Overview

overview

10

Static

static

3

U prilogu ...bi.exe

windows7-x64

7

U prilogu ...bi.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    U prilogu lista novih narudzbi_1.zip

  • Size

    637KB

  • Sample

    240125-vwzsaacden

  • MD5

    ac7ac69bd1d3e6bffb64366ea1eb5454

  • SHA1

    69ded6ad90c35e746314f2c239b945df77e0f7e5

  • SHA256

    1b32cbb7f53c3eecc9c6a1e1824fbac816c58a940f414c6f613e2fc0d893c691

  • SHA512

    944d95c4670a8f1e46d30a7f39eb28238c15aaca993fe59616abaef9994912f99fdf902edd5120586e877b3a1b59f544cc0c73d8b36c2b6314c294b86cda3114

  • SSDEEP

    12288:4SwxD0VNoN94RrFuJSr1os0wbKYX7Pt/8R4JHqgT6Q4iAPKH535MZzRS9LPLE:4SwxDcc4RrFuJSr1b/bKYrt/8R4JHqgA

Score
10/10
kinsingloader

Malware Config

Targets

    • Target

      U prilogu lista novih narudzbi.exe

    • Size

      776KB

    • MD5

      75c1a9a40b3594e87dfd526d5d02786e

    • SHA1

      9da904b9ade761c097d214a2fa823edc219522da

    • SHA256

      be6c4cf0c6c048a2a1c98374746b282bae9c7eb191ec193a747b47910ade5aa1

    • SHA512

      808bda7370c3c5c00faca7a088b059baa59545f17bd8167964565379dbf77d0093824cc4496c7154dc65b83dea92e118027e737ac640a6cd697928f6f81ed7a9

    • SSDEEP

      24576:20vDyK4nrFuXSrTb/bqQlt/GR4lHKg6Qsi08StK2PwxNcH:20uKYFuXkcssi08IK2ozcH

    Score
    10/10
    kinsingloader

    • Kinsing

      Kinsing is a loader written in Golang.

      loaderkinsing

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks