MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ddc24f2e6ce31f41e8f9195c2612384abad5baf2797cd3a99f8e48de0430f184. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Ganelp


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ddc24f2e6ce31f41e8f9195c2612384abad5baf2797cd3a99f8e48de0430f184
SHA3-384 hash: 020711ea0b0902c4ed09e27813d69e8ee2751021d2b9c58534edb8a2962753349b7311dcad5a154287e49d80af42f3b2
SHA1 hash: 929d88654ac5c966a6ef23f4c9358b1fced2c4f1
MD5 hash: 01b426c7da2feb3a2169cd9b1638e0dd
humanhash: pip-batman-hamper-single
File name:ddc24f2e6ce31f41e8f9195c2612384abad5baf2797cd3a99f8e48de0430f184
Download: download sample
Signature Ganelp
Create hunting rule
File size:225'842 bytes
First seen:2020-06-03 09:39:11 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 43df92b7b77db2760430968647afb835 (2 x Ganelp)
ssdeep 3072:jChJgYMm4xf9cU9KQ2BxA59SPMSOoLn2P:vYMm4xiWKQ2BiCMn
Threatray 29 similar samples on MalwareBazaar
TLSH 55245A21E351C02AE8D040FED6EB8B76A56D5E301F9C60E387D07AAD277A5E5BD3044B
Reporter raashidbhatt
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Worm.Ganelp-6776766-0
Create hunting rule

Win.Worm.Lolbot-6787741-0
Create hunting rule

Win.Worm.Autorun-6953
Create hunting rule

Gathering data
Threat name:
Win32.Worm.Ganelp
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 11:02:00 UTC
AV detection:
30 of 31 (96.77%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
09e28b22c749808d439f6a3d4948aad24bf8b1034bf1041c7cd2b8cdb5dd7be3
Ganelp
14d333f6817a40cc66251901b630df311dc518be513f3be9e4fc308ab7ff562d
Ganelp
32ef6a3c172b8ab59ed668b0fbad8c05dda82428fb2d1ec8e47d9e6db076043f
Ganelp
7c58672f646a85dd65ae2c5d44fdcfb899584a9a27650418a06ecc495cdf7a86
Ganelp
b2b14296a263cab9869cfec8790777f06580f2677344bdc1fdca40e06b8ff899
Ganelp
b40c8fcb20acf66db418078f0d6099145b220dc056d095beb54665faf6c726c7
Ganelp
e4784520b1722382c5167856165a57d837b7f877bb8475f441cb3e40b98706c8
Ganelp
e62889be5bf912d37044d83aab08dfa85c7863ec9baeac93e0397e03a407f95a
Ganelp
e86a18deaabae18d09ad1e5a7e3f46f9f08e13ee41f7a06f674bca2ad3f98154
Ganelp
f2db78e5165646f19a5b9438764740b24ab4c578890cd68e292cedaed3f7ca84
Ganelp
+ 19 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
persistence
Link:
https://tria.ge/reports/201109-8dwrkccxyx/
Behaviour
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Drops file in Windows directory
Adds Run key to start application
Loads dropped DLL
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments