MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8e2adc00e2bd5105b237f4aee989bce7bbe465c00fb835c2b82440ebe82dde3b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 11


Intelligence 11 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8e2adc00e2bd5105b237f4aee989bce7bbe465c00fb835c2b82440ebe82dde3b
SHA3-384 hash: 6866dbfc16ca8d1adc9e857ee15dbaf15288731052b6019e84edda79539021cafeac29e21e7e0ece5c01c50444a5e58f
SHA1 hash: 03c6d760d20eed30157b5a68cc15229101618702
MD5 hash: 13b6ed8c79f9a878e6d77ec51d4a71a3
humanhash: kitten-two-robert-blossom
File name:Ganja121.exe
Download: download sample
File size:30'720 bytes
First seen:2025-06-14 14:05:54 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 5d93c980cc5e5613f5a385e38f0e819e (1 x IRCbot)
ssdeep 768:7CHmSn9KjJWuLocza1U/HLUwmLPO9fcTnn8C:eH2Wu8hCUrLPO9sn8C
TLSH T194D2180D59816877D86208307B012F779FEFEDB32358A81FDF4105082AB979AD5B929F
TrID 43.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
22.9% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
9.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.0% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.2% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
401
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Ganja121.exe
Verdict:
Malicious activity
Analysis date:
2025-06-14 14:22:57 UTC
Tags:
auto-reg
Link:
https://app.any.run/tasks/d06af2a7-1a62-40ba-bcc7-9c20ca52e117

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/9460/
Detection(s):
Win.Ircbot.Ircbot-7650649-0
Create hunting rule

Win.Worm.Ircbot-3117
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=684d81f707b5e8c1cfe6c9a1
Tags:
backdoor dropper emotet ircbot
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Creating a process from a recently created file
Creating a process with a hidden window
Searching for the window
DNS request
Creating a file in the %temp% directory
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Creating a file in the mass storage device
Enabling threat expansion on mass storage devices
Verdict:
Malicious
Labled as:
Backdoor.IRCBot
Link:
https://www.hybrid-analysis.com/sample/8e2adc00e2bd5105b237f4aee989bce7bbe465c00fb835c2b82440ebe82dde3b
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8eb45ae3-276c-449d-941a-2d9e2e6449fb
Result
Threat name:
n/a
Detection:
malicious
Classification:
troj.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/1714484
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Contains functionality to inject threads in other processes
Contains VNC / remote desktop functionality (version string found)
Found evasive API chain (may stop execution after checking mutex)
Modifies the windows firewall
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Opens the same file many times (likely Sandbox evasion)
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/8e2adc00e2bd5105b237f4aee989bce7bbe465c00fb835c2b82440ebe82dde3b
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8e2adc00e2bd5105b237f4aee989bce7bbe465c00fb835c2b82440ebe82dde3b/
Threat name:
Win32.Malware.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2016-11-29 18:04:00 UTC
File Type:
PE (Exe)
AV detection:
30 of 36 (83.33%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ryvnyahcxviqlmrx6sxotcn44656izoab64dlqvyeraox2bn3y5q._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
defense_evasion discovery persistence
Link:
https://tria.ge/reports/250614-reqaqszwez/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Adds Run key to start application
Executes dropped EXE
Modifies firewall policy service
Verdict:
Malicious
Tags:
Win.Ircbot.Ircbot-7650649-0
YARA:
n/a
Link:
https://app.threat.zone/submission/b4a66837-c47b-4ba4-b567-5e4c1fe69e6b
Unpacked files
SH256 hash:
8e2adc00e2bd5105b237f4aee989bce7bbe465c00fb835c2b82440ebe82dde3b
MD5 hash:
13b6ed8c79f9a878e6d77ec51d4a71a3
SHA1 hash:
03c6d760d20eed30157b5a68cc15229101618702
Link:
https://www.unpac.me/results/b8a7a936-ee14-443d-95ac-7ff5435c2560/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8e2adc00e2bd5105b237f4aee989bce7bbe465c00fb835c2b82440ebe82dde3b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Cerberus
Create hunting rule
Author:Jean-Philippe Teissier / @Jipe_
Description:Cerberus
Rule name:SUSP_ENV_Folder_Root_File_Jan23_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects suspicious file path pointing to the root of a folder easily accessible via environment variables
Reference:Internal Research
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 8e2adc00e2bd5105b237f4aee989bce7bbe465c00fb835c2b82440ebe82dde3b

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3561935/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3561939/
  
URLhaus
https://urlhaus.abuse.ch/url/3561943/
  
URLhaus
https://urlhaus.abuse.ch/url/3561980/
Cape
Cape
https://www.capesandbox.com/analysis/9460/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
COM_BASE_APICan Download & Execute componentsole32.dll::CoCreateInstance
SHELL_APIManipulates System ShellSHELL32.dll::ShellExecuteA
URL_MONIKERS_APICan Download & Execute componentsurlmon.dll::URLDownloadToFileA
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CreateRemoteThread
KERNEL32.dll::CreateProcessA
KERNEL32.dll::OpenProcess
KERNEL32.dll::VirtualAllocEx
KERNEL32.dll::WriteProcessMemory
KERNEL32.dll::CloseHandle
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::GetDriveTypeA
KERNEL32.dll::GetStartupInfoA
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CopyFileA
KERNEL32.dll::CreateDirectoryA
KERNEL32.dll::CreateFileA
KERNEL32.dll::DeleteFileA
KERNEL32.dll::GetWindowsDirectoryA
KERNEL32.dll::GetFileAttributesA
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegCreateKeyExA
ADVAPI32.dll::RegOpenKeyExA
ADVAPI32.dll::RegQueryValueExA
ADVAPI32.dll::RegSetValueExA
WIN_USER_APIPerforms GUI ActionsUSER32.dll::BlockInput
USER32.dll::EmptyClipboard
USER32.dll::FindWindowA
USER32.dll::OpenClipboard

Comments