gink | cdaff9c343cee644bf97b8cbb5adcb8d6537cbe4a49ddf78ba289603d3fa2db8 | Triage

Sharing

General

Target

NEAS.b5c8c1f5a5f83f2fe7db2167155553bf_JC.exe
Size

36KB
Sample

231015-shr46sac95
MD5

b5c8c1f5a5f83f2fe7db2167155553bf
SHA1

7da5a65889324b261633d7f92c39370d48c7bd29
SHA256

cdaff9c343cee644bf97b8cbb5adcb8d6537cbe4a49ddf78ba289603d3fa2db8
SHA512

b21cfe6d741dec0424952cf065ef2a96dcee5299d4993c3e8b1b67c45acdb2efd03c25e2aae37f3d483a5df0316106dfcd79a136efac8938b335fc523317df16
SSDEEP

384:O6Lz0OyPaGPbG8FecNrgzbUFPlfRNefMfNq8Utm1oJCKWRzpeancfKykJIyfgS9Z:O6Lo1RPbPFHRgzwFPlf/efMTKHkI8Z

Score

10^/10

gink persistence worm

Malware Config

Targets

- Target
  
  NEAS.b5c8c1f5a5f83f2fe7db2167155553bf_JC.exe
- Size
  
  36KB
- MD5
  
  b5c8c1f5a5f83f2fe7db2167155553bf
- SHA1
  
  7da5a65889324b261633d7f92c39370d48c7bd29
- SHA256
  
  cdaff9c343cee644bf97b8cbb5adcb8d6537cbe4a49ddf78ba289603d3fa2db8
- SHA512
  
  b21cfe6d741dec0424952cf065ef2a96dcee5299d4993c3e8b1b67c45acdb2efd03c25e2aae37f3d483a5df0316106dfcd79a136efac8938b335fc523317df16
- SSDEEP
  
  384:O6Lz0OyPaGPbG8FecNrgzbUFPlfRNefMfNq8Utm1oJCKWRzpeancfKykJIyfgS9Z:O6Lo1RPbPFHRgzwFPlf/efMTKHkI8Z
Score

10^/10

gink persistence worm
- Gink
  worm gink
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ginkpersistenceworm

behavioral2

ginkpersistenceworm