gink | 023c801d7c5beb7124aeaf6d011c2dc157a2bcd7e1cfc064528a6aa4b1b56f44 | Triage

Sharing

General

Target

023c801d7c5beb7124aeaf6d011c2dc157a2bcd7e1cfc064528a6aa4b1b56f44
Size

37KB
Sample

241024-w1pzbazgln
MD5

f4e3495de6440c7fd3feff4da73795e7
SHA1

4e4a842f382a2cffd79833579155952bdd656007
SHA256

023c801d7c5beb7124aeaf6d011c2dc157a2bcd7e1cfc064528a6aa4b1b56f44
SHA512

0f383cc3e2aeba9906c4a201fbbf0768f67c6ce1873663380dbc2e211f7b2bfb2db3b0f3f9c5f658d21f63178bda4d79bd8cad43cffaa0bb704a650f1449cc56
SSDEEP

384:rwSAlr3KbvEJS4c+6UHwXRhYEVs8K2begnib1I5ULlkTWdcynI85LT:rMlraE/c+6QwX52bmn25BkTWdcYI85L

Score

10^/10

gink discovery persistence worm

Malware Config

Targets

- Target
  
  023c801d7c5beb7124aeaf6d011c2dc157a2bcd7e1cfc064528a6aa4b1b56f44
- Size
  
  37KB
- MD5
  
  f4e3495de6440c7fd3feff4da73795e7
- SHA1
  
  4e4a842f382a2cffd79833579155952bdd656007
- SHA256
  
  023c801d7c5beb7124aeaf6d011c2dc157a2bcd7e1cfc064528a6aa4b1b56f44
- SHA512
  
  0f383cc3e2aeba9906c4a201fbbf0768f67c6ce1873663380dbc2e211f7b2bfb2db3b0f3f9c5f658d21f63178bda4d79bd8cad43cffaa0bb704a650f1449cc56
- SSDEEP
  
  384:rwSAlr3KbvEJS4c+6UHwXRhYEVs8K2begnib1I5ULlkTWdcynI85LT:rMlraE/c+6QwX52bmn25BkTWdcYI85L
Score

10^/10

gink discovery persistence worm
- Gink
  worm gink
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ginkdiscoverypersistenceworm

behavioral2

ginkdiscoverypersistenceworm