Extracted

• • Target

    751d870aa39047bca3a7e6cca0e11303

  • Size

    11.4MB

  • MD5

    751d870aa39047bca3a7e6cca0e11303

  • SHA1

    6220cacde3e1f98a5a1813ae7324ba951bcbe895

  • SHA256

    47ce762a85469542401e2cdede7e409f236cca6d8c2f77337bdc31a31ad9f6c8

  • SHA512

    5e553ba1c774731d30a79f406a9f21a6a7af393ac7a7cdc0598e4e672ebb4b9b88f716a9ecef86252aaa615df256ba37f874bf7f2eb6c2413be9b45a8e54a487

  • SSDEEP

    12288:hTAazcHzcHzcHzcHzcHzcHzcHzcHzcHzcHzcHzcHzcHzcHzcHzcHzcHzcHzcHzcn:9

  Score

  10^/10

  tofseeevasionpersistencetrojankinsingloader

  • Kinsing

    Kinsing is a loader written in Golang.

    loaderkinsing

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2