gink | 5594d01a2d3dbd3a2497a3ec0d7bf6a60ee15e77ff72fe29839cb5e5cfaeb40b | Triage

Sharing

General

Target

a425733eeb21d5c36bc0b44d52322231_JaffaCakes118
Size

37KB
Sample

241126-z242eawphq
MD5

a425733eeb21d5c36bc0b44d52322231
SHA1

178fb392fbec06726986e664e86c3bb8e6f2c8f8
SHA256

5594d01a2d3dbd3a2497a3ec0d7bf6a60ee15e77ff72fe29839cb5e5cfaeb40b
SHA512

f6472a321f7dd13ba3dd929bc6e38691d76354433bfb9fbecc0daab6a11151f864546650b4552b9c8a6a2e32894282044de7c2b5c789bf490e743e4ba8b8f6c9
SSDEEP

384:ZlROwQrII3ONJodCVXMepa3UtSzcD90mblrnI8v:ZmwQh3OnxXOmSE2+I8v

Score

10^/10

gink discovery persistence worm

Malware Config

Targets

- Target
  
  a425733eeb21d5c36bc0b44d52322231_JaffaCakes118
- Size
  
  37KB
- MD5
  
  a425733eeb21d5c36bc0b44d52322231
- SHA1
  
  178fb392fbec06726986e664e86c3bb8e6f2c8f8
- SHA256
  
  5594d01a2d3dbd3a2497a3ec0d7bf6a60ee15e77ff72fe29839cb5e5cfaeb40b
- SHA512
  
  f6472a321f7dd13ba3dd929bc6e38691d76354433bfb9fbecc0daab6a11151f864546650b4552b9c8a6a2e32894282044de7c2b5c789bf490e743e4ba8b8f6c9
- SSDEEP
  
  384:ZlROwQrII3ONJodCVXMepa3UtSzcD90mblrnI8v:ZmwQh3OnxXOmSE2+I8v
Score

10^/10

gink discovery persistence worm
- Gink
  worm gink
- Gink family
  gink
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ginkdiscoverypersistenceworm

behavioral2

ginkdiscoverypersistenceworm