Overview

overview

10

Static

static

10

2024-01-25...er.exe

windows7-x64

9

2024-01-25...er.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    2024-01-25_00f1e55729c35d34b365ece88bae6038_cryptolocker

  • Size

    44KB

  • Sample

    240125-vxjgpacdfp

  • MD5

    00f1e55729c35d34b365ece88bae6038

  • SHA1

    b5f3d7d932636063d93d5bfde6e04ba6411c9fc9

  • SHA256

    5783b4c578e51e33626370b8458447e574fe06fdaa4e64831225883f9c939461

  • SHA512

    87b1857bb964b1ed503c2027c3fe3e663a18302fea89f54120b1b89d1bdb3aafaf8fa521606fedb5a0bcbe1c4c476d949e13b3141c9ded39a70403441aaa3939

  • SSDEEP

    768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPhbCi44vCz:6j+1NMOtEvwDpjr8dx45

Score
10/10
kinsingloader

Malware Config

Targets

    • Target

      2024-01-25_00f1e55729c35d34b365ece88bae6038_cryptolocker

    • Size

      44KB

    • MD5

      00f1e55729c35d34b365ece88bae6038

    • SHA1

      b5f3d7d932636063d93d5bfde6e04ba6411c9fc9

    • SHA256

      5783b4c578e51e33626370b8458447e574fe06fdaa4e64831225883f9c939461

    • SHA512

      87b1857bb964b1ed503c2027c3fe3e663a18302fea89f54120b1b89d1bdb3aafaf8fa521606fedb5a0bcbe1c4c476d949e13b3141c9ded39a70403441aaa3939

    • SSDEEP

      768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPhbCi44vCz:6j+1NMOtEvwDpjr8dx45

    Score
    10/10
    kinsingloader

    • Kinsing

      Kinsing is a loader written in Golang.

      loaderkinsing

    • Detection of CryptoLocker Variants

    • Detection of Cryptolocker Samples

    • Detects executables built or packed with MPress PE compressor

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks