gink | 2d2f738a252fc7ca55e4db393de5929eef564e46016f7fc7c9c95ce7d2e78784 | Triage

Sharing

General

Target

NEAS.6446db187cac1f1d85613de3f51b9630.exe
Size

37KB
Sample

231101-fchx4acf46
MD5

6446db187cac1f1d85613de3f51b9630
SHA1

fc2c4e6f65e10091ad5c9fc3e68a18be674dfaf7
SHA256

2d2f738a252fc7ca55e4db393de5929eef564e46016f7fc7c9c95ce7d2e78784
SHA512

42f205d87ab5d9f8b8ba53cd8c593bee90a6fd6ef1cec5fe35b8142dff34de8ead6a359c2b75abb4456662b3b56ad9b89a25c101424e71751ebf55cc35a8fd6e
SSDEEP

384:glmkiuv7xlgiJjlTnJXHJfIZbceD2gYFpkv0vnMh60y2HnnYnI8Gjv:glmkiuz4iJjlTJXi+HtvMByhI8G7

Score

10^/10

gink persistence worm

Malware Config

Targets

- Target
  
  NEAS.6446db187cac1f1d85613de3f51b9630.exe
- Size
  
  37KB
- MD5
  
  6446db187cac1f1d85613de3f51b9630
- SHA1
  
  fc2c4e6f65e10091ad5c9fc3e68a18be674dfaf7
- SHA256
  
  2d2f738a252fc7ca55e4db393de5929eef564e46016f7fc7c9c95ce7d2e78784
- SHA512
  
  42f205d87ab5d9f8b8ba53cd8c593bee90a6fd6ef1cec5fe35b8142dff34de8ead6a359c2b75abb4456662b3b56ad9b89a25c101424e71751ebf55cc35a8fd6e
- SSDEEP
  
  384:glmkiuv7xlgiJjlTnJXHJfIZbceD2gYFpkv0vnMh60y2HnnYnI8Gjv:glmkiuz4iJjlTJXi+HtvMByhI8G7
Score

10^/10

gink persistence worm
- Gink
  worm gink
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ginkpersistenceworm

behavioral2

ginkpersistenceworm