Overview

overview

10

Static

static

3

7f5bc615e4...30.exe

windows7-x64

8

7f5bc615e4...30.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7f5bc615e401caaf9252dbbe0349c59710e9b63efc5a50a0f6dacb0fb06f0b30

  • Size

    409KB

  • Sample

    240125-v4h5hacfcl

  • MD5

    7c8ec206d0043df90b7eccf6bd266576

  • SHA1

    b73615aedbafea3d4be7d436e6b88299e5c147f3

  • SHA256

    7f5bc615e401caaf9252dbbe0349c59710e9b63efc5a50a0f6dacb0fb06f0b30

  • SHA512

    b7f9a68b71e438425a1673f9dc82403ac8be3ad343657673524817c851728e1595589f94df8fb66c6ae1b23e0c092ee835c8071ab15ec838a66a636a7de71a86

  • SSDEEP

    6144:kIPnx3+QPLWV9MAud5fcq2nES078acb+IYEKskHS/hoEI:jx3+QSV9Ad5f8nES0YacY9DH4W

Score
10/10
cobaltstrikekinsingbackdoorloadertrojan

Malware Config

Targets

    • Target

      7f5bc615e401caaf9252dbbe0349c59710e9b63efc5a50a0f6dacb0fb06f0b30

    • Size

      409KB

    • MD5

      7c8ec206d0043df90b7eccf6bd266576

    • SHA1

      b73615aedbafea3d4be7d436e6b88299e5c147f3

    • SHA256

      7f5bc615e401caaf9252dbbe0349c59710e9b63efc5a50a0f6dacb0fb06f0b30

    • SHA512

      b7f9a68b71e438425a1673f9dc82403ac8be3ad343657673524817c851728e1595589f94df8fb66c6ae1b23e0c092ee835c8071ab15ec838a66a636a7de71a86

    • SSDEEP

      6144:kIPnx3+QPLWV9MAud5fcq2nES078acb+IYEKskHS/hoEI:jx3+QSV9Ad5f8nES0YacY9DH4W

    Score
    10/10
    cobaltstrikekinsingbackdoorloadertrojan

    • Cobaltstrike

      Detected malicious payload which is part of Cobaltstrike.

      trojanbackdoorcobaltstrike

    • Kinsing

      Kinsing is a loader written in Golang.

      loaderkinsing

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks