gink | 2dde453d6bf6db400c4add12ac455bc572142ac8ad61d70aa12108e708ac9fd2 | Triage

Sharing

General

Target

NEAS.d893359b3289efdb9215e8a9faab8310.exe
Size

37KB
Sample

231102-vcl23sdd29
MD5

d893359b3289efdb9215e8a9faab8310
SHA1

9dde2065173d7db1576c8ef31067cb7bd089503f
SHA256

2dde453d6bf6db400c4add12ac455bc572142ac8ad61d70aa12108e708ac9fd2
SHA512

da6cfa03e2342e85ad25cc7526feaea28235d1112578ed037ceffab11745b46e2d57cec25e1bc2dee571c17d4b6d9986748b39d6d8a38602b8a305f4c6b47264
SSDEEP

384:HSwRF88HkOlK7sOLyaoX0H/YIPu7B91Cm8WLJnI8t3:ywTJgIOeaoX0fY0C1Cm/dI8B

Score

10^/10

gink persistence worm

Malware Config

Targets

- Target
  
  NEAS.d893359b3289efdb9215e8a9faab8310.exe
- Size
  
  37KB
- MD5
  
  d893359b3289efdb9215e8a9faab8310
- SHA1
  
  9dde2065173d7db1576c8ef31067cb7bd089503f
- SHA256
  
  2dde453d6bf6db400c4add12ac455bc572142ac8ad61d70aa12108e708ac9fd2
- SHA512
  
  da6cfa03e2342e85ad25cc7526feaea28235d1112578ed037ceffab11745b46e2d57cec25e1bc2dee571c17d4b6d9986748b39d6d8a38602b8a305f4c6b47264
- SSDEEP
  
  384:HSwRF88HkOlK7sOLyaoX0H/YIPu7B91Cm8WLJnI8t3:ywTJgIOeaoX0fY0C1Cm/dI8B
Score

10^/10

gink persistence worm
- Gink
  worm gink
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ginkpersistenceworm

behavioral2

ginkpersistenceworm