Overview

overview

10

Static

static

3

750b40ffa0...bb.exe

windows7-x64

9

750b40ffa0...bb.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    750b40ffa0547527d997880a049deabb

  • Size

    604KB

  • Sample

    240125-vlyggabcc5

  • MD5

    750b40ffa0547527d997880a049deabb

  • SHA1

    d1e5c772f37cded80ae7a6cc7f35bcc286d99d9a

  • SHA256

    20af1bcc37f2ec60ec3854a389b0ded6f567dd2839ef1ed0554928926754e6b7

  • SHA512

    cb2f6d8cce82d04f517644702ae68f85c1386b71aab1e717d36410be7b76ae4a134feec90c39ebe57b216d0c88759d2bd0ae4e6cc47c057e10d942931cb5590a

  • SSDEEP

    12288:lqmSXl3v5iqGWvSOEZIJo333nEHYdpSYzcHwYm0h/pBWGXAO6rwT2Os9eNvjAde:lXSXl3v5fv38naHYqVSZO6rwds9cvjAY

Score
10/10
kinsingevasionloader

Malware Config

Targets

    • Target

      750b40ffa0547527d997880a049deabb

    • Size

      604KB

    • MD5

      750b40ffa0547527d997880a049deabb

    • SHA1

      d1e5c772f37cded80ae7a6cc7f35bcc286d99d9a

    • SHA256

      20af1bcc37f2ec60ec3854a389b0ded6f567dd2839ef1ed0554928926754e6b7

    • SHA512

      cb2f6d8cce82d04f517644702ae68f85c1386b71aab1e717d36410be7b76ae4a134feec90c39ebe57b216d0c88759d2bd0ae4e6cc47c057e10d942931cb5590a

    • SSDEEP

      12288:lqmSXl3v5iqGWvSOEZIJo333nEHYdpSYzcHwYm0h/pBWGXAO6rwT2Os9eNvjAde:lXSXl3v5fv38naHYqVSZO6rwds9cvjAY

    Score
    10/10
    evasionkinsingloader

    • Kinsing

      Kinsing is a loader written in Golang.

      loaderkinsing

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks