gink | bf3260c9fa3c33770785e8fe9f62a1d9fb23c168acfdb1e5a0870de12ea8a679 | Triage

Sharing

General

Target

NEAS.NEAS86d05d9ab52db0785f8f967b98abf6dcexe_JC.exe
Size

37KB
Sample

231013-tabb5abc5t
MD5

86d05d9ab52db0785f8f967b98abf6dc
SHA1

b0f1d94f6453263ff6ee6fa638b6e0ae0bda8e7d
SHA256

bf3260c9fa3c33770785e8fe9f62a1d9fb23c168acfdb1e5a0870de12ea8a679
SHA512

eac331c617c91b35b69143f17528944c1a6c71d17355fa235045492e299759732cf76cc8ba76cf39a5c201baeb698d57c56452b72ac1392f67189f1366b223ed
SSDEEP

768:0aP/wpE5LiJTehk0YpOcvZfMV+llcalI8:1gpEsJyhk0YpOOZfM8n

Score

10^/10

gink persistence worm

Malware Config

Targets

- Target
  
  NEAS.NEAS86d05d9ab52db0785f8f967b98abf6dcexe_JC.exe
- Size
  
  37KB
- MD5
  
  86d05d9ab52db0785f8f967b98abf6dc
- SHA1
  
  b0f1d94f6453263ff6ee6fa638b6e0ae0bda8e7d
- SHA256
  
  bf3260c9fa3c33770785e8fe9f62a1d9fb23c168acfdb1e5a0870de12ea8a679
- SHA512
  
  eac331c617c91b35b69143f17528944c1a6c71d17355fa235045492e299759732cf76cc8ba76cf39a5c201baeb698d57c56452b72ac1392f67189f1366b223ed
- SSDEEP
  
  768:0aP/wpE5LiJTehk0YpOcvZfMV+llcalI8:1gpEsJyhk0YpOOZfM8n
Score

10^/10

gink persistence worm
- Gink
  worm gink
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ginkpersistenceworm

behavioral2

ginkpersistenceworm