Overview

overview

10

Static

static

3

74f42b1bc5...32.exe

windows7-x64

9

74f42b1bc5...32.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    74f42b1bc557572f11e9a450c0a0a232

  • Size

    3.6MB

  • Sample

    240125-tswe1sbdbm

  • MD5

    74f42b1bc557572f11e9a450c0a0a232

  • SHA1

    33190f5cd1b03c6439b6bc8289b054c85ffdc0ef

  • SHA256

    aa8764c82ac6963672dfd4f3c25bf248108f435eb5d464ad2902000546a765be

  • SHA512

    99eea1b9bcb448131f8d17bb67a4967583adc4fbfc8c532fd688ad29d3798094472996e117f1aeba3090c11da41a3ddf43513c4da38c15b573c3cbe6a7f75f16

  • SSDEEP

    98304:gt03hK/8jmL4pXPIPc1WY6I+e1nutwE/5Ql21T6:1K/0mMlHZ+e1b/U6

Score
10/10
kinsingevasionloader

Malware Config

Targets

    • Target

      74f42b1bc557572f11e9a450c0a0a232

    • Size

      3.6MB

    • MD5

      74f42b1bc557572f11e9a450c0a0a232

    • SHA1

      33190f5cd1b03c6439b6bc8289b054c85ffdc0ef

    • SHA256

      aa8764c82ac6963672dfd4f3c25bf248108f435eb5d464ad2902000546a765be

    • SHA512

      99eea1b9bcb448131f8d17bb67a4967583adc4fbfc8c532fd688ad29d3798094472996e117f1aeba3090c11da41a3ddf43513c4da38c15b573c3cbe6a7f75f16

    • SSDEEP

      98304:gt03hK/8jmL4pXPIPc1WY6I+e1nutwE/5Ql21T6:1K/0mMlHZ+e1b/U6

    Score
    10/10
    evasionkinsingloader

    • Kinsing

      Kinsing is a loader written in Golang.

      loaderkinsing

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Drops startup file

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Loads dropped DLL

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks