Overview

overview

10

Static

static

10

2024-01-25...er.exe

windows7-x64

9

2024-01-25...er.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-01-25_832269203e7cf07dff5a24f86f61d7ba_cryptolocker

  • Size

    93KB

  • Sample

    240125-v358msbga9

  • MD5

    832269203e7cf07dff5a24f86f61d7ba

  • SHA1

    97d1eeb8473c4759d6e2854ae25e16fe83b7f106

  • SHA256

    c79bca8f939801dddc5fb7167e03c455199cc0b03119f2992f2445489346cc90

  • SHA512

    011bb4e49766887ef925a23c4316fb6a2c6752f7666f3e8895a51fab3535589c6f52b5a77899c17888c8bdcf3c6f20c198ae2bb65f922945da9450e1e9b8e35e

  • SSDEEP

    768:xQz7yVEhs9+4uR1bytOOtEvwDpjWfbZ7uyA36S7MpxRiWNa9mktJ9:xj+VGMOtEvwDpjubwQEIiVmkp

Score
10/10
kinsingloader

Malware Config

Targets

    • Target

      2024-01-25_832269203e7cf07dff5a24f86f61d7ba_cryptolocker

    • Size

      93KB

    • MD5

      832269203e7cf07dff5a24f86f61d7ba

    • SHA1

      97d1eeb8473c4759d6e2854ae25e16fe83b7f106

    • SHA256

      c79bca8f939801dddc5fb7167e03c455199cc0b03119f2992f2445489346cc90

    • SHA512

      011bb4e49766887ef925a23c4316fb6a2c6752f7666f3e8895a51fab3535589c6f52b5a77899c17888c8bdcf3c6f20c198ae2bb65f922945da9450e1e9b8e35e

    • SSDEEP

      768:xQz7yVEhs9+4uR1bytOOtEvwDpjWfbZ7uyA36S7MpxRiWNa9mktJ9:xj+VGMOtEvwDpjubwQEIiVmkp

    Score
    10/10
    kinsingloader

    • Kinsing

      Kinsing is a loader written in Golang.

      loaderkinsing

    • Detection of CryptoLocker Variants

    • Detection of Cryptolocker Samples

    • Detects executables built or packed with MPress PE compressor

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks