Overview

overview

10

Static

static

10

2024-01-25...er.exe

windows7-x64

9

2024-01-25...er.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-01-25_3988b5e4f2fb15c93546addf5cd1b27c_cryptolocker

  • Size

    47KB

  • Sample

    240125-vzvbzabfa9

  • MD5

    3988b5e4f2fb15c93546addf5cd1b27c

  • SHA1

    b0f3daf940f160b7a9e15f19f3bfd58bf1b80dba

  • SHA256

    6e0d7d203cc3c2bcc882d65f9d4f2ba2fc8f8f6d834df5a04de014e8aa5103bf

  • SHA512

    5b637f75c19726bc149e1bda825d1c32d4e619d0e7df628bba1b07093e66ec840204c928e753142cf5ba68be4f11e27cd43fbf71d1a30a409394444fe2742ef4

  • SSDEEP

    384:icX+ni9VCr5nQI021q4VQBqURYp055TOtOOtEvwDpjqIGR/hHi7/OlI0G/3lQIqK:XS5nQJ24LR1bytOOtEvwDpjNbP/3lL

Score
10/10
kinsingloader

Malware Config

Targets

    • Target

      2024-01-25_3988b5e4f2fb15c93546addf5cd1b27c_cryptolocker

    • Size

      47KB

    • MD5

      3988b5e4f2fb15c93546addf5cd1b27c

    • SHA1

      b0f3daf940f160b7a9e15f19f3bfd58bf1b80dba

    • SHA256

      6e0d7d203cc3c2bcc882d65f9d4f2ba2fc8f8f6d834df5a04de014e8aa5103bf

    • SHA512

      5b637f75c19726bc149e1bda825d1c32d4e619d0e7df628bba1b07093e66ec840204c928e753142cf5ba68be4f11e27cd43fbf71d1a30a409394444fe2742ef4

    • SSDEEP

      384:icX+ni9VCr5nQI021q4VQBqURYp055TOtOOtEvwDpjqIGR/hHi7/OlI0G/3lQIqK:XS5nQJ24LR1bytOOtEvwDpjNbP/3lL

    Score
    10/10
    kinsingloader

    • Kinsing

      Kinsing is a loader written in Golang.

      loaderkinsing

    • Detection of CryptoLocker Variants

    • Detection of Cryptolocker Samples

    • Detects executables built or packed with MPress PE compressor

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks