Overview

overview

10

Static

static

7

750b99a6c6...05.exe

windows7-x64

10

750b99a6c6...05.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    750b99a6c6e28c229d1f2b5b5ae73005

  • Size

    37KB

  • Sample

    240125-vmgv4scbdr

  • MD5

    750b99a6c6e28c229d1f2b5b5ae73005

  • SHA1

    0d93a2a4d0df8e52c9f2e2c28d7f0caba379b560

  • SHA256

    5e750fac586cda27ec22494b9af9d8cd3ffbad6eb5457ddcdad34e3db988d7ee

  • SHA512

    7de8043cc427532053746db354e4545349786c92e18299a59913283fe92dd55c5785b4ddec22fc3e17d5e60a9a169a481c20dffb88d7a824735453e85c998aaa

  • SSDEEP

    384:tX2feVkvXXmVMqrWmx9hlHEYUrvt9kceFdJIZQ4G0+5OIwktBs1Hf4ch9eMLMIgL:l27vHa3rrx3Z7JIZV5kuf4YkKMIR7L0

Score
10/10
kinsingevasionloaderpersistenceupx

Malware Config

Targets

    • Target

      750b99a6c6e28c229d1f2b5b5ae73005

    • Size

      37KB

    • MD5

      750b99a6c6e28c229d1f2b5b5ae73005

    • SHA1

      0d93a2a4d0df8e52c9f2e2c28d7f0caba379b560

    • SHA256

      5e750fac586cda27ec22494b9af9d8cd3ffbad6eb5457ddcdad34e3db988d7ee

    • SHA512

      7de8043cc427532053746db354e4545349786c92e18299a59913283fe92dd55c5785b4ddec22fc3e17d5e60a9a169a481c20dffb88d7a824735453e85c998aaa

    • SSDEEP

      384:tX2feVkvXXmVMqrWmx9hlHEYUrvt9kceFdJIZQ4G0+5OIwktBs1Hf4ch9eMLMIgL:l27vHa3rrx3Z7JIZV5kuf4YkKMIR7L0

    Score
    10/10
    evasionpersistenceupxkinsingloader

    • Kinsing

      Kinsing is a loader written in Golang.

      loaderkinsing

    • Modifies firewall policy service

      evasion

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks