gink | 5730f0fc5c86d44820cf604d3a6f17266e74109718dce0302a8d5adf92b6a12a | Triage

Sharing

General

Target

NEAS.c2f27ae6c87643b2b7f11a28acba7a30.exe
Size

37KB
Sample

231031-kw98xaga25
MD5

c2f27ae6c87643b2b7f11a28acba7a30
SHA1

310acd1aff1687a7dd3693344eaca70d6546b21c
SHA256

5730f0fc5c86d44820cf604d3a6f17266e74109718dce0302a8d5adf92b6a12a
SHA512

fef2ca5385a5b447420dd01900795875b0b104b4de860931e55d64d71809ad906b64522dc0b378036372b3a61bb75d40a412a08cdf0bce020a98820e589f0c1a
SSDEEP

384:4x/lbQJ5h+LBCCfnewrDZBuRWBNIBWJJkNMHvYHfgc9R81YN6HJnI89Cyb:c/ZQ602ekDZB4WBNI4J/Wgc01dI84y

Score

10^/10

gink persistence worm

Malware Config

Targets

- Target
  
  NEAS.c2f27ae6c87643b2b7f11a28acba7a30.exe
- Size
  
  37KB
- MD5
  
  c2f27ae6c87643b2b7f11a28acba7a30
- SHA1
  
  310acd1aff1687a7dd3693344eaca70d6546b21c
- SHA256
  
  5730f0fc5c86d44820cf604d3a6f17266e74109718dce0302a8d5adf92b6a12a
- SHA512
  
  fef2ca5385a5b447420dd01900795875b0b104b4de860931e55d64d71809ad906b64522dc0b378036372b3a61bb75d40a412a08cdf0bce020a98820e589f0c1a
- SSDEEP
  
  384:4x/lbQJ5h+LBCCfnewrDZBuRWBNIBWJJkNMHvYHfgc9R81YN6HJnI89Cyb:c/ZQ602ekDZB4WBNI4J/Wgc01dI84y
Score

10^/10

gink persistence worm
- Gink
  worm gink
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ginkpersistenceworm

behavioral2

ginkpersistenceworm