Overview

overview

10

Static

static

3

751ef59be3...8e.exe

windows7-x64

10

751ef59be3...8e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    751ef59be3c954bc0af792f2d426138e

  • Size

    358KB

  • Sample

    240125-v9sacsbhe5

  • MD5

    751ef59be3c954bc0af792f2d426138e

  • SHA1

    a6631f30664a22c9dd5dd08cad96e3149c16adb3

  • SHA256

    8ecba4b9ab5f639c8a3df5ad0856c6b83c96d2c937f2bd2af4fc71907852ccab

  • SHA512

    2b21d28063717038f1ff424b1009841740316e50ee2a5fd7558ae300e84eac056b4a8c8b3fbcdf52bbb28b8a67cd8a5e2024c07a8affb201cb3c811ce14b86ca

  • SSDEEP

    6144:/uMO+BlSNSvJA6yGjspnJJkwxNmm0PYct5xjg40WSXN5JKk3Sm9p5lTRDGrP02Zk:4WLvJeGwnXkdtlqWmf4kiObTlGbrk

Score
10/10
kinsingloaderpersistence

Malware Config

Targets

    • Target

      751ef59be3c954bc0af792f2d426138e

    • Size

      358KB

    • MD5

      751ef59be3c954bc0af792f2d426138e

    • SHA1

      a6631f30664a22c9dd5dd08cad96e3149c16adb3

    • SHA256

      8ecba4b9ab5f639c8a3df5ad0856c6b83c96d2c937f2bd2af4fc71907852ccab

    • SHA512

      2b21d28063717038f1ff424b1009841740316e50ee2a5fd7558ae300e84eac056b4a8c8b3fbcdf52bbb28b8a67cd8a5e2024c07a8affb201cb3c811ce14b86ca

    • SSDEEP

      6144:/uMO+BlSNSvJA6yGjspnJJkwxNmm0PYct5xjg40WSXN5JKk3Sm9p5lTRDGrP02Zk:4WLvJeGwnXkdtlqWmf4kiObTlGbrk

    Score
    10/10
    persistencekinsingloader

    • Kinsing

      Kinsing is a loader written in Golang.

      loaderkinsing

    • Modifies WinLogon for persistence

      persistence

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks