Overview

overview

10

Static

static

10

2024-01-25...er.exe

windows7-x64

9

2024-01-25...er.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-01-25_13f5afe8395e6a1d9607764e2aa45107_cryptolocker

  • Size

    37KB

  • Sample

    240125-wae2eschaq

  • MD5

    13f5afe8395e6a1d9607764e2aa45107

  • SHA1

    a53936d1e8c799b692a944f8d4145c971db8c1dd

  • SHA256

    b0accfba01bbda2dc9133a92709520cf6c010c1f85a31acf7a51d335a3ec9873

  • SHA512

    54451792c1fae2c4f7349a89e0b915d68eb8d7aace21337da9abcd4821992411861936169d0b7e0f74f892e97836433d426e533481cb83872e2833d2197b6d5f

  • SSDEEP

    384:bM7Q0pjC4GybxMv01d3AcASBQMf6i/zzzcYgUPSznHzl6AJvDSuYlU7g:b/yC4GyNM01GuQMNXw2PSjHPbSuYlU7g

Score
10/10
kinsingdiscoveryloader

Malware Config

Targets

    • Target

      2024-01-25_13f5afe8395e6a1d9607764e2aa45107_cryptolocker

    • Size

      37KB

    • MD5

      13f5afe8395e6a1d9607764e2aa45107

    • SHA1

      a53936d1e8c799b692a944f8d4145c971db8c1dd

    • SHA256

      b0accfba01bbda2dc9133a92709520cf6c010c1f85a31acf7a51d335a3ec9873

    • SHA512

      54451792c1fae2c4f7349a89e0b915d68eb8d7aace21337da9abcd4821992411861936169d0b7e0f74f892e97836433d426e533481cb83872e2833d2197b6d5f

    • SSDEEP

      384:bM7Q0pjC4GybxMv01d3AcASBQMf6i/zzzcYgUPSznHzl6AJvDSuYlU7g:b/yC4GyNM01GuQMNXw2PSjHPbSuYlU7g

    Score
    10/10
    discoverykinsingloader

    • Kinsing

      Kinsing is a loader written in Golang.

      loaderkinsing

    • Detection of CryptoLocker Variants

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks