gink | 609cf33b2cfdc6c6677ba8086b809269d055071910e3136fe1abf210e350cc98 | Triage

Sharing

General

Target

NEAS.c478877ef4b3117f0038815b9d0055f0_JC.exe
Size

37KB
Sample

231101-qvbxlsgh81
MD5

c478877ef4b3117f0038815b9d0055f0
SHA1

6ececb191921321db1f557f367076477686e6e0c
SHA256

609cf33b2cfdc6c6677ba8086b809269d055071910e3136fe1abf210e350cc98
SHA512

12fe0c2cbe624a8ed4ab6c0d115ef5e7b52126adb9d87284cf1228675993f37f0f2156730e43f831d9631d1e8016369e796c42356c4a226a20b3ef83218bcfc4
SSDEEP

384:XTXpIU+h4loU9OG11KqH7G3jqy+wGm78yCKd157IuGs2KWmnI8QR:XT5IU+6uG1IoCL+wGcCKdY6W0I8

Score

10^/10

gink persistence worm

Malware Config

Targets

- Target
  
  NEAS.c478877ef4b3117f0038815b9d0055f0_JC.exe
- Size
  
  37KB
- MD5
  
  c478877ef4b3117f0038815b9d0055f0
- SHA1
  
  6ececb191921321db1f557f367076477686e6e0c
- SHA256
  
  609cf33b2cfdc6c6677ba8086b809269d055071910e3136fe1abf210e350cc98
- SHA512
  
  12fe0c2cbe624a8ed4ab6c0d115ef5e7b52126adb9d87284cf1228675993f37f0f2156730e43f831d9631d1e8016369e796c42356c4a226a20b3ef83218bcfc4
- SSDEEP
  
  384:XTXpIU+h4loU9OG11KqH7G3jqy+wGm78yCKd157IuGs2KWmnI8QR:XT5IU+6uG1IoCL+wGcCKdY6W0I8
Score

10^/10

gink persistence worm
- Gink
  worm gink
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ginkpersistenceworm

behavioral2

ginkpersistenceworm