gink | 23a407edd5e5c02d6dfd21ec18f3cfe4b9da9d27bd0218664092e8ebfe17dccc | Triage

Sharing

General

Target

9321f8114562543ca4825e98d44807b0N.exe
Size

37KB
Sample

240715-ghz91a1cjj
MD5

9321f8114562543ca4825e98d44807b0
SHA1

05475c7dbf880ea39b7ecf78291447db8647bada
SHA256

23a407edd5e5c02d6dfd21ec18f3cfe4b9da9d27bd0218664092e8ebfe17dccc
SHA512

6c0c3dc761d5c321a278d2414b00cdb8ee3aea450cdb0c87b384b20f4d1abfee2ccff87ff9ef9805414c14966189088bf0f058637054d1466c5353b6f655cf59
SSDEEP

384:Bz6VJs0ifcsNSB8KmphAlHc5PYYM5h+FE/Wj2lQ22MNMPTfBHFcnWnI8BNV:BzKSp4GSHcdYz5hedjc2MNwZ2kI8B

Score

10^/10

gink persistence worm

Malware Config

Targets

- Target
  
  9321f8114562543ca4825e98d44807b0N.exe
- Size
  
  37KB
- MD5
  
  9321f8114562543ca4825e98d44807b0
- SHA1
  
  05475c7dbf880ea39b7ecf78291447db8647bada
- SHA256
  
  23a407edd5e5c02d6dfd21ec18f3cfe4b9da9d27bd0218664092e8ebfe17dccc
- SHA512
  
  6c0c3dc761d5c321a278d2414b00cdb8ee3aea450cdb0c87b384b20f4d1abfee2ccff87ff9ef9805414c14966189088bf0f058637054d1466c5353b6f655cf59
- SSDEEP
  
  384:Bz6VJs0ifcsNSB8KmphAlHc5PYYM5h+FE/Wj2lQ22MNMPTfBHFcnWnI8BNV:BzKSp4GSHcdYz5hedjc2MNwZ2kI8B
Score

10^/10

gink persistence worm
- Gink
  worm gink
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ginkpersistenceworm

behavioral2

ginkpersistenceworm