gink | 10a8e1c15fa361be35bf0e16c7372aa7e873b7fa252ac5c6dcdd84f96e53221b | Triage

Sharing

General

Target

NEAS.5c325cee3f9b498ebb58368772124a80_JC.exe
Size

37KB
Sample

231031-1g42caeb71
MD5

5c325cee3f9b498ebb58368772124a80
SHA1

d5ef0d2717e49979642d54997795f19744b5eec0
SHA256

10a8e1c15fa361be35bf0e16c7372aa7e873b7fa252ac5c6dcdd84f96e53221b
SHA512

5bccb28d1cf2f88990420bbfb32b66237cf9e7c368c14d9930925fb4b68eb6109bd03a9ebd7a48ce1cdebd3ae2d3b28fbee86f647316d051dc061b40752f0df3
SSDEEP

384:8fjWiErk7Hw/5LYou/bQPpsm8U9dfmH97nI8Pc5:8WiEg7QhLYrQsJAmdDI8Pc

Score

10^/10

gink persistence worm

Malware Config

Targets

- Target
  
  NEAS.5c325cee3f9b498ebb58368772124a80_JC.exe
- Size
  
  37KB
- MD5
  
  5c325cee3f9b498ebb58368772124a80
- SHA1
  
  d5ef0d2717e49979642d54997795f19744b5eec0
- SHA256
  
  10a8e1c15fa361be35bf0e16c7372aa7e873b7fa252ac5c6dcdd84f96e53221b
- SHA512
  
  5bccb28d1cf2f88990420bbfb32b66237cf9e7c368c14d9930925fb4b68eb6109bd03a9ebd7a48ce1cdebd3ae2d3b28fbee86f647316d051dc061b40752f0df3
- SSDEEP
  
  384:8fjWiErk7Hw/5LYou/bQPpsm8U9dfmH97nI8Pc5:8WiEg7QhLYrQsJAmdDI8Pc
Score

10^/10

gink persistence worm
- Gink
  worm gink
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ginkpersistenceworm

behavioral2

ginkpersistenceworm