gink | 7ae1959c0b1ca54cd7e79ffe6cb0fa62204711c7f9255bab69f8e8574172b33d | Triage

Sharing

General

Target

95fc0e1f3789aab9540731d8c9e1bd7533dc4795.rl
Size

37KB
Sample

230502-cfgyeshd48
MD5

cf25c08d7ad94ffb0e37f894e8b46fc2
SHA1

95fc0e1f3789aab9540731d8c9e1bd7533dc4795
SHA256

7ae1959c0b1ca54cd7e79ffe6cb0fa62204711c7f9255bab69f8e8574172b33d
SHA512

b07d352927188fe56325320f5e857b965f9e8607c74f0503ef5d577d1eee951b30b4277544b58c1248bcefe9e16989257aaab424d83c6497e02cebff822ae2b6
SSDEEP

384:F5m90NlBpLeFH5/xSEOReuEEXVYnhl8/odXgreebEnI8YJ:FXdiP7OR/V0M/odY2I8A

Score

10^/10

gink persistence worm

Malware Config

Targets

- Target
  
  95fc0e1f3789aab9540731d8c9e1bd7533dc4795.rl
- Size
  
  37KB
- MD5
  
  cf25c08d7ad94ffb0e37f894e8b46fc2
- SHA1
  
  95fc0e1f3789aab9540731d8c9e1bd7533dc4795
- SHA256
  
  7ae1959c0b1ca54cd7e79ffe6cb0fa62204711c7f9255bab69f8e8574172b33d
- SHA512
  
  b07d352927188fe56325320f5e857b965f9e8607c74f0503ef5d577d1eee951b30b4277544b58c1248bcefe9e16989257aaab424d83c6497e02cebff822ae2b6
- SSDEEP
  
  384:F5m90NlBpLeFH5/xSEOReuEEXVYnhl8/odXgreebEnI8YJ:FXdiP7OR/V0M/odY2I8A
Score

10^/10

gink persistence worm
- Gink
  worm gink
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ginkpersistenceworm

behavioral2

ginkpersistenceworm