gink | 0e92bd75ff72afaa3e9802546dc56b8d243db8222a6f226f623e3a8501e70ca6 | Triage

Sharing

General

Target

NEAS.f5d00c36c695d5b8a6e24f3531223580.exe
Size

37KB
Sample

231020-zd1zvaba9x
MD5

f5d00c36c695d5b8a6e24f3531223580
SHA1

89b5f3d728be6c8006f15bc2cc62eff0fb35dd7c
SHA256

0e92bd75ff72afaa3e9802546dc56b8d243db8222a6f226f623e3a8501e70ca6
SHA512

f29674b0ea3297f92dfd12d36edf540b0248d76c5891cf2c75eff5f239fe9ae4c8a3b29cb3db66fc1cc3d287545b92056f737c0c1aa39494ad76d92dda3106e3
SSDEEP

384:16tgGH/VL05U3GfERVeUsRhb+7X80QVT0IgMJGl4uJnI8jbdsO:g1A5UWcV3uhb+7X80QBAMslFdI83dsO

Score

10^/10

gink persistence worm

Malware Config

Targets

- Target
  
  NEAS.f5d00c36c695d5b8a6e24f3531223580.exe
- Size
  
  37KB
- MD5
  
  f5d00c36c695d5b8a6e24f3531223580
- SHA1
  
  89b5f3d728be6c8006f15bc2cc62eff0fb35dd7c
- SHA256
  
  0e92bd75ff72afaa3e9802546dc56b8d243db8222a6f226f623e3a8501e70ca6
- SHA512
  
  f29674b0ea3297f92dfd12d36edf540b0248d76c5891cf2c75eff5f239fe9ae4c8a3b29cb3db66fc1cc3d287545b92056f737c0c1aa39494ad76d92dda3106e3
- SSDEEP
  
  384:16tgGH/VL05U3GfERVeUsRhb+7X80QVT0IgMJGl4uJnI8jbdsO:g1A5UWcV3uhb+7X80QBAMslFdI83dsO
Score

10^/10

gink persistence worm
- Gink
  worm gink
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ginkpersistenceworm

behavioral2

ginkpersistenceworm