2004-x64

10

$PLUGINSDI...se.dll

windows7-x64

3

$PLUGINSDI...se.dll

windows10-2004-x64

10

$PLUGINSDI...se.rtf

windows7-x64

4

$PLUGINSDI...se.rtf

windows10-2004-x64

10

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

10

$PLUGINSDI...on.dll

windows7-x64

3

$PLUGINSDI...on.dll

windows10-2004-x64

10

$PLUGINSDI...se.rtf

windows7-x64

4

$PLUGINSDI...se.rtf

windows10-2004-x64

1

$PLUGINSDIR/Math.dll

windows7-x64

3

$PLUGINSDIR/Math.dll

windows10-2004-x64

10

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

10

$PLUGINSDI...fo.dll

windows7-x64

3

$PLUGINSDI...fo.dll

windows10-2004-x64

10

$PLUGINSDI...dl.exe

windows7-x64

7

$PLUGINSDI...dl.exe

windows10-2004-x64

10

$PLUGINSDI...se.rtf

windows7-x64

4

$PLUGINSDI...se.rtf

windows10-2004-x64

10

$PLUGINSDI...se.rtf

windows7-x64

4

$PLUGINSDI...se.rtf

windows10-2004-x64

10

$PLUGINSDI...ib.dll

windows7-x64

3

$PLUGINSDI...ib.dll

windows10-2004-x64

10

$PLUGINSDI...BL.rtf

windows7-x64

4

$PLUGINSDI...BL.rtf

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    74f381edf4612bfc6dd97e7a49d65dcf

  • Size

    996KB

  • Sample

    240125-trzfaaaea8

  • MD5

    74f381edf4612bfc6dd97e7a49d65dcf

  • SHA1

    07c7c7c83e577b1dc4bce2ab3a79c2d63622a715

  • SHA256

    578928c21365636a5901841722431bc78f5c13b31ccc7cf81a7ead52f9db8457

  • SHA512

    71f07230a52458215805dda92a37b65ec677de29336f6ed28b555ebc2faf00a257fb3da20fe8fd7dcc6c68e692f1404ee0c8c532651c5586aec401b6ba28918c

  • SSDEEP

    24576:wH+5sjkZczo63M87oYbJd5A8uvKovKSHPf4xVv53:rsloTYBbSDvKovKSvgxVvd

Score
10/10
kinsingdiscoveryloaderspywarestealer

Malware Config

Targets

    • Target

      74f381edf4612bfc6dd97e7a49d65dcf

    • Size

      996KB

    • MD5

      74f381edf4612bfc6dd97e7a49d65dcf

    • SHA1

      07c7c7c83e577b1dc4bce2ab3a79c2d63622a715

    • SHA256

      578928c21365636a5901841722431bc78f5c13b31ccc7cf81a7ead52f9db8457

    • SHA512

      71f07230a52458215805dda92a37b65ec677de29336f6ed28b555ebc2faf00a257fb3da20fe8fd7dcc6c68e692f1404ee0c8c532651c5586aec401b6ba28918c

    • SSDEEP

      24576:wH+5sjkZczo63M87oYbJd5A8uvKovKSHPf4xVv53:rsloTYBbSDvKovKSvgxVvd

    Score
    10/10
    discoveryspywarestealerkinsingloader

    • Kinsing

      Kinsing is a loader written in Golang.

      loaderkinsing

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

    • Target

      $PLUGINSDIR/215AppsChecker.exe

    • Size

      39KB

    • MD5

      420320e78490a36cf23cb17ffbb13358

    • SHA1

      fcf1151c22f9b8c9e29ec6387b38e6b040bd196e

    • SHA256

      bc13af4eb6cc4917d617785d7e4ad09f64745a9cf06354833e815e9229ce8dcf

    • SHA512

      fe2774fd095c3a3b51b01a1da1c5fcd49b53f939b647c84cdfd3c243cb74644ca2909971bc87d3e5c8781a93c27ac3ef7691625a024008b4f1ffba4c947cd023

    • SSDEEP

      768:KHJd0TpH2+bQ2dUWVX9Hfv1JMWmtLEJOyuBxG0D3mjfS3XJv68Br3czgr:KpgpHzb9dZVX9fHMvG0D3XJvhcu

    Score
    10/10
    kinsingloader

    • Kinsing

      Kinsing is a loader written in Golang.

      loaderkinsing

    • Loads dropped DLL

    behavioral3behavioral4

    • Target

      $PLUGINSDIR/AnimalShopping_license.rtf

    • Size

      102KB

    • MD5

      b9f0a9106d9c55d17ec154ae8c736688

    • SHA1

      529b0a0821e8acb5ab0d95d8fa10b24110264422

    • SHA256

      3e76b19f84b09bdf29a841978d19290ccaa6aeea46676eb89e9a02f977704332

    • SHA512

      5dec17fdf3e9685b370707f9b65848414ad3db09fd30a56096b25af5872ff7276d03d2a854f0573ce98963627795b1aee1ee9fe738cc3a2320d9c572cba863c8

    • SSDEEP

      3072:rCnlb8SacXMYUGL/IpJZ9zzNA5Kv1kCn6:O+g/IpJDzzNA5Kv1kC6

    Score
    10/10
    kinsingloader
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/CustomLicense.dll

    • Size

      4KB

    • MD5

      ca37f2747e04ae09ae9f14852574abef

    • SHA1

      e40bf34907337340520f368575c848ddb62f98c5

    • SHA256

      bbcab5c7e9f4b3f63184b23995e5b335a1c6ca5108aaa1be0eaf3fbf78afc1c4

    • SHA512

      ea781e646313bc458fba0ce66e357818725f385cb6c3383bb9c41dbb5221a6f43e3d8296aa3cbd5e8759d95d87a8eefa5f87665912fbc65c8eb4efcacabfdb60

    Score
    10/10
    kinsingloader
    behavioral7behavioral8

    • Target

      $PLUGINSDIR/DefaultTab_license.rtf

    • Size

      14KB

    • MD5

      b97839b3cfe1f7e62ef09d5a2815ed81

    • SHA1

      e569ba28d4a88a6e23551b96b3cec0e710b99487

    • SHA256

      f2c89065a00e08202756cb383d3092b685dcec2075314f494df71bf8ec01fd11

    • SHA512

      227a2a1b5322dd183ca7463aec8613447b8670e97011e26286d2718571ca76a6206493aee2bb3c747bdd28892ee9820e3da58e3e69e0d42051e26b112aabc221

    • SSDEEP

      384:ZrPL4Pgxpgc7u2ucXCN6CCnNA9NDrclFyLkH4A2:9Og3gwu2u3N6CCnNAfAjHS

    Score
    10/10
    kinsingloader
    behavioral10behavioral9

    • Target

      $PLUGINSDIR/FindProcDLL.dll

    • Size

      3KB

    • MD5

      8614c450637267afacad1645e23ba24a

    • SHA1

      e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2

    • SHA256

      0fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758

    • SHA512

      af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b

    Score
    10/10
    kinsingloader
    behavioral11behavioral12

    • Target

      $PLUGINSDIR/GetVersion.dll

    • Size

      6KB

    • MD5

      5264f7d6d89d1dc04955cfb391798446

    • SHA1

      211d8d3e7c2b2f57f54a11cb8bc4fa536df08acc

    • SHA256

      7d76c7dd8f7cd5a87e0118dacb434db3971a049501e22a5f4b947154621ab3d4

    • SHA512

      80d27ee2f87e2822bd5c8c55cc3d1e49beebb86d8557c92b52b7cbea9f27882d80e59eefa25e414eecee268a9a6193b6b50b748de33c778b007cde24ef8bcfb7

    • SSDEEP

      96:E12Z84uiwpGTVTDSpaHYfniz0R3GhCvXY6Ix5vdR7pBi46AQ5Vu4:2STVTGwYhR3GhCvy5vH7pBi46AQ5Vu

    Score
    10/10
    kinsingloader
    behavioral13behavioral14

    • Target

      $PLUGINSDIR/Iminent_license.rtf

    • Size

      56KB

    • MD5

      f8578ff6185b661fe345208408091619

    • SHA1

      981078df6188ffc4566dda762df40cf6c19b4bd4

    • SHA256

      6936713a7d1a89e13b2d08038a5d5c5774d7611b218d2ba8da556efe28add6b5

    • SHA512

      b4229e80226bde268b2d847b9d0993d6a70a5b1f9eb44c8a225e1d0d035ca4b6a792d47ce9ab8b127b23e1d2fba75d9b502afb39ca98583d0eaa3d07c5508288

    • SSDEEP

      768:aE6m+kHbNZ/caU0MI6M1/caU0MI6Mn/caU0MI6MQ/caU0MI6Mvejq6CRFQ5/caU4:Nj/lb8W3YncXMYXip7LJKL9cO9

    Score
    4/10
    behavioral15behavioral16

    • Target

      $PLUGINSDIR/Math.dll

    • Size

      66KB

    • MD5

      b140459077c7c39be4bef249c2f84535

    • SHA1

      c56498241c2ddafb01961596da16d08d1b11cd35

    • SHA256

      0598f7d83db44929b7170c1285457b52b4281185f63ced102e709bf065f10d67

    • SHA512

      fbcb19a951d96a216d73b6b3e005338bbb6e11332c6cc8c3f179ccd420b4db0e5682dc4245bd120dcb67bc70960eab368e74c68c7c165a485a12a7d0d8a00328

    • SSDEEP

      1536:0P43WZ4Ql60gam+2MwRmPeqFVHbQH0ZZ1Iet:0wU609VMH0T/t

    Score
    10/10
    kinsingloader
    behavioral17behavioral18

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      c17103ae9072a06da581dec998343fc1

    • SHA1

      b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

    • SHA256

      dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

    • SHA512

      d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

    • SSDEEP

      192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw

    Score
    10/10
    kinsingloader
    behavioral19behavioral20

    • Target

      $PLUGINSDIR/UserInfo.dll

    • Size

      4KB

    • MD5

      7579ade7ae1747a31960a228ce02e666

    • SHA1

      8ec8571a296737e819dcf86353a43fcf8ec63351

    • SHA256

      564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5

    • SHA512

      a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b

    Score
    10/10
    kinsingloader
    behavioral21behavioral22

    • Target

      $PLUGINSDIR/dlhelpdl.exe

    • Size

      129KB

    • MD5

      af636418ff8f6b0c1af960a999a8911a

    • SHA1

      90198f23bd13b1d3692b077b82806bcdb6159a3a

    • SHA256

      4ea3e48f8525aa98a957bfb472e81489cbd2fcf17e7004d8515493bcf7919f46

    • SHA512

      25d44b519b0f1b490bd23f6d59abd11213894a992552b5d2416a0b8260501e4f6e53def651bbf815961d38ae2f3aa9b39295b96af98f26ac34bd66552ec638f8

    • SSDEEP

      3072:sgXdZt9P6D3XJw9EdzQIJYToTkNhDmvKyOuS1OV82MW48EOkNhDw:se34yadz2TTDmvKy7S1OV82MpFDw

    Score
    10/10
    kinsingloader

    • Kinsing

      Kinsing is a loader written in Golang.

      loaderkinsing

    • Loads dropped DLL

    behavioral23behavioral24

    • Target

      $PLUGINSDIR/frg_license.rtf

    • Size

      57KB

    • MD5

      7be0f88cc380caaf3efc805e14eb3c9b

    • SHA1

      28cfb260e938a81bd4eada0099e397ec83f2e619

    • SHA256

      5101a990a7d78e415958a8e803fae4b4a1de3601d9fb37dbb55f85e0644a85a3

    • SHA512

      a307c461dbb171f88972e2220a07f307a1f006f00a0369a935fb33c9af4d4cef62cc2e05ec9a9d84376778556ed201d10884319fbf9b35581bce71cbbf771c4c

    • SSDEEP

      768:GH6OyQAoYRJQQA5Vq7MYQQA5VqKMPQQA5Vq7MPQQA5VqUMPQQA5VqT81O3idRfOE:SpsxIUhd

    Score
    10/10
    kinsingloader
    behavioral25behavioral26

    • Target

      $PLUGINSDIR/gc_license.rtf

    • Size

      14KB

    • MD5

      5190bd8d892384b72d0a7f5eb4364eb0

    • SHA1

      4960e2af31f9dc90f6c8f864b8fb865150e76e97

    • SHA256

      cd47392546a0b63061e33a431debd341f21755d794b59d14b6272ae895725db3

    • SHA512

      718bd94078f78f074d6dee299aadd12041e1b7cee9a51aa8ce320477845d627259da76239ac1f10a87dd90135c1a9c83f65ddd6dc1eac4d18ef210a3cd2b6295

    • SSDEEP

      384:PMxEXYxvXulMRXk///JGGl/q7yJQCTLDJTLSjYC12xx:VXYx2lW0/3JGGl/q76QCTPJTWYC12xx

    Score
    10/10
    kinsingloader
    behavioral27behavioral28

    • Target

      $PLUGINSDIR/intlib.dll

    • Size

      24KB

    • MD5

      1efbbf5a54eb145a1a422046fd8dfb2c

    • SHA1

      ec4efd0a95bb72fd4cf47423647e33e5a3fddf26

    • SHA256

      983859570099b941c19d5eb9755eda19dd21f63e8ccad70f6e93f055c329d341

    • SHA512

      7fdeba8c961f3507162eb59fb8b9b934812d449cc85c924f61722a099618d771fed91cfb3944e10479280b73648a9a5cbb23482d7b7f8bfb130f23e8fd6c15fb

    • SSDEEP

      384:XErRo4TdlKCdUk6qz46qu2vPqUcnlSHmkuPJOiya4fF0Ac9khYLMkIX0+GvBgK3M:XiRoW7Kc5bBq1qNlSHmkuPJOJa4f4CD

    Score
    10/10
    kinsingloader
    behavioral29behavioral30

    • Target

      $PLUGINSDIR/license_BL.rtf

    • Size

      80KB

    • MD5

      007d1fccfd621cf3a8a829b1103c5f62

    • SHA1

      8f42d5f6644f933091ead409f414505ddf9789ae

    • SHA256

      cc6534428c6239f68d39ec82d1325c24e17e7e8085acd36ba1a61bbe22c4d4f6

    • SHA512

      0e03304c05f002e2bbd4321794b53da7bc37a4d55f56599e742d03b000fcf39435892d73f0947b3e885c15d7e1c3aee6c6f19228b41df9411ddca2c694d8f970

    • SSDEEP

      768:+M6bkuFuQAF6XcONYwIcCNftkpLvRYMHX6YXL5UMHX6YhL5UMHX6YyLvRYMHX6Ya:ZyBcDe+vISM93jWPUUOR

    Score
    10/10
    kinsingloader
    behavioral31behavioral32

MITRE ATT&CK Enterprise v15

Tasks

static1

Score
3/10

behavioral1

discoveryspywarestealer
Score
7/10

behavioral2

kinsingloaderspywarestealer
Score
10/10

behavioral3

Score
7/10

behavioral4

kinsingloader
Score
10/10

behavioral5

Score
4/10

behavioral6

kinsingloader
Score
10/10

behavioral7

Score
3/10

behavioral8

kinsingloader
Score
10/10

behavioral9

Score
4/10

behavioral10

kinsingloader
Score
10/10

behavioral11

Score
3/10

behavioral12

kinsingloader
Score
10/10

behavioral13

Score
3/10

behavioral14

kinsingloader
Score
10/10

behavioral15

Score
4/10

behavioral16

Score
1/10

behavioral17

Score
3/10

behavioral18

kinsingloader
Score
10/10

behavioral19

Score
3/10

behavioral20

kinsingloader
Score
10/10

behavioral21

Score
3/10

behavioral22

kinsingloader
Score
10/10

behavioral23

Score
7/10

behavioral24

kinsingloader
Score
10/10

behavioral25

Score
4/10

behavioral26

kinsingloader
Score
10/10

behavioral27

Score
4/10

behavioral28

kinsingloader
Score
10/10

behavioral29

Score
3/10

behavioral30

kinsingloader
Score
10/10

behavioral31

Score
4/10

behavioral32

kinsingloader
Score
10/10