Overview

overview

10

Static

static

10

2024-01-25...er.exe

windows7-x64

9

2024-01-25...er.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-01-25_318971b6dd3228f0907eb804dc3d177e_cryptolocker

  • Size

    47KB

  • Sample

    240125-vzksjacebm

  • MD5

    318971b6dd3228f0907eb804dc3d177e

  • SHA1

    4e376684c25cc58dfd078b73f3ac7d6b12d1b853

  • SHA256

    45366c9e1d8cbb14c3527a7602733027b10987e9ade3e046151873600e1a2f27

  • SHA512

    197fb9f265adf3f418d5e0222718f772c67eeca402b4e6df0ea6f8a2e91edb0274882338d56a0a01625deb7676cadcfa0da75ea25ef0c0448bd798f8a71a2d2b

  • SSDEEP

    768:xQz7yVEhs9+4uR1bytOOtEvwDpjWE6BLbjG9RzhwaF:xj+VGMOtEvwDpjy+TF

Score
10/10
kinsingloader

Malware Config

Targets

    • Target

      2024-01-25_318971b6dd3228f0907eb804dc3d177e_cryptolocker

    • Size

      47KB

    • MD5

      318971b6dd3228f0907eb804dc3d177e

    • SHA1

      4e376684c25cc58dfd078b73f3ac7d6b12d1b853

    • SHA256

      45366c9e1d8cbb14c3527a7602733027b10987e9ade3e046151873600e1a2f27

    • SHA512

      197fb9f265adf3f418d5e0222718f772c67eeca402b4e6df0ea6f8a2e91edb0274882338d56a0a01625deb7676cadcfa0da75ea25ef0c0448bd798f8a71a2d2b

    • SSDEEP

      768:xQz7yVEhs9+4uR1bytOOtEvwDpjWE6BLbjG9RzhwaF:xj+VGMOtEvwDpjy+TF

    Score
    10/10
    kinsingloader

    • Kinsing

      Kinsing is a loader written in Golang.

      loaderkinsing

    • Detection of CryptoLocker Variants

    • Detection of Cryptolocker Samples

    • Detects executables built or packed with MPress PE compressor

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks