MALICIOUS — 8f9ed23f7a00d9acf796e657d36232cf098ccbb2488415cbb43ce1835e0ac7f5

MALICIOUS — 8f9ed23f7a00d9acf796e657d36232cf098ccbb2488415cbb43ce1835e0ac7f5 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Ganelp family. 3 of 25 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 8f9ed23f7a00d9acf796e657d36232cf098ccbb2488415cbb43ce1835e0ac7f5
SHA-1: 37e15919cbac4284bdf04c3df993b15d4ebd750f
MD5: be53e7bd0aaad9b30bbd0ec7b3710f65
imphash: fe9b94dd0e4ea2a905fbd4f42f4b2f8f
ssdeep: 768:6zQYScGrIubHuYtv0xwYHw5FAe2Q7ncwx8Nwv92Vf9B:8QTIubHR5wQ7A1
TLSH: T106314CC1262B2045ECA7E37B0C516D2CD02A8CF49EB798DC445A523CAD61B2763B7877
Submitted as: 8f9ed23f7a00d9acf796e657d36232cf098ccbb2488415cbb43ce1835e0ac7f5
File type: pe · Size: 42017 bytes
Verdict: malicious (99/100) · Family: Ganelp

Detections (3 of 25 engines)

Microsoft Defender: Worm:Win32/Ganelp!atmnm
Emsisoft (Emergency Kit): Trojan.Agent.EY
Kaspersky (KVRT): HEUR:Worm.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 8 weighted signals:

Dropped a malicious payload (Ganelp): 831c10fa1a3549fb828193ca7959e091ad7f848cb06ae0b016cea4c6dcbaaff7 - dynamic signal, weight 0.80, confidence 0.90
Microsoft Defender flagged Worm:Win32/Ganelp!atmnm (rule Worm:Win32/Ganelp!atmnm) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Agent.EY (rule Trojan.Agent.EY) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 30 external host(s) at runtime (13 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

22676 behavior events · 2 ATT&CK techniques · 2 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/8599/files/49dca65f362fee401292ed7ada96f96295eab1e589c52e4e66bf4aedda715fdd - 49dca65f362fee401292ed7ada96f96295eab1e589c52e4e66bf4aedda715fdd
/opt/CAPEv2/storage/analyses/8599/files/831c10fa1a3549fb828193ca7959e091ad7f848cb06ae0b016cea4c6dcbaaff7 - 831c10fa1a3549fb828193ca7959e091ad7f848cb06ae0b016cea4c6dcbaaff7

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786349173&P2=404&P3=2&P4=CNmsE6ZxthqNQ6MC%2b01CsZRCDZrc1ZpIsp0ykSi0cx6%2bfGhhdcHzIodKu45At%2fX4YUqCvYZQK2T9u5yO6%2fZzZw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786349258&P2=404&P3=2&P4=XmL3OoyseVWcdKLWtSUxMYwOijzb1k%2bUCmp3GK1qMjn5hcm6f8gDmjL7yd0XEqbSM5pp5cg%2fEGPWFNE1aV2Qbw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

elegan_786444.el.funpic.org
griptoloji.host-ed.net
ftp.tripod.com

Embedded IP addresses

4.150.223.111
52.230.60.54
4.230.171.124
40.84.97.4
74.178.76.128
40.79.197.34
172.178.240.161
135.233.95.135
13.89.179.12
203.26.79.13
74.178.232.29
135.233.45.222
209.202.252.54
72.145.35.104
92.223.78.30
52.148.114.188
52.110.12.14
52.110.12.20

More Ganelp samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report