gink | 7b36fcd2910473cd9fa7e233f8d1ab644162fe7efa6e91ba66367fa19c3d5ef6 | Triage

Sharing

General

Target

385702c5c94ea9deb6eed7e4a21fe380N.exe
Size

34KB
Sample

240707-dm938avbma
MD5

385702c5c94ea9deb6eed7e4a21fe380
SHA1

b2756d7a39749819e3a7df4bc0d2915008d24860
SHA256

7b36fcd2910473cd9fa7e233f8d1ab644162fe7efa6e91ba66367fa19c3d5ef6
SHA512

896561f73ec787f8d9afe53418fd498c1feaae9a37f1865c2ece905b2346e04651a3f913801a8023cd5277a48f9e557ab643676b1b65377a8d52168b3d596407
SSDEEP

384:y6Lz0OyPaGPbG8FecNrgzbUFPlfRNefMfNq8UQIkWyKWRzpeancfKykJIyfgS9/6:y6Lo1RPbPFHRgzwFPlf/efMTekHdI8W

Score

10^/10

gink persistence worm

Malware Config

Targets

- Target
  
  385702c5c94ea9deb6eed7e4a21fe380N.exe
- Size
  
  34KB
- MD5
  
  385702c5c94ea9deb6eed7e4a21fe380
- SHA1
  
  b2756d7a39749819e3a7df4bc0d2915008d24860
- SHA256
  
  7b36fcd2910473cd9fa7e233f8d1ab644162fe7efa6e91ba66367fa19c3d5ef6
- SHA512
  
  896561f73ec787f8d9afe53418fd498c1feaae9a37f1865c2ece905b2346e04651a3f913801a8023cd5277a48f9e557ab643676b1b65377a8d52168b3d596407
- SSDEEP
  
  384:y6Lz0OyPaGPbG8FecNrgzbUFPlfRNefMfNq8UQIkWyKWRzpeancfKykJIyfgS9/6:y6Lo1RPbPFHRgzwFPlf/efMTekHdI8W
Score

10^/10

gink persistence worm
- Gink
  worm gink
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ginkpersistenceworm

behavioral2

ginkpersistenceworm