MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e4784520b1722382c5167856165a57d837b7f877bb8475f441cb3e40b98706c8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Ganelp


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e4784520b1722382c5167856165a57d837b7f877bb8475f441cb3e40b98706c8
SHA3-384 hash: 1ef926b13f837ee96eef1113c767a31fa6f35c7b6bd349d024d6a008275cb8c1226d0340a055d2da221305479041c977
SHA1 hash: 72941d5e1708f74cbc49efb2e00b2a4ce91c75c5
MD5 hash: b1a03bc1424c030698f5bc6c7bc46788
humanhash: nine-emma-pluto-alpha
File name:e4784520b1722382c5167856165a57d837b7f877bb8475f441cb3e40b98706c8
Download: download sample
Signature Ganelp
Create hunting rule
File size:198'034 bytes
First seen:2020-06-03 09:39:25 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash faea664dccb12d653cbea3ef51eb7d97 (1 x Ganelp)
ssdeep 1536:yvVQb4cLIkN+4Weat2RKLjWlC48Pp9JAcjrSrowuiIq:yvVQLIkLWeaA8KlCph9GrowuiIq
Threatray 21 similar samples on MalwareBazaar
TLSH F4145B20E301C0AEE4E142BDD6EA8B77B9391F305B5890E7C7E4754E17B92E6B93054B
Reporter raashidbhatt
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Worm.Ganelp-6776766-0
Create hunting rule

Win.Worm.Lolbot-6787741-0
Create hunting rule

Win.Trojan.Agent-365515
Create hunting rule

Gathering data
Threat name:
Win32.Worm.Ganelp
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 11:08:41 UTC
AV detection:
31 of 31 (100.00%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
0310713073d73da7a45ff957b3fdba84d8d6da70a91a8404c66561007d505d08
Ganelp
03ca4226a0ffde63bd99d756625c24269cf2f6f19ed5d701a5f4f0c6b1fd4ce9
Ganelp
09e28b22c749808d439f6a3d4948aad24bf8b1034bf1041c7cd2b8cdb5dd7be3
Ganelp
55955f17d34267da959cd050b9f399df33c7ef7da0cbce05a74e98d90c2d2b3e
Ganelp
5c826e35fe48ce5410e9c553242a83e71b2408a57d3256bcd0bd4334412010b0
Ganelp
7c58672f646a85dd65ae2c5d44fdcfb899584a9a27650418a06ecc495cdf7a86
Ganelp
94581916a6f0f8c4c0e9238fb1ec9ee8f44035e750f7a41115e68ebe526e6ee4
Ganelp
9c5b8535e2ac554768c5cfc3d655a3aed7647fe2280e66161a516296eb5a5918
Ganelp
ddc24f2e6ce31f41e8f9195c2612384abad5baf2797cd3a99f8e48de0430f184
Ganelp
fd512bcb35f6f9b41f33ec961e46e3b80a774d8038a03abb1b693064a84f8f1a
Ganelp
+ 11 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
persistence
Link:
https://tria.ge/reports/201109-n19paa14tj/
Behaviour
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Drops file in Windows directory
Adds Run key to start application
Loads dropped DLL
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments