gink | 31432fbd7e85846f2d8f61cc70d2cc4c57e63d37174e591833c5833ba084810e | Triage

Sharing

General

Target

023691895a5916d7670864f952b90a60N.exe
Size

37KB
Sample

240706-lnfj1avapp
MD5

023691895a5916d7670864f952b90a60
SHA1

af952fb62facd334495d3027c12738acc2373e13
SHA256

31432fbd7e85846f2d8f61cc70d2cc4c57e63d37174e591833c5833ba084810e
SHA512

c422ebfad22a034d9140fc7b63c298d6a95bfd4c38d62ddbcf0d2c6a7b820956e37fba99538a0b451c8023f7823bbdd812aa206d2a5bb6b62a6e05f936a7def4
SSDEEP

768:0/zXu6t51XJ8icoZgzPmHt42V/c0+yLbbBiI8:OzXuyj3CPxfybBY

Score

10^/10

gink persistence worm

Malware Config

Targets

- Target
  
  023691895a5916d7670864f952b90a60N.exe
- Size
  
  37KB
- MD5
  
  023691895a5916d7670864f952b90a60
- SHA1
  
  af952fb62facd334495d3027c12738acc2373e13
- SHA256
  
  31432fbd7e85846f2d8f61cc70d2cc4c57e63d37174e591833c5833ba084810e
- SHA512
  
  c422ebfad22a034d9140fc7b63c298d6a95bfd4c38d62ddbcf0d2c6a7b820956e37fba99538a0b451c8023f7823bbdd812aa206d2a5bb6b62a6e05f936a7def4
- SSDEEP
  
  768:0/zXu6t51XJ8icoZgzPmHt42V/c0+yLbbBiI8:OzXuyj3CPxfybBY
Score

10^/10

gink persistence worm
- Gink
  worm gink
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ginkpersistenceworm

behavioral2

ginkpersistenceworm