gink | 0cbad9dcf99954034883b3ae1424ee5cb7e005f6e6adca34f2c36985a85d826a | Triage

Sharing

General

Target

0cbad9dcf99954034883b3ae1424ee5cb7e005f6e6adca34f2c36985a85d826a
Size

24KB
Sample

240314-vze72saa7w
MD5

d0d816102b26620b995adb2bc448e0a4
SHA1

d375c6b781064ebcb55bca89eced1e784be9c9f9
SHA256

0cbad9dcf99954034883b3ae1424ee5cb7e005f6e6adca34f2c36985a85d826a
SHA512

c2bffc5086f58c592217b88de0ceb30db741568464fadab3c0777a4378ecf0e35fab45edce01bf504bc6f58ea2d340d88589829050d19d238cfc4a6d98750ac5
SSDEEP

384:H6Lz0OyPaGPbG8FecNrgzbUFPlfRNefMfNq8UFsKWRzpeancfKykJIyfgS9/V+iE:H6Lo1RPbPFHRgzwFPlf/efMTXI8q

Score

10^/10

gink persistence worm

Malware Config

Targets

- Target
  
  0cbad9dcf99954034883b3ae1424ee5cb7e005f6e6adca34f2c36985a85d826a
- Size
  
  24KB
- MD5
  
  d0d816102b26620b995adb2bc448e0a4
- SHA1
  
  d375c6b781064ebcb55bca89eced1e784be9c9f9
- SHA256
  
  0cbad9dcf99954034883b3ae1424ee5cb7e005f6e6adca34f2c36985a85d826a
- SHA512
  
  c2bffc5086f58c592217b88de0ceb30db741568464fadab3c0777a4378ecf0e35fab45edce01bf504bc6f58ea2d340d88589829050d19d238cfc4a6d98750ac5
- SSDEEP
  
  384:H6Lz0OyPaGPbG8FecNrgzbUFPlfRNefMfNq8UFsKWRzpeancfKykJIyfgS9/V+iE:H6Lo1RPbPFHRgzwFPlf/efMTXI8q
Score

10^/10

gink persistence worm
- Gink
  worm gink
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ginkpersistenceworm

behavioral2

ginkpersistenceworm