MALICIOUS — virussign.com_f24ca421cb192605d559a1bc7fc50dc0.vir
MALICIOUS — virussign.com_f24ca421cb192605d559a1bc7fc50dc0.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Ganelp family. 7 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
6a035c0d3769a3ee126a13fceb2ed86e9eda296ef0c4d4d2c1e634b10581889e - SHA-1:
654ff6145a2cecd4b473fc9c195e9a1133cf72e3 - MD5:
f24ca421cb192605d559a1bc7fc50dc0 - imphash:
cdf5bbb8693f29ef22aef04d2a161dd7 - ssdeep:
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND+3T4+mzv7oEzNmNMvT9Np:ymb3NkkiQ3mdBjF+3TYzvT/p - TLSH:
T1C33AF194682BA4D8C835F0EF8E62882C3126CE25BD55C3C96D916905DFFC2EB06C70E0 - Submitted as: virussign.com_f24ca421cb192605d559a1bc7fc50dc0.vir
- File type: pe · Size: 95758 bytes
- Verdict: malicious (98/100) · Family: Ganelp
Source: VirusSign · first seen 2026-08-18T00:00:00.000Z · SHA-256 verified
Detections (7 of 55 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:
- ClamAV (daily): Win.Malware.Midie-9242512-0
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- Detect It Easy (packer/type): DIE:Petite
- Microsoft Defender: Worm:Win32/Ganelp
- Trellix Stinger (McAfee): Trojan-FPCQ!B272ED41D1EA
- Kaspersky (KVRT): HEUR:Backdoor.Win32.Tiny.gen
MITRE ATT&CK
Why this verdict
The malicious score of 98/100 is the fusion of 7 weighted signals:
- ClamAV (daily) flagged Win.Malware.Midie-9242512-0 (rule
Win.Malware.Midie-9242512-0) - engine signal, weight 0.90, confidence 0.95 - Memory forensics: 2 finding(s), e.g. SSDT hook (rule
windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85 - Contacted 28 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
- YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70 - Detect It Easy (packer/type) flagged DIE:Petite (rule
DIE:Petite) - engine signal, weight 0.35, confidence 0.70 - Packing/obfuscation: high-entropy-sections:, Petite - static signal, weight 0.25, confidence 0.55
- Dropped 23 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Dynamic analysis (windows)
1046 behavior events · 0 ATT&CK techniques · 26 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- ctldl.windowsupdate.com
- login.live.com
- desktop-hsgcbep
- ocsp.digicert.com
- v20.events.data.microsoft.com
- config.edge.skype.com
- licensing.mp.microsoft.com
- windows.msn.com
- oneocsp.microsoft.com
- www.msn.com
Dropped files
- C:\rbntdd.exe -
54d86dd13f462d698f00551d6996478adba8798632aaed7f226a315ca9b8365e - C:\bflvdtl.exe -
9b43ee8c0d58c24efa9f8d5b872b9bf25de676730aa83e16e99f873eee86ad24 - C:\ftntp.exe -
d4c199b22645dc57fda6f2d991698e5891d1259a78468766a9705507a0e8e048 - C:\trvnjvb.exe -
8298147b47490676b341853e30d0c149b872cb70aa81aa3edaba872c44ca1825 - C:\lxtfnj.exe -
22747c8e83f4989e29b2ad6cae96183fc84a4353e416d0baa9f1b0ed302ad8c3 - C:\ttlhhnn.exe -
eb047078c2a531e5f47a027a1d32c539f3e1b8d705dbd7e4ef709a6e8d0c03d9 - C:\txfjxh.exe -
40856fc86e0792eb1ab6ae5d1a1f88b27c3653e2621736c251ae5354902ca09e - C:\hbtvlht.exe -
19fa65f77b410b85314a0e50f64e7b7e87944a4780323a7187a19f69ff44c5ab - C:\hxndthv.exe -
5423715e6db3caf84065057b293a1d1635459882bdefb6d640589d971e09f2a2 - C:\vppfvlx.exe -
8b5480cb932f9fff3d118ec15f86e59e2ed70e73b97320e35cc26b6e5ecf0505 - C:\xppdrdl.exe -
7faf44a0375ddee44c2d36f7e87913086af9f23c0bd3d2bfe1a0d51b7abb0133 - C:\tjjdxx.exe -
5220144ea0181b7c2ca1c5d85441840b9b5732072d9073088fbe0e50e3b3d93f - C:\hdnvjfn.exe -
0e5e4ad9dfc3f2285db58ed79fd995d95b6edaae565c3b75c17178b4ca407e5a - C:\vrrpb.exe -
0f9574b8d51a9e4d891d985ec6836e093d2ca4d858023d9170325c01eb9e5e06 - C:\ltfnhpx.exe -
6cc6b8ecbadfb950e33031d37876b63a3ccb369f74ba715c4c68818c9f78edee
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787731832&P2=404&P3=2&P4=YdVjLoP7lHWXEG53fZTSnbCTiMWj2sFwjEe0yxxv%2bI9qrIA%2bBhHgsWQkfSi5CzDvHMvX0k97u7ubTzn1IuaJQA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
Embedded IP addresses
- 20.50.201.200
- 52.123.252.218
- 20.247.185.124
- 4.247.188.224
- 4.230.171.124
- 20.165.94.63
- 74.179.77.164
- 4.150.223.104
- 74.178.240.61
- 20.112.250.133
- 52.123.129.14
- 52.123.128.14
- 92.223.78.30
- 52.123.252.224
- 172.178.240.163
- 203.26.79.13
- 52.148.114.188
- 52.110.12.53
- 52.110.12.42
- 52.123.252.225
- 135.232.92.34
- 72.153.5.140
- 85.210.196.11
- 4.150.223.111
- 4.150.223.113
More Ganelp samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report