Overview

overview

10

Static

static

3

750275be8b...c0.exe

windows7-x64

10

750275be8b...c0.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    750275be8b7a59683214567ba5032dc0

  • Size

    88KB

  • Sample

    240125-vbs41abghr

  • MD5

    750275be8b7a59683214567ba5032dc0

  • SHA1

    dbe35201b79b8ac74430d450485314dde69211d7

  • SHA256

    f3855a4136db942476d91e007c610b3f9d0454201616f2e63a1a1fc7fbd98af0

  • SHA512

    4fdcb76420a6d40968afe8e2d8d0db40052244df065e6a95715f09df599f80e45b05cc184148126f8c3a38a3b01d7889d0dcd779ca53cf59670ea35bb4240220

  • SSDEEP

    1536:SdS4HSpy8tXG06YpqdXTsYJ/F+FBFIFGFYF7DUZxTZNCa:ZuSs0G0mZAD

Score
10/10
kinsingevasionloaderpersistence

Malware Config

Targets

    • Target

      750275be8b7a59683214567ba5032dc0

    • Size

      88KB

    • MD5

      750275be8b7a59683214567ba5032dc0

    • SHA1

      dbe35201b79b8ac74430d450485314dde69211d7

    • SHA256

      f3855a4136db942476d91e007c610b3f9d0454201616f2e63a1a1fc7fbd98af0

    • SHA512

      4fdcb76420a6d40968afe8e2d8d0db40052244df065e6a95715f09df599f80e45b05cc184148126f8c3a38a3b01d7889d0dcd779ca53cf59670ea35bb4240220

    • SSDEEP

      1536:SdS4HSpy8tXG06YpqdXTsYJ/F+FBFIFGFYF7DUZxTZNCa:ZuSs0G0mZAD

    Score
    10/10
    evasionpersistencekinsingloader

    • Kinsing

      Kinsing is a loader written in Golang.

      loaderkinsing

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks