gink | c36ca3dd5bf2d289c35d8aba7763b25ae579186a030d4dce09b99eca7744956c | Triage

Sharing

General

Target

c36ca3dd5bf2d289c35d8aba7763b25ae579186a030d4dce09b99eca7744956c
Size

37KB
Sample

221205-y6v4maga91
MD5

4c7f40ca0b11f11feb0df97081bcf0d5
SHA1

0b2541e4f6aff057ed2904dd48dee1734a4d87a3
SHA256

c36ca3dd5bf2d289c35d8aba7763b25ae579186a030d4dce09b99eca7744956c
SHA512

c811392c71c19c4e49c604a4b29ba1141f81bed10b43a1002e5c161628be78c8b9b632df4278d5911b83e18c0845a6adc99395964128d167fce662dfc5297ae8
SSDEEP

768:+PGzQPi/qtWFvJXjhPzYjfxPkpw2dI8Cs:+ekPi/qtYjhP8jmwAr

Score

10^/10

gink persistence worm

Malware Config

Targets

- Target
  
  c36ca3dd5bf2d289c35d8aba7763b25ae579186a030d4dce09b99eca7744956c
- Size
  
  37KB
- MD5
  
  4c7f40ca0b11f11feb0df97081bcf0d5
- SHA1
  
  0b2541e4f6aff057ed2904dd48dee1734a4d87a3
- SHA256
  
  c36ca3dd5bf2d289c35d8aba7763b25ae579186a030d4dce09b99eca7744956c
- SHA512
  
  c811392c71c19c4e49c604a4b29ba1141f81bed10b43a1002e5c161628be78c8b9b632df4278d5911b83e18c0845a6adc99395964128d167fce662dfc5297ae8
- SSDEEP
  
  768:+PGzQPi/qtWFvJXjhPzYjfxPkpw2dI8Cs:+ekPi/qtYjhP8jmwAr
Score

10^/10

gink persistence worm
- Gink
  worm gink
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ginkpersistenceworm

behavioral2

ginkpersistenceworm