Overview

overview

10

Static

static

10

2024-01-25...er.exe

windows7-x64

9

2024-01-25...er.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-01-25_ea7874276a66ec5044e1143e63468a6c_cryptolocker

  • Size

    40KB

  • Sample

    240125-v88wqabhd3

  • MD5

    ea7874276a66ec5044e1143e63468a6c

  • SHA1

    b5416c9ef60fb6e80a8b35c73096739bba6b5103

  • SHA256

    11854e3429a225caab97800ccc21b5809391d75bc19a9eb7aa53142a04c31139

  • SHA512

    9b4e043ce120821a01b64c182cf3a9b4ce339e31f5f5cef5c968e57fe20f5ccb2cd26432f31a9958d0a4ed051c5da103969e43fee4db5c9fe5ab1a47ad3235d0

  • SSDEEP

    768:b/yC4GyNM01GuQMNXw2PSjHPbSuYlW8PAl:b/pYayGig5HjS3NPAl

Score
10/10
kinsingdiscoveryloader

Malware Config

Targets

    • Target

      2024-01-25_ea7874276a66ec5044e1143e63468a6c_cryptolocker

    • Size

      40KB

    • MD5

      ea7874276a66ec5044e1143e63468a6c

    • SHA1

      b5416c9ef60fb6e80a8b35c73096739bba6b5103

    • SHA256

      11854e3429a225caab97800ccc21b5809391d75bc19a9eb7aa53142a04c31139

    • SHA512

      9b4e043ce120821a01b64c182cf3a9b4ce339e31f5f5cef5c968e57fe20f5ccb2cd26432f31a9958d0a4ed051c5da103969e43fee4db5c9fe5ab1a47ad3235d0

    • SSDEEP

      768:b/yC4GyNM01GuQMNXw2PSjHPbSuYlW8PAl:b/pYayGig5HjS3NPAl

    Score
    10/10
    discoverykinsingloader

    • Kinsing

      Kinsing is a loader written in Golang.

      loaderkinsing

    • Detection of CryptoLocker Variants

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks