kinsing | c62d65e49cda2653b185ba181c1ad775955e10f6550acde60562e90d35861045 | Triage

Sharing

General

Target

2168-37-0x0000000000EA0000-0x0000000001216000-memory.dmp
Size

3.5MB
Sample

240125-vv9k4abea9
MD5

a9e5109e14562508b2b2a03a60dc7202
SHA1

bbe5b84d9d3ad7ca2fb34602182297f3ae669611
SHA256

c62d65e49cda2653b185ba181c1ad775955e10f6550acde60562e90d35861045
SHA512

1e93b71a563e3f853f0a8d7ca83d32b147a058bb9dba4867cec31cce68a1d19357442b3684c10014be025570fef7e5b432d9ad007b915b0df9428390b2b718e4
SSDEEP

49152:XkLUJbzk8o21UsNT7I35W4AShA+SdhtkCu/BaC8UWF:X7XkkNpIJAkA+otSZax

Score

10^/10

kinsing njrat evasion loader persistence trojan

Malware Config

Targets

- Target
  
  2168-37-0x0000000000EA0000-0x0000000001216000-memory.dmp
- Size
  
  3.5MB
- MD5
  
  a9e5109e14562508b2b2a03a60dc7202
- SHA1
  
  bbe5b84d9d3ad7ca2fb34602182297f3ae669611
- SHA256
  
  c62d65e49cda2653b185ba181c1ad775955e10f6550acde60562e90d35861045
- SHA512
  
  1e93b71a563e3f853f0a8d7ca83d32b147a058bb9dba4867cec31cce68a1d19357442b3684c10014be025570fef7e5b432d9ad007b915b0df9428390b2b718e4
- SSDEEP
  
  49152:XkLUJbzk8o21UsNT7I35W4AShA+SdhtkCu/BaC8UWF:X7XkkNpIJAkA+otSZax
Score

10^/10

njrat evasion persistence trojan kinsing loader
- Kinsing
  Kinsing is a loader written in Golang.
  loader kinsing
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Replication Through Removable Media

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

njratevasionpersistencetrojan

behavioral2

kinsingnjratevasionloaderpersistencetrojan