gink | 4e6c1e75b10e88b8765bd4c406b54548c3458bd13f217ec878dc4d00eed5075c | Triage

Sharing

General

Target

NEAS.4dddc05fdc541c1015e728445653bd53.exe
Size

37KB
Sample

231101-kch1bafa94
MD5

4dddc05fdc541c1015e728445653bd53
SHA1

02f3f150c7da5b26693c4c2b26466af703f56426
SHA256

4e6c1e75b10e88b8765bd4c406b54548c3458bd13f217ec878dc4d00eed5075c
SHA512

0d01bd9715b0aeeb9bd89c1e8080bfb3c91db1f9e1def8dd6774de0562e90ef2cbf5c7b672b17b6b4907e78989112e77ebf32935da8b0010877fad71f2e4add4
SSDEEP

384:PfjWiErk7Hw/5LYou/bQPpsmhU9dfmH9zgBjnI8Pc5:DWiEg7QhLYrQs8AmduI8Pc

Score

10^/10

gink persistence worm

Malware Config

Targets

- Target
  
  NEAS.4dddc05fdc541c1015e728445653bd53.exe
- Size
  
  37KB
- MD5
  
  4dddc05fdc541c1015e728445653bd53
- SHA1
  
  02f3f150c7da5b26693c4c2b26466af703f56426
- SHA256
  
  4e6c1e75b10e88b8765bd4c406b54548c3458bd13f217ec878dc4d00eed5075c
- SHA512
  
  0d01bd9715b0aeeb9bd89c1e8080bfb3c91db1f9e1def8dd6774de0562e90ef2cbf5c7b672b17b6b4907e78989112e77ebf32935da8b0010877fad71f2e4add4
- SSDEEP
  
  384:PfjWiErk7Hw/5LYou/bQPpsmhU9dfmH9zgBjnI8Pc5:DWiEg7QhLYrQs8AmduI8Pc
Score

10^/10

gink persistence worm
- Gink
  worm gink
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ginkpersistenceworm

behavioral2

ginkpersistenceworm