MALICIOUS — 1ad0d54a6bd79f92b01688cc0b8aaa413261eae7d223b8ae7c56b70a2e3f77a1

MALICIOUS — 1ad0d54a6bd79f92b01688cc0b8aaa413261eae7d223b8ae7c56b70a2e3f77a1 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Ganelp family. 3 of 25 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 1ad0d54a6bd79f92b01688cc0b8aaa413261eae7d223b8ae7c56b70a2e3f77a1
SHA-1: 8f30e08e7137909f60c750769930baa37131301c
MD5: 2093410bfe234fa5cc421dbf17a71fec
imphash: fe9b94dd0e4ea2a905fbd4f42f4b2f8f
ssdeep: 768:6zQYScGrIubHuYtv0xwYHw5FAe2Qvncwx8Nwv92Vf9N:8QTIubHR5wQvAh
TLSH: T152315DC1262B2045ECA7E37B0C516D2CD02A8CF49EB798DC444A523CAD61B2763B7977
Submitted as: 1ad0d54a6bd79f92b01688cc0b8aaa413261eae7d223b8ae7c56b70a2e3f77a1
File type: pe · Size: 41961 bytes
Verdict: malicious (99/100) · Family: Ganelp

Detections (3 of 25 engines)

Microsoft Defender: Worm:Win32/Ganelp!atmnm
Emsisoft (Emergency Kit): Trojan.Agent.EY
Kaspersky (KVRT): HEUR:Worm.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

Dropped a malicious payload (Ganelp): 8f9ed23f7a00d9acf796e657d36232cf098ccbb2488415cbb43ce1835e0ac7f5 - dynamic signal, weight 0.80, confidence 0.90
Microsoft Defender flagged Worm:Win32/Ganelp!atmnm (rule Worm:Win32/Ganelp!atmnm) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Agent.EY (rule Trojan.Agent.EY) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Worm.Win32.Generic (rule HEUR:Worm.Win32.Generic) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 30 external host(s) at runtime (13 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

22920 behavior events · 2 ATT&CK techniques · 2 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/8589/files/8f9ed23f7a00d9acf796e657d36232cf098ccbb2488415cbb43ce1835e0ac7f5 - 8f9ed23f7a00d9acf796e657d36232cf098ccbb2488415cbb43ce1835e0ac7f5
/opt/CAPEv2/storage/analyses/8589/files/49dca65f362fee401292ed7ada96f96295eab1e589c52e4e66bf4aedda715fdd - 49dca65f362fee401292ed7ada96f96295eab1e589c52e4e66bf4aedda715fdd

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786348609&P2=404&P3=2&P4=SzMulCxeTF96L2R3okDtzbiIyY7EF7YlpuP%2btuUU%2beXtpobLmgbDwhLcYx4aZDI0kYYJx9SSFux9473TQxs0eA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786348687&P2=404&P3=2&P4=KtARxz2KwV3mx9Ht%2fhu9uy8qHYkS%2fHrvf7LpCPstawJF7GC1EkQeMK%2fi9tNh1Z3cMoN8E4B92V5ZmnHis9Vp1Q%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

elegan_786444.el.funpic.org
griptoloji.host-ed.net
ftp.tripod.com

Embedded IP addresses

4.150.223.109
48.211.4.16
4.230.171.124
52.230.59.222
74.178.240.61
4.150.223.102
135.232.92.97
172.178.240.163
13.69.116.105
135.234.160.246
92.223.78.30
203.26.79.13
135.233.95.80
209.202.252.54
52.148.114.188
72.145.35.113
52.110.12.55
52.110.12.38

More Ganelp samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report