MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 09e28b22c749808d439f6a3d4948aad24bf8b1034bf1041c7cd2b8cdb5dd7be3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Ganelp


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 09e28b22c749808d439f6a3d4948aad24bf8b1034bf1041c7cd2b8cdb5dd7be3
SHA3-384 hash: 688175fd026ae803171f48b799692bf7c546f2280f344db9258732330f78fb7b90ed39071cd13534c5989f97ede654ba
SHA1 hash: 832e08c5ce216e9e2150e7a054f0b184cfeccc0c
MD5 hash: 728f81e7e996ce4446aa8333ae1b2530
humanhash: september-west-oklahoma-comet
File name:09e28b22c749808d439f6a3d4948aad24bf8b1034bf1041c7cd2b8cdb5dd7be3
Download: download sample
Signature Ganelp
Create hunting rule
File size:305'878 bytes
First seen:2020-06-03 09:40:04 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash cf6478dd315d96e90d4e24bcf02940d3 (1 x Ganelp)
ssdeep 3072:5BlvaWjzrLXQQJKgmSBAVpet2Ago4lWXt:DpaWjz/gGKgmS+k29Wd
Threatray 26 similar samples on MalwareBazaar
TLSH A5546C21E251C02AE4D080FED69B4B76A06D0F301B9C60E7C7E17AAD277A1F6BE35447
Reporter raashidbhatt
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Worm.Ganelp-6776766-0
Create hunting rule

Win.Worm.Lolbot-6787741-0
Create hunting rule

Win.Worm.Autorun-8572
Create hunting rule

Gathering data
Threat name:
Win32.Worm.Ganelp
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 11:08:38 UTC
AV detection:
30 of 31 (96.77%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
02fcb6cdd4b61cbf7f40448784a36d0067e618cac935aebf6fd6f482af076ba3
Ganelp
1c989f633edcaea6e97a4a96f8a1f9ed19d54ed109cfaf1053a67dc48d28fd52
Ganelp
262df2047b1eb08b3e58a1edc2823e38563c42d74027a7ecfa2a6a8c7f1f1541
Ganelp
75c275e5cf07f4932978afa90c68dbd7a4fe9b12e6002e3e933f99156b137181
Ganelp
75da456980b6c16a80a05269d6fee93bc18a242ebe0c7f9f014bad8828b09291
Ganelp
84742df4cd63ab373d601a9f4900b1b55f41ea5f48d93eaebb68b9fd4bf8235a
Ganelp
9dfba413d306830589105d96b90b5ea870b1975bd371350635ea1c2b591bcbd8
Ganelp
b2169a0b14394b89cad7d3d4092b1a3e940c4504f9e7d982ebbcfd0b8c603530
Ganelp
ddc24f2e6ce31f41e8f9195c2612384abad5baf2797cd3a99f8e48de0430f184
Ganelp
e16f2a118c2150aaa6ac8c5587737557e6abc4ba57023a78644634eac9fbf696
Ganelp
+ 16 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
persistence
Link:
https://tria.ge/reports/201109-g2w3cszlne/
Behaviour
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Drops file in Windows directory
Adds Run key to start application
Loads dropped DLL
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments