gink | 8744592566728b55309953dfb35a0b1937b2532ff84a5418ab31352fc41b92f1 | Triage

Sharing

General

Target

NEAS.e23b37e0c609ece38c8a78f0adb37140.exe
Size

37KB
Sample

231016-xcen4see37
MD5

e23b37e0c609ece38c8a78f0adb37140
SHA1

4ba622c3b0ff75f7f905c8442f7775e374e97f35
SHA256

8744592566728b55309953dfb35a0b1937b2532ff84a5418ab31352fc41b92f1
SHA512

f9f79d744ad91b237167426ce2bb1995b2e315cd22c64f45419c929bbbdfa4ad3df0b7780476bc553b0a7af438985af4d91675a9eff648b629c52efa48f4c0d5
SSDEEP

384:lPAhuZb1hfp8PZ69kBErewz63hNnDL5+uqyjvlFJnI8k1fP:lPyUbjfp8BDBEr7+vnDL58yPdI8k1

Score

10^/10

gink persistence worm

Malware Config

Targets

- Target
  
  NEAS.e23b37e0c609ece38c8a78f0adb37140.exe
- Size
  
  37KB
- MD5
  
  e23b37e0c609ece38c8a78f0adb37140
- SHA1
  
  4ba622c3b0ff75f7f905c8442f7775e374e97f35
- SHA256
  
  8744592566728b55309953dfb35a0b1937b2532ff84a5418ab31352fc41b92f1
- SHA512
  
  f9f79d744ad91b237167426ce2bb1995b2e315cd22c64f45419c929bbbdfa4ad3df0b7780476bc553b0a7af438985af4d91675a9eff648b629c52efa48f4c0d5
- SSDEEP
  
  384:lPAhuZb1hfp8PZ69kBErewz63hNnDL5+uqyjvlFJnI8k1fP:lPyUbjfp8BDBEr7+vnDL58yPdI8k1
Score

10^/10

gink persistence worm
- Gink
  worm gink
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ginkpersistenceworm

behavioral2

ginkpersistenceworm