gink | 1b1af1ddd18e0504348074fa8f969c5f657f8e5390c5e054a10cf28d8d52bd98 | Triage

Sharing

General

Target

c172a633f244dd1c67035715ecb9a4e9
Size

37KB
Sample

240311-yh9xwaef22
MD5

c172a633f244dd1c67035715ecb9a4e9
SHA1

e2bf15a024b6d0a88752401d53e047e39bb1e4cd
SHA256

1b1af1ddd18e0504348074fa8f969c5f657f8e5390c5e054a10cf28d8d52bd98
SHA512

9ee7591e45ccc90f2083b0b832bf7906b68d62823113f0fae687ca2c6a60320eefea024fcb871cf6df9048abb4ce79de55cabe024ecaf2693b7975937d3f9ff8
SSDEEP

384:qV4jRGBhOry47SDH02Ijd5vrf6DelcTKmpY2vnqwxX6lBdhoHnI8vuu:BRO0rEDAjdhrf6Del/yDvnqwF67MI8

Score

10^/10

gink persistence worm

Malware Config

Targets

- Target
  
  c172a633f244dd1c67035715ecb9a4e9
- Size
  
  37KB
- MD5
  
  c172a633f244dd1c67035715ecb9a4e9
- SHA1
  
  e2bf15a024b6d0a88752401d53e047e39bb1e4cd
- SHA256
  
  1b1af1ddd18e0504348074fa8f969c5f657f8e5390c5e054a10cf28d8d52bd98
- SHA512
  
  9ee7591e45ccc90f2083b0b832bf7906b68d62823113f0fae687ca2c6a60320eefea024fcb871cf6df9048abb4ce79de55cabe024ecaf2693b7975937d3f9ff8
- SSDEEP
  
  384:qV4jRGBhOry47SDH02Ijd5vrf6DelcTKmpY2vnqwxX6lBdhoHnI8vuu:BRO0rEDAjdhrf6Del/yDvnqwF67MI8
Score

10^/10

gink persistence worm
- Gink
  worm gink
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ginkpersistenceworm

behavioral2

ginkpersistenceworm