MALICIOUS — a99718dfa245208107712a849126d19d6811afc5f3a3cb1e36d040600089fe84

MALICIOUS — a99718dfa245208107712a849126d19d6811afc5f3a3cb1e36d040600089fe84 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Ganelp family. 6 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: a99718dfa245208107712a849126d19d6811afc5f3a3cb1e36d040600089fe84
SHA-1: 3604b6a196cabc31b72089821c2f1642b0dddecb
MD5: 4da7d65b7e7dd8add05799e050d56c14
imphash: 43df92b7b77db2760430968647afb835
ssdeep: 3072:4mfQgicdlGvILcU9KQ2BBAkJaPxsIolkbnq:4kicdlG5WKQ2BjGxs
TLSH: T113466BD9B105A71EFE730BD784B26E2DA40260FC14A40D40AEC7CD689B31C9FA4D65E6
Submitted as: a99718dfa245208107712a849126d19d6811afc5f3a3cb1e36d040600089fe84
File type: pe · Size: 299062 bytes
Verdict: malicious (100/100) · Family: Ganelp

Detections (6 of 56 engines)

ClamAV (daily): Win.Worm.Ganelp-9941285-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Worm:Win32/Ganelp!pz
Emsisoft (Emergency Kit): Trojan.Generic.7604330
Trellix Stinger (McAfee): W32/Autorun.worm.aacd
Kaspersky (KVRT): Worm.Win32.Juched.fkf

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Worm.Ganelp-9941285-0 (rule Win.Worm.Ganelp-9941285-0) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s) across 2 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.63, confidence 0.90
Microsoft Defender flagged Worm:Win32/Ganelp!pz (rule Worm:Win32/Ganelp!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Generic.7604330 (rule Trojan.Generic.7604330) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged W32/Autorun.worm.aacd (rule W32/Autorun.worm.aacd) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Worm.Win32.Juched.fkf (rule Worm.Win32.Juched.fkf) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 1 external host(s) and 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

49844 behavior events · 3 ATT&CK techniques · 4 dropped files.

Dropped files

C:\Program Files (x86)\800e9cf7\jusched.exe - e8a1c1dfa19860475964035b7281fb071fa3ab6f91d5e90ceedec7d265082871
C:\Program Files (x86)\800e9cf7\800e9cf7 - 3ef9ff5da8272fd1b14c83f12c8d28fd9dbf32d56bcb714921032b02557fe789
C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\d42cc0c3858a58db2db37658219e6400_0e5a7577-049a-462a-abab-794868e0c8ff - c44734a4d0cd70e71c2e9fa334fcb0f9f54c8c741c77e59a832bac17eb6171b8
C:\Windows\Tasks\Update23.job - ad882aee3f5cbd701e55854da81045d591dc6a3a07e56931341ee215fda4c6a3

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

ftp.byethost12.com
griptoloji.host-ed.net
ftp.tripod.com

Embedded IP addresses

20.247.185.124
4.150.223.112
52.123.252.227
4.230.171.124
52.230.60.54
172.64.154.167
185.27.134.11
172.178.240.162
57.154.63.210
48.211.4.16
72.154.7.17
52.148.114.188
52.110.12.15
52.110.12.4

More Ganelp samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report