MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6e25ad03103a1a972b78c642bac09060fa79c460011dc5748cbb433cc459938b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Kinsing


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6e25ad03103a1a972b78c642bac09060fa79c460011dc5748cbb433cc459938b
SHA3-384 hash: 74333b6ce0f815955656bd8dcb5b3c10a494882150f5e317a0296442bcffa9d19d193c05cc1444430a0a0049b0d13816
SHA1 hash: 0194637f1e83c2efc8bcda8d20c446805698c7bc
MD5 hash: 648effa354b3cbaad87b45f48d59c616
humanhash: fanta-high-mike-sodium
File name:SecuriteInfo.com.Linux.Miner-ZS.18234.26199
Download: download sample
Signature Kinsing
Create hunting rule
File size:14'643'200 bytes
First seen:2021-03-04 13:44:45 UTC
Last seen:2022-01-13 19:35:35 UTC
File type: elf
MIME type:application/x-executable
ssdeep 98304:zpU9MTfASNlnewCIoxAlfVG9bnY+Zx+A:zG9GfASNlnewChxAxVWbY
TLSH D8E6AF7AF8441CE6D57FD136CA92A66537713C72876277C74AA0AA930523BE0FE39700
telfhash e072dd70497c74b6b26ac561f3b3b4b4e53718b167f874b10026b992efe0e441c96c6b
Reporter SecuriteInfoCom
Tags:elf Kinsing log4j

Intelligence

File Origin
# of uploads :
5
# of downloads :
218
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Linux.Miner-ZS.18234.26199.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6e25ad03103a1a972b78c642bac09060fa79c460011dc5748cbb433cc459938b/
Threat name:
Linux.Trojan.LINUXKinsing
Create hunting rule
Status:
Malicious
First seen:
2020-12-18 22:38:37 UTC
AV detection:
24 of 47 (51.06%)
Threat level:
  5/5
Result
Malware family:
n/a
Score:
  9/10
Tags:
antivm linux
Link:
https://tria.ge/reports/210304-nt1vpdb9aa/
Behaviour
Enumerates kernel/hardware configuration
Reads runtime system information
Writes file to tmp directory
Reads CPU attributes
Attempts to identify hypervisor via CPU configuration
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6e25ad03103a1a972b78c642bac09060fa79c460011dc5748cbb433cc459938b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Kinsing

elf 6e25ad03103a1a972b78c642bac09060fa79c460011dc5748cbb433cc459938b

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1046523/
  
Delivery method
Distributed via web download

Comments