Overview

overview

10

Static

static

5271e4160f...e0.exe

windows7_x64

10

5271e4160f...e0.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5271e4160fe28699c14c73b94c8dd9cf8efa4eba6a8a78a9cc8ee305589d14e0

  • Size

    37KB

  • Sample

    210515-lffr4yyjwe

  • MD5

    c933104538712c82e3a1c7a625f77aaf

  • SHA1

    8bf8db1c25354817ce1ebbd5a6648b4f42f806ae

  • SHA256

    5271e4160fe28699c14c73b94c8dd9cf8efa4eba6a8a78a9cc8ee305589d14e0

  • SHA512

    7ce137561f337314a5ccb1cbf935cca6a44c99b0990f98ccd1a15a85262b77e21ef49c1996841466801cd791e92e366430de8f6873efb82c3ce7fa6af757db95

Score
10/10
ginkxmrigminerpersistenceworm

Malware Config

Targets

    • Target

      5271e4160fe28699c14c73b94c8dd9cf8efa4eba6a8a78a9cc8ee305589d14e0

    • Size

      37KB

    • MD5

      c933104538712c82e3a1c7a625f77aaf

    • SHA1

      8bf8db1c25354817ce1ebbd5a6648b4f42f806ae

    • SHA256

      5271e4160fe28699c14c73b94c8dd9cf8efa4eba6a8a78a9cc8ee305589d14e0

    • SHA512

      7ce137561f337314a5ccb1cbf935cca6a44c99b0990f98ccd1a15a85262b77e21ef49c1996841466801cd791e92e366430de8f6873efb82c3ce7fa6af757db95

    Score
    10/10
    ginkxmrigminerpersistenceworm

    • Gink

      wormgink

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks