Overview

overview

10

Static

static

3

U prilogu ...bi.exe

windows7-x64

7

U prilogu ...bi.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    U prilogu lista novih narudzbi.exe

  • Size

    776KB

  • Sample

    240125-vqtn3sbdc3

  • MD5

    75c1a9a40b3594e87dfd526d5d02786e

  • SHA1

    9da904b9ade761c097d214a2fa823edc219522da

  • SHA256

    be6c4cf0c6c048a2a1c98374746b282bae9c7eb191ec193a747b47910ade5aa1

  • SHA512

    808bda7370c3c5c00faca7a088b059baa59545f17bd8167964565379dbf77d0093824cc4496c7154dc65b83dea92e118027e737ac640a6cd697928f6f81ed7a9

  • SSDEEP

    24576:20vDyK4nrFuXSrTb/bqQlt/GR4lHKg6Qsi08StK2PwxNcH:20uKYFuXkcssi08IK2ozcH

Score
10/10
kinsingloader

Malware Config

Targets

    • Target

      U prilogu lista novih narudzbi.exe

    • Size

      776KB

    • MD5

      75c1a9a40b3594e87dfd526d5d02786e

    • SHA1

      9da904b9ade761c097d214a2fa823edc219522da

    • SHA256

      be6c4cf0c6c048a2a1c98374746b282bae9c7eb191ec193a747b47910ade5aa1

    • SHA512

      808bda7370c3c5c00faca7a088b059baa59545f17bd8167964565379dbf77d0093824cc4496c7154dc65b83dea92e118027e737ac640a6cd697928f6f81ed7a9

    • SSDEEP

      24576:20vDyK4nrFuXSrTb/bqQlt/GR4lHKg6Qsi08StK2PwxNcH:20uKYFuXkcssi08IK2ozcH

    Score
    10/10
    kinsingloader

    • Kinsing

      Kinsing is a loader written in Golang.

      loaderkinsing

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks