gink | 4128f280d07d779023b837d8b2cfcf603858a4a5484d60807ebdc086b250638a | Triage

Sharing

General

Target

5d4c27d2f4c9f70f4b9c568c2492da00N.exe
Size

37KB
Sample

240731-d8j4xsvcpl
MD5

5d4c27d2f4c9f70f4b9c568c2492da00
SHA1

d342e651eeb4e3254d0307db74bf6d2e2a4dc11f
SHA256

4128f280d07d779023b837d8b2cfcf603858a4a5484d60807ebdc086b250638a
SHA512

7b16dd70a5ecb670235152d6ad3734ad02031ec719d97f08342dec40b57c90f337a14329196c938f670c94cbbb8ae46cd9693a13c54d7b30b3b84815d466bb17
SSDEEP

384:d+iQTHnIGeHL4L8t3NHizczo0SHWNbdj/qb5IS9Dwv335cnI8T3:AiOHM4L+UF2NhYRuv335uI8T3

Score

10^/10

gink discovery persistence worm

Malware Config

Targets

- Target
  
  5d4c27d2f4c9f70f4b9c568c2492da00N.exe
- Size
  
  37KB
- MD5
  
  5d4c27d2f4c9f70f4b9c568c2492da00
- SHA1
  
  d342e651eeb4e3254d0307db74bf6d2e2a4dc11f
- SHA256
  
  4128f280d07d779023b837d8b2cfcf603858a4a5484d60807ebdc086b250638a
- SHA512
  
  7b16dd70a5ecb670235152d6ad3734ad02031ec719d97f08342dec40b57c90f337a14329196c938f670c94cbbb8ae46cd9693a13c54d7b30b3b84815d466bb17
- SSDEEP
  
  384:d+iQTHnIGeHL4L8t3NHizczo0SHWNbdj/qb5IS9Dwv335cnI8T3:AiOHM4L+UF2NhYRuv335uI8T3
Score

10^/10

gink discovery persistence worm
- Gink
  worm gink
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ginkdiscoverypersistenceworm

behavioral2

ginkdiscoverypersistenceworm