Overview

overview

10

Static

static

10

2024-01-25...er.exe

windows7-x64

9

2024-01-25...er.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-01-25_259f9b58e5f27071472b5909427585c5_cryptolocker

  • Size

    32KB

  • Sample

    240125-wa6t5schcm

  • MD5

    259f9b58e5f27071472b5909427585c5

  • SHA1

    b4da42c7aabb032efc1cec19394eb8c5b370f37e

  • SHA256

    6be70c12a7a0879e1fc176a0fbd425847989a291ab61dc1ddce0d731ec46e309

  • SHA512

    7079291937b07ca5f54c1222e4f1ebd33e6ec0ec28985c3257947c6e3e235ecea8c4ea082d8626b890de4908b99aeaf72894e7ae0a8a86b0e79da5b16ad00a53

  • SSDEEP

    384:bM7Q0pjC4GybxMv01d3AcASBQMf6i/zzzcYgUPSznHzl6A0X/Xd:b/yC4GyNM01GuQMNXw2PSjH+PN

Score
10/10
kinsingdiscoveryloader

Malware Config

Targets

    • Target

      2024-01-25_259f9b58e5f27071472b5909427585c5_cryptolocker

    • Size

      32KB

    • MD5

      259f9b58e5f27071472b5909427585c5

    • SHA1

      b4da42c7aabb032efc1cec19394eb8c5b370f37e

    • SHA256

      6be70c12a7a0879e1fc176a0fbd425847989a291ab61dc1ddce0d731ec46e309

    • SHA512

      7079291937b07ca5f54c1222e4f1ebd33e6ec0ec28985c3257947c6e3e235ecea8c4ea082d8626b890de4908b99aeaf72894e7ae0a8a86b0e79da5b16ad00a53

    • SSDEEP

      384:bM7Q0pjC4GybxMv01d3AcASBQMf6i/zzzcYgUPSznHzl6A0X/Xd:b/yC4GyNM01GuQMNXw2PSjH+PN

    Score
    10/10
    discoverykinsingloader

    • Kinsing

      Kinsing is a loader written in Golang.

      loaderkinsing

    • Detection of CryptoLocker Variants

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks