gink | bc94637ce90d1f1a1cff2d96f649909bf0069bb96b363a61ea7ba5c9609e9c0a | Triage

Sharing

General

Target

bc94637ce90d1f1a1cff2d96f649909bf0069bb96b363a61ea7ba5c9609e9c0a
Size

37KB
Sample

240614-dxnyqsxcqj
MD5

884a64fd954d7438a98762714d020354
SHA1

c51ec45a7ea4370a7f8cf06719eadac6c1e422b8
SHA256

bc94637ce90d1f1a1cff2d96f649909bf0069bb96b363a61ea7ba5c9609e9c0a
SHA512

7c011306e2e4f62164bf7483247c320b9bd965f2ac7f036be03605f194632f9bc18aee66ef73e16a3bd5f07d536730f82effa497cfbc06540e82b71b6a41cbb9
SSDEEP

384:dUhS+mWzlfJkd8vt+r2mdTJ0orET48D2IEkB7LpHnI89gKe:uL5JkevtwXJ0orETF2/kB5I89gK

Score

10^/10

gink persistence worm

Malware Config

Targets

- Target
  
  bc94637ce90d1f1a1cff2d96f649909bf0069bb96b363a61ea7ba5c9609e9c0a
- Size
  
  37KB
- MD5
  
  884a64fd954d7438a98762714d020354
- SHA1
  
  c51ec45a7ea4370a7f8cf06719eadac6c1e422b8
- SHA256
  
  bc94637ce90d1f1a1cff2d96f649909bf0069bb96b363a61ea7ba5c9609e9c0a
- SHA512
  
  7c011306e2e4f62164bf7483247c320b9bd965f2ac7f036be03605f194632f9bc18aee66ef73e16a3bd5f07d536730f82effa497cfbc06540e82b71b6a41cbb9
- SSDEEP
  
  384:dUhS+mWzlfJkd8vt+r2mdTJ0orET48D2IEkB7LpHnI89gKe:uL5JkevtwXJ0orETF2/kB5I89gK
Score

10^/10

gink persistence worm
- Gink
  worm gink
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ginkpersistenceworm

behavioral2

ginkpersistenceworm