gink | eeac66507183527f587d1b75644eb9ec2cd60a8aa88538ae7f84edf51130f15d | Triage

Sharing

General

Target

NEAS.21951414d7c026cb46c9f9a6ed7d5a70.exe
Size

37KB
Sample

231113-cble2sfh56
MD5

21951414d7c026cb46c9f9a6ed7d5a70
SHA1

ae06dbd943393f99de5626d56a20dd07919d3366
SHA256

eeac66507183527f587d1b75644eb9ec2cd60a8aa88538ae7f84edf51130f15d
SHA512

07c63e3c02f40ac815c2eeeeb6d79cb0f201f458e180486fd5a4396e6f669ac8070bc1c5004c8bca87163bc301d4a24aeeb8d7b21420e05999656b94efe4fddf
SSDEEP

384:NXDUPQGDDUphUGPvlbblq2aPZHr3eVaRpS496SBsJnI8Bn1gl5:NXDUPVu1vlbpqHZz7pS49+dI8M

Score

10^/10

gink persistence worm

Malware Config

Targets

- Target
  
  NEAS.21951414d7c026cb46c9f9a6ed7d5a70.exe
- Size
  
  37KB
- MD5
  
  21951414d7c026cb46c9f9a6ed7d5a70
- SHA1
  
  ae06dbd943393f99de5626d56a20dd07919d3366
- SHA256
  
  eeac66507183527f587d1b75644eb9ec2cd60a8aa88538ae7f84edf51130f15d
- SHA512
  
  07c63e3c02f40ac815c2eeeeb6d79cb0f201f458e180486fd5a4396e6f669ac8070bc1c5004c8bca87163bc301d4a24aeeb8d7b21420e05999656b94efe4fddf
- SSDEEP
  
  384:NXDUPQGDDUphUGPvlbblq2aPZHr3eVaRpS496SBsJnI8Bn1gl5:NXDUPVu1vlbpqHZz7pS49+dI8M
Score

10^/10

gink persistence worm
- Gink
  worm gink
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ginkpersistenceworm

behavioral2

ginkpersistenceworm