gink | 9f216f4938df645abff017253079be1bb600a3531260c09117370dbb673dc1b9 | Triage

Sharing

General

Target

41526b20fa21d3d4a410c5d834786d90N.exe
Size

37KB
Sample

240731-bl2pcataqh
MD5

41526b20fa21d3d4a410c5d834786d90
SHA1

00407fae91318c28f025f7c5891a827f4b982afc
SHA256

9f216f4938df645abff017253079be1bb600a3531260c09117370dbb673dc1b9
SHA512

43bc85164d6a9d4a328d07e550f40b60e09753f624b980224732faf2cd61ad63a73364293adb5a145fd4bc2baa47ddede36639d6580c2350d1943b1205e2d46c
SSDEEP

384:3MGelWsiuHJ7aqJArbbrmCAeWF5Ob9dncQACgGK1nI8CS:zOHJAnnmCAeQOb9JcQOxI8

Score

10^/10

gink discovery persistence worm

Malware Config

Targets

- Target
  
  41526b20fa21d3d4a410c5d834786d90N.exe
- Size
  
  37KB
- MD5
  
  41526b20fa21d3d4a410c5d834786d90
- SHA1
  
  00407fae91318c28f025f7c5891a827f4b982afc
- SHA256
  
  9f216f4938df645abff017253079be1bb600a3531260c09117370dbb673dc1b9
- SHA512
  
  43bc85164d6a9d4a328d07e550f40b60e09753f624b980224732faf2cd61ad63a73364293adb5a145fd4bc2baa47ddede36639d6580c2350d1943b1205e2d46c
- SSDEEP
  
  384:3MGelWsiuHJ7aqJArbbrmCAeWF5Ob9dncQACgGK1nI8CS:zOHJAnnmCAeQOb9JcQOxI8
Score

10^/10

gink discovery persistence worm
- Gink
  worm gink
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ginkdiscoverypersistenceworm

behavioral2

ginkdiscoverypersistenceworm