gink | 61700a045c8efd0ab547bcce43f213c5cc7f6c67824f9fe7088177ca60f182b8 | Triage

Sharing

General

Target

61700a045c8efd0ab547bcce43f213c5cc7f6c67824f9fe7088177ca60f182b8
Size

34KB
Sample

230502-cjzbwabc3w
MD5

4fd67483d40c23bbb41351aed8e04399
SHA1

4b9930f17c2dc5714627f37764fd8521902ca32a
SHA256

61700a045c8efd0ab547bcce43f213c5cc7f6c67824f9fe7088177ca60f182b8
SHA512

22299ef8cf020de83baffeb69d887e4e8219bb29a8b4e5880902c86a84be6ebff95c5ce6dfa1cc55c0d0af136c2d7d587a5ffcf6605044349ceb951ea2bf4d86
SSDEEP

384:Y6Lz0OyPaGPbG8FecNrgzbUFPlfRNefMfNq8U/tyKWRzpeancfKykJIyfgS9/V+q:Y6Lo1RPbPFHRgzwFPlf/efMT6bI8W

Score

10^/10

gink persistence worm

Malware Config

Targets

- Target
  
  61700a045c8efd0ab547bcce43f213c5cc7f6c67824f9fe7088177ca60f182b8
- Size
  
  34KB
- MD5
  
  4fd67483d40c23bbb41351aed8e04399
- SHA1
  
  4b9930f17c2dc5714627f37764fd8521902ca32a
- SHA256
  
  61700a045c8efd0ab547bcce43f213c5cc7f6c67824f9fe7088177ca60f182b8
- SHA512
  
  22299ef8cf020de83baffeb69d887e4e8219bb29a8b4e5880902c86a84be6ebff95c5ce6dfa1cc55c0d0af136c2d7d587a5ffcf6605044349ceb951ea2bf4d86
- SSDEEP
  
  384:Y6Lz0OyPaGPbG8FecNrgzbUFPlfRNefMfNq8U/tyKWRzpeancfKykJIyfgS9/V+q:Y6Lo1RPbPFHRgzwFPlf/efMT6bI8W
Score

10^/10

gink persistence worm
- Gink
  worm gink
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ginkpersistenceworm

behavioral2

ginkpersistenceworm