gink | a799c19efe33b88565a1a3d2df8385945eaaa025f4aca0f10a10c134f62d2424 | Triage

Sharing

General

Target

NEAS.39eae6437af0b932a7e6cc6a5760c4c0.exe
Size

37KB
Sample

231101-c3rfdabd25
MD5

39eae6437af0b932a7e6cc6a5760c4c0
SHA1

79d7f59f041a0e5cfcf766d2c75a82f1dc7740a1
SHA256

a799c19efe33b88565a1a3d2df8385945eaaa025f4aca0f10a10c134f62d2424
SHA512

5db6c3e6680e1d0abadabf980a572068c03ded21353f653d34085756d6549381469938b9f130f1886afeb88dbf4ce3961b51a0de2befb3bbc92f4a9635e297cc
SSDEEP

384:DiDhM5GOqikWSfP4/yu1/3+qdBTTH//nnwJJy0uE++/nI8Yz:DisPNVS3M1/3lTTHnwipE+UI8Y

Score

10^/10

gink persistence worm

Malware Config

Targets

- Target
  
  NEAS.39eae6437af0b932a7e6cc6a5760c4c0.exe
- Size
  
  37KB
- MD5
  
  39eae6437af0b932a7e6cc6a5760c4c0
- SHA1
  
  79d7f59f041a0e5cfcf766d2c75a82f1dc7740a1
- SHA256
  
  a799c19efe33b88565a1a3d2df8385945eaaa025f4aca0f10a10c134f62d2424
- SHA512
  
  5db6c3e6680e1d0abadabf980a572068c03ded21353f653d34085756d6549381469938b9f130f1886afeb88dbf4ce3961b51a0de2befb3bbc92f4a9635e297cc
- SSDEEP
  
  384:DiDhM5GOqikWSfP4/yu1/3+qdBTTH//nnwJJy0uE++/nI8Yz:DisPNVS3M1/3lTTHnwipE+UI8Y
Score

10^/10

gink persistence worm
- Gink
  worm gink
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ginkpersistenceworm

behavioral2

ginkpersistenceworm