Overview

overview

10

Static

static

10

2024-01-25...er.exe

windows7-x64

9

2024-01-25...er.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-01-25_f43fef50b760b03505c6db0056a0bbcf_cryptolocker

  • Size

    44KB

  • Sample

    240125-v9kkhsbhd8

  • MD5

    f43fef50b760b03505c6db0056a0bbcf

  • SHA1

    aa865a3cda3fd57ab1c0c924e5bc9d2baebffefb

  • SHA256

    b07ddf7a0f03d2a4a1a5addea0aa795a91be91bf308734a151ab16448b9ad7c7

  • SHA512

    040e1fd15495d38826592c95bf7c0f989349ee40fa86fa08b1c70c22ab30291909d258314310b4f77054072721f8ce56bdd6ef5c3af67ef47ab96f2a959efea8

  • SSDEEP

    768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPhbCi44vCP:6j+1NMOtEvwDpjr8dx4F

Score
10/10
kinsingloader

Malware Config

Targets

    • Target

      2024-01-25_f43fef50b760b03505c6db0056a0bbcf_cryptolocker

    • Size

      44KB

    • MD5

      f43fef50b760b03505c6db0056a0bbcf

    • SHA1

      aa865a3cda3fd57ab1c0c924e5bc9d2baebffefb

    • SHA256

      b07ddf7a0f03d2a4a1a5addea0aa795a91be91bf308734a151ab16448b9ad7c7

    • SHA512

      040e1fd15495d38826592c95bf7c0f989349ee40fa86fa08b1c70c22ab30291909d258314310b4f77054072721f8ce56bdd6ef5c3af67ef47ab96f2a959efea8

    • SSDEEP

      768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPhbCi44vCP:6j+1NMOtEvwDpjr8dx4F

    Score
    10/10
    kinsingloader

    • Kinsing

      Kinsing is a loader written in Golang.

      loaderkinsing

    • Detection of CryptoLocker Variants

    • Detection of Cryptolocker Samples

    • Detects executables built or packed with MPress PE compressor

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks