gink | 02befee9fcda5614a7fc2cfaac0a427cd6482b9c1646b19edfbe9e93862c8cfe | Triage

Sharing

General

Target

NEAS.63363981a9592158afecb2d9774298b0_JC.exe
Size

37KB
Sample

231031-yp19badc2w
MD5

63363981a9592158afecb2d9774298b0
SHA1

cf9ec264c1d4329de6d383b558228fdc9653e105
SHA256

02befee9fcda5614a7fc2cfaac0a427cd6482b9c1646b19edfbe9e93862c8cfe
SHA512

b4866894fa2ca009daec2b192ac1d7a8c41d2bdb5901397c82be9a3a8e62fcec7a50f6c346b5d2c421f585ade14a375820c9e6a11acd0abcffeb515139ed8dca
SSDEEP

384:FXIZvTSdoxGCJ7evB/iMj2m5pfTDz9VhKPEA1bQFZ1EDlawMsJnI8HSE:WTt8I7evMM55T1fK8ALZRdI8

Score

10^/10

gink persistence worm

Malware Config

Targets

- Target
  
  NEAS.63363981a9592158afecb2d9774298b0_JC.exe
- Size
  
  37KB
- MD5
  
  63363981a9592158afecb2d9774298b0
- SHA1
  
  cf9ec264c1d4329de6d383b558228fdc9653e105
- SHA256
  
  02befee9fcda5614a7fc2cfaac0a427cd6482b9c1646b19edfbe9e93862c8cfe
- SHA512
  
  b4866894fa2ca009daec2b192ac1d7a8c41d2bdb5901397c82be9a3a8e62fcec7a50f6c346b5d2c421f585ade14a375820c9e6a11acd0abcffeb515139ed8dca
- SSDEEP
  
  384:FXIZvTSdoxGCJ7evB/iMj2m5pfTDz9VhKPEA1bQFZ1EDlawMsJnI8HSE:WTt8I7evMM55T1fK8ALZRdI8
Score

10^/10

gink persistence worm
- Gink
  worm gink
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ginkpersistenceworm

behavioral2

ginkpersistenceworm