gink | f735347f074ff2e3ded73c3c0009c9f6dc5095bd5a9341fa2f0144d7166b0a07 | Triage

Sharing

General

Target

NEAS.ca409816d71718a2b0a10a643366f000.exe
Size

37KB
Sample

231104-jt12sadc9s
MD5

ca409816d71718a2b0a10a643366f000
SHA1

532380a0297ee19d523168e8fe8bcd85a67ffb70
SHA256

f735347f074ff2e3ded73c3c0009c9f6dc5095bd5a9341fa2f0144d7166b0a07
SHA512

658c5a604cc8642af7cc79ca740e701853b548cf1fb7dba8b49cfe627532e449c3b313e756c8392871f09560f0071dd3947378feb4131beb3f3c6ba69a889a8d
SSDEEP

384:oPvmmRUpxPxN5hC+yX5i8uSSIMzOvu+TnI8Gymo:oHmmRUbRMzwESInFI8tm

Score

10^/10

gink persistence worm

Malware Config

Targets

- Target
  
  NEAS.ca409816d71718a2b0a10a643366f000.exe
- Size
  
  37KB
- MD5
  
  ca409816d71718a2b0a10a643366f000
- SHA1
  
  532380a0297ee19d523168e8fe8bcd85a67ffb70
- SHA256
  
  f735347f074ff2e3ded73c3c0009c9f6dc5095bd5a9341fa2f0144d7166b0a07
- SHA512
  
  658c5a604cc8642af7cc79ca740e701853b548cf1fb7dba8b49cfe627532e449c3b313e756c8392871f09560f0071dd3947378feb4131beb3f3c6ba69a889a8d
- SSDEEP
  
  384:oPvmmRUpxPxN5hC+yX5i8uSSIMzOvu+TnI8Gymo:oHmmRUbRMzwESInFI8tm
Score

10^/10

gink persistence worm
- Gink
  worm gink
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ginkpersistenceworm

behavioral2

ginkpersistenceworm