Loading malware…
KINS (Kasper Internet Non-Security) is a Windows banking Trojan and crimeware toolkit derived from the Zeus source code leaked in 2011. It targets online banking users and supports financial fraud, including use of the ATSEngine module to facilitate theft of funds. KINS incorporates virtual-machine-based protection and steganographic techniques to conceal malicious information and complicate analysis.
KINS has been distributed through malvertising targeting visitors to European transit websites. Advertising redirects led victims to malware disguised as a PDF document, relying on users to execute it. It has also appeared in spam-driven banking-malware distribution infrastructure, with downloads observed in Italy.
Observed samples copy themselves into a user application-data location, delete their original executable, and inject code into the Windows shell process. The injected code handles command-and-control communications, while the malware collects and transmits encrypted host and system information and listens for inbound network connections. Its defense-evasion behavior includes disabling Windows Firewall, suppressing Windows Security Center notifications, and adding broad process and file-extension exclusions to Windows Defender and Microsoft Antimalware. These modifications weaken host protections and reduce the likelihood of detection.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
11 distinct techniques documented for this family, organized by ATT&CK tactic.
The bot encrypts the system information in the following format and sends it via the above POST request to the C&C server
The malware masquerades as a PDF document to lure an unsuspecting user into opening the file.
The bot further makes multiple system registry modifications to evade detection
Microsoft security center - disable update notifications, disable antimalware scan... Windows firewall settings - Allow exceptions, disable notifications, disable the firewall... Windows Defender & AntiMalware settings - Exclude malware processes, injected system processes and certain file types from scanning
91 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Семейство вредоносного ПО, упомянутое как использующее стеганографию для сокрытия данных или коммуникаций.
A Zeus-derived banking trojan/crimekit delivered via malvertising. It masquerades as a PDF, copies itself into Application Data, deletes the original, injects into explorer.exe, modifies registry settings to weaken Security Center, Firewall, Windows Defender, and Microsoft Antimalware protections, opens TCP port 36139 for incoming connections, and performs encrypted C2 communications to exfiltrate system information.
A banking trojan mentioned as an example of malware that used simpler, non-digital steganographic techniques by appending data to image files.
PC banking trojan listed among malware actively used to attack companies.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.