gink | f8db7df3da844fca5bad399da3bebecbcbf1d567b93c18f59b7516dfc4953843 | Triage

Sharing

General

Target

f8db7df3da844fca5bad399da3bebecbcbf1d567b93c18f59b7516dfc4953843
Size

37KB
Sample

240302-d8dbdaaa92
MD5

18844a258db4b6e806377e5e7067d676
SHA1

7153d753980397a88feb723dc7c53dd773a1b28b
SHA256

f8db7df3da844fca5bad399da3bebecbcbf1d567b93c18f59b7516dfc4953843
SHA512

2d45bc249b102ff46c2e1c4b5c94ede44718f72f35f6de34d055d6c666af4369617c47116a2e075b6afd2555b201948043133d849cbaf58d9d0837a9a699d656
SSDEEP

384:NnmDwCfjjm5KhZvn6dL4AN+fYJkm5E7aWNIstCDdkvXr4R7nLhNuuSnI8mnMd:NnCl250V6q8BGmWaW7CZkD4RbLfEI8Z

Score

10^/10

gink persistence worm

Malware Config

Targets

- Target
  
  f8db7df3da844fca5bad399da3bebecbcbf1d567b93c18f59b7516dfc4953843
- Size
  
  37KB
- MD5
  
  18844a258db4b6e806377e5e7067d676
- SHA1
  
  7153d753980397a88feb723dc7c53dd773a1b28b
- SHA256
  
  f8db7df3da844fca5bad399da3bebecbcbf1d567b93c18f59b7516dfc4953843
- SHA512
  
  2d45bc249b102ff46c2e1c4b5c94ede44718f72f35f6de34d055d6c666af4369617c47116a2e075b6afd2555b201948043133d849cbaf58d9d0837a9a699d656
- SSDEEP
  
  384:NnmDwCfjjm5KhZvn6dL4AN+fYJkm5E7aWNIstCDdkvXr4R7nLhNuuSnI8mnMd:NnCl250V6q8BGmWaW7CZkD4RbLfEI8Z
Score

10^/10

gink persistence worm
- Gink
  worm gink
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ginkpersistenceworm

behavioral2

ginkpersistenceworm