gink | 5c9d985f9ea77ad855bf81ae6404caa6a3fdff5641f0178b667418e63b885efd | Triage

Sharing

General

Target

NEAS.a31e831e4f92f4e27998be89b31b0fe0.exe
Size

34KB
Sample

231107-x9hf9sgb27
MD5

a31e831e4f92f4e27998be89b31b0fe0
SHA1

fd0928721dc2ac02c079b0327d7126ee0a8b62d1
SHA256

5c9d985f9ea77ad855bf81ae6404caa6a3fdff5641f0178b667418e63b885efd
SHA512

f12a956d90fac9622d41d31d8421b1606f0bda6b863f1dcfa108f49f993fc56281970e8fae26d7e2a0905e72b525f10f726194c1cdc2a520dbca0f4c654fd44a
SSDEEP

384:u6Lz0OyPaGPbG8FecNrgzbUFPlfRNefMfNq8UhCKWRzpeancfKykJIyfgS9/V+iX:u6Lo1RPbPFHRgzwFPlf/efMT2I8W

Score

10^/10

gink persistence worm

Malware Config

Targets

- Target
  
  NEAS.a31e831e4f92f4e27998be89b31b0fe0.exe
- Size
  
  34KB
- MD5
  
  a31e831e4f92f4e27998be89b31b0fe0
- SHA1
  
  fd0928721dc2ac02c079b0327d7126ee0a8b62d1
- SHA256
  
  5c9d985f9ea77ad855bf81ae6404caa6a3fdff5641f0178b667418e63b885efd
- SHA512
  
  f12a956d90fac9622d41d31d8421b1606f0bda6b863f1dcfa108f49f993fc56281970e8fae26d7e2a0905e72b525f10f726194c1cdc2a520dbca0f4c654fd44a
- SSDEEP
  
  384:u6Lz0OyPaGPbG8FecNrgzbUFPlfRNefMfNq8UhCKWRzpeancfKykJIyfgS9/V+iX:u6Lo1RPbPFHRgzwFPlf/efMT2I8W
Score

10^/10

gink persistence worm
- Gink
  worm gink
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ginkpersistenceworm

behavioral2

ginkpersistenceworm