gink | 0d538c3ebb5f5aa62cc84995ade4277b2ffd8e89d6b62569373bb20db89f96df | Triage

Sharing

General

Target

NEAS.ecb205649366ed8549d08cb426a6df8e_JC.exe
Size

37KB
Sample

231010-y68pqabb87
MD5

ecb205649366ed8549d08cb426a6df8e
SHA1

16b0a145268c1ac8fbf32ad830533cba7d3f89ef
SHA256

0d538c3ebb5f5aa62cc84995ade4277b2ffd8e89d6b62569373bb20db89f96df
SHA512

e7fad3e75d25648fdaf40473e71d3843d6a72b8a640f5ca4227fad31da3596e9f71dcfef35ed142b1f28eb6a154f9a70a2711e458ee070c5cb43915171fd7258
SSDEEP

384:UDAEHuA88eZRacRcdlpPE4YBmusu6XJQTDmPyHjWzpREeSSFnI8Rq:U0wuTzYq4YBQqTDljQRbI8R

Score

10^/10

gink persistence worm

Malware Config

Targets

- Target
  
  NEAS.ecb205649366ed8549d08cb426a6df8e_JC.exe
- Size
  
  37KB
- MD5
  
  ecb205649366ed8549d08cb426a6df8e
- SHA1
  
  16b0a145268c1ac8fbf32ad830533cba7d3f89ef
- SHA256
  
  0d538c3ebb5f5aa62cc84995ade4277b2ffd8e89d6b62569373bb20db89f96df
- SHA512
  
  e7fad3e75d25648fdaf40473e71d3843d6a72b8a640f5ca4227fad31da3596e9f71dcfef35ed142b1f28eb6a154f9a70a2711e458ee070c5cb43915171fd7258
- SSDEEP
  
  384:UDAEHuA88eZRacRcdlpPE4YBmusu6XJQTDmPyHjWzpREeSSFnI8Rq:U0wuTzYq4YBQqTDljQRbI8R
Score

10^/10

gink persistence worm
- Gink
  worm gink
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ginkpersistenceworm

behavioral2

ginkpersistenceworm