gink | 54a4651e2d91d821c886134a63b86f97e5854bc182fc1d82fd77f286ac64c1c2 | Triage

Sharing

General

Target

6543447973d284ed2606c93daeaa8540_JC.exe
Size

37KB
Sample

230918-v54slade39
MD5

6543447973d284ed2606c93daeaa8540
SHA1

cdd4a562a98a3a8a9e7824c9e3b9a7869abbbb5c
SHA256

54a4651e2d91d821c886134a63b86f97e5854bc182fc1d82fd77f286ac64c1c2
SHA512

8772b9056725e3c81bbba197709c17399251311424c30bdf8ee802d825b90cbb9349abc24b4ce46020a7dc6c3f91518469c5c0d470e07573dfaa6e4e15e16fae
SSDEEP

384:FaZnLpWhVv9i3bYmr9l5WJ32olPxJ1vTfYerLw6xZP5NnI8:elWhZmDr7IJm4PxJ1LJrLw6hZI8

Score

10^/10

gink persistence worm

Malware Config

Targets

- Target
  
  6543447973d284ed2606c93daeaa8540_JC.exe
- Size
  
  37KB
- MD5
  
  6543447973d284ed2606c93daeaa8540
- SHA1
  
  cdd4a562a98a3a8a9e7824c9e3b9a7869abbbb5c
- SHA256
  
  54a4651e2d91d821c886134a63b86f97e5854bc182fc1d82fd77f286ac64c1c2
- SHA512
  
  8772b9056725e3c81bbba197709c17399251311424c30bdf8ee802d825b90cbb9349abc24b4ce46020a7dc6c3f91518469c5c0d470e07573dfaa6e4e15e16fae
- SSDEEP
  
  384:FaZnLpWhVv9i3bYmr9l5WJ32olPxJ1vTfYerLw6xZP5NnI8:elWhZmDr7IJm4PxJ1LJrLw6hZI8
Score

10^/10

gink persistence worm
- Gink
  worm gink
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ginkpersistenceworm

behavioral2

ginkpersistenceworm