Overview

overview

10

Static

static

7

75119fe9f8...ab.exe

windows7-x64

9

75119fe9f8...ab.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    75119fe9f878feee28e29601e9fbe6ab

  • Size

    9.0MB

  • Sample

    240125-vs8wsacchp

  • MD5

    75119fe9f878feee28e29601e9fbe6ab

  • SHA1

    24a48b0309a58f226fc54206cc1c37b16085ad02

  • SHA256

    bde72889e6726e74c922375df348762679081c38c2e60a34481635a4cdaa76cc

  • SHA512

    3dc098c95f9abbbee4ae4a49221da51592ab791f073a860d21f0c45bb584a95e9dd6b106742996dbeea7ed75f2d691271839909963f25877bed7406639cf2fd6

  • SSDEEP

    196608:jFdhCokh2aPWzqHcveCucAgb6lPkJBw2x25Ejp:jFdhVSW+iejcAs6lMJ62g5k

Score
10/10
kinsingevasionloaderthemidatrojan

Malware Config

Targets

    • Target

      75119fe9f878feee28e29601e9fbe6ab

    • Size

      9.0MB

    • MD5

      75119fe9f878feee28e29601e9fbe6ab

    • SHA1

      24a48b0309a58f226fc54206cc1c37b16085ad02

    • SHA256

      bde72889e6726e74c922375df348762679081c38c2e60a34481635a4cdaa76cc

    • SHA512

      3dc098c95f9abbbee4ae4a49221da51592ab791f073a860d21f0c45bb584a95e9dd6b106742996dbeea7ed75f2d691271839909963f25877bed7406639cf2fd6

    • SSDEEP

      196608:jFdhCokh2aPWzqHcveCucAgb6lPkJBw2x25Ejp:jFdhVSW+iejcAs6lMJ62g5k

    Score
    10/10
    evasionthemidatrojankinsingloader

    • Kinsing

      Kinsing is a loader written in Golang.

      loaderkinsing

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks