🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1c182b64b72ed82a9dcef2a13bc5f5fe43c9efcb3a405ded83a20eb5c87c695b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LegionLoader


Vendor detections: 11


Intelligence 11 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1c182b64b72ed82a9dcef2a13bc5f5fe43c9efcb3a405ded83a20eb5c87c695b
SHA3-384 hash: a6ebc97d12e7248a830edfd52bff8346b5f783ff426af7aeb9137c9b18930d87890673de4cfe3d06610f00d28e18195a
SHA1 hash: e4993c650f18a645bcb519aa2a6a53109e370772
MD5 hash: fa5216fbb7880cdb7719919ab3a36b9d
humanhash: cardinal-william-indigo-burger
File name:obs.dll
Download: download sample
Signature LegionLoader
Create hunting rule
File size:3'160'064 bytes
First seen:2025-01-31 16:14:14 UTC
Last seen:2025-01-31 16:19:39 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 13bbfcd3497d99c229c0a4e50e811ae0 (1 x LegionLoader)
ssdeep 49152:+qCwG5Ex2LS7PRlXYSiD96GyvUqf3KS1hZKkixr4bjTUT0VhlS88x63:+qCwG5qyMP2wd/jxKjgjHrS23
TLSH T175E52387D241D735C47A7930E8D17BCF286D3A41DED48B68EF38480B661B6AD40A67CB
TrID 44.4% (.EXE) Win64 Executable (generic) (10522/11/4)
21.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.7% (.ICL) Windows Icons Library (generic) (2059/9)
8.5% (.EXE) OS/2 Executable (generic) (2029/13)
8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter PHP
Tags:dll exe LegioDropper LegionLoader unpacked

Intelligence

File Origin
# of uploads :
3
# of downloads :
507
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
setup.msi
Verdict:
Malicious activity
Analysis date:
2025-01-31 16:03:43 UTC
Tags:
generated-doc
Link:
https://app.any.run/tasks/081b1831-001a-40c3-a9f4-46b96a63165f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Win64.Evo-gen.28443.12385.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=679cf8426d96a8d7e4ce420c
Tags:
virus crypt hype
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Launching a process
DNS request
Launching the default Windows debugger (dwwin.exe)
Connection attempt
Sending an HTTP GET request
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
masquerade packed packed packer_detected
Link:
https://www.filescan.io/uploads/679cf7094587880099bab1b4/reports/89ee96f5-6f1d-4463-94cc-9b92577d093c/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/1c182b64b72ed82a9dcef2a13bc5f5fe43c9efcb3a405ded83a20eb5c87c695b
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/b4ddc0da-c7b0-430a-896b-0d922c4d1d7c
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1603944
Signature
Contains functionality to inject code into remote processes
Found direct / indirect Syscall (likely to bypass EDR)
Hides threads from debuggers
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Joe Sandbox ML detected suspicious sample
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
PE file contains section with special chars
Sigma detected: RunDLL32 Spawning Explorer
System process connects to network (likely due to code injection or exploit)
Tries to detect debuggers (CloseHandle check)
Tries to evade analysis by execution special instruction (VM detection)
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1603944 Sample: obs.dll.exe Startdate: 31/01/2025 Architecture: WINDOWS Score: 100 41 emarketstats.com 2->41 45 Multi AV Scanner detection for submitted file 2->45 47 Machine Learning detection for sample 2->47 49 PE file contains section with special chars 2->49 51 2 other signatures 2->51 9 loaddll64.exe 1 2->9         started        signatures3 process4 signatures5 53 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 9->53 55 Injects code into the Windows Explorer (explorer.exe) 9->55 57 Contains functionality to inject code into remote processes 9->57 59 6 other signatures 9->59 12 rundll32.exe 9->12         started        15 cmd.exe 1 9->15         started        17 rundll32.exe 9->17         started        19 4 other processes 9->19 process6 signatures7 69 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 12->69 71 Injects code into the Windows Explorer (explorer.exe) 12->71 73 Writes to foreign memory regions 12->73 21 explorer.exe 12->21         started        24 WerFault.exe 3 16 12->24         started        26 rundll32.exe 15->26         started        75 Tries to detect debuggers (CloseHandle check) 17->75 77 Hides threads from debuggers 17->77 79 Injects a PE file into a foreign processes 17->79 29 WerFault.exe 16 17->29         started        31 explorer.exe 17->31         started        81 System process connects to network (likely due to code injection or exploit) 19->81 33 explorer.exe 19->33         started        35 WerFault.exe 19->35         started        process8 dnsIp9 43 emarketstats.com 169.150.247.38, 49712, 49713, 49717 SPIRITTEL-ASUS United States 21->43 61 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 26->61 63 Injects code into the Windows Explorer (explorer.exe) 26->63 65 Writes to foreign memory regions 26->65 67 3 other signatures 26->67 37 WerFault.exe 20 16 26->37         started        39 explorer.exe 26->39         started        signatures10 process11
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/1c182b64b72ed82a9dcef2a13bc5f5fe43c9efcb3a405ded83a20eb5c87c695b
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1c182b64b72ed82a9dcef2a13bc5f5fe43c9efcb3a405ded83a20eb5c87c695b/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dqmcwzfxf3mcvhoo6kqtxrpv7zb4t36lhjaf33mduihllsd4nfnq._file
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/250131-tp7zmszrbv/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of NtSetInformationThreadHideFromDebugger
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/820328f1-a9f5-4d18-9776-4e61ef268fd0
Unpacked files
SH256 hash:
1c182b64b72ed82a9dcef2a13bc5f5fe43c9efcb3a405ded83a20eb5c87c695b
MD5 hash:
fa5216fbb7880cdb7719919ab3a36b9d
SHA1 hash:
e4993c650f18a645bcb519aa2a6a53109e370772
Link:
https://www.unpac.me/results/965a70d2-4f88-4edf-89a5-a07e185e674d/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/1c182b64b72e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1c182b64b72ed82a9dcef2a13bc5f5fe43c9efcb3a405ded83a20eb5c87c695b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ldpreload
Create hunting rule
Author:xorseed
Reference:https://stuff.rop.io/
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

LegionLoader

Microsoft Software Installer (MSI) msi 3f84979ca8de7378a2f963ebb84923d631d36db6eaefa88365081da9d71586e8

LegionLoader

Executable exe 1c182b64b72ed82a9dcef2a13bc5f5fe43c9efcb3a405ded83a20eb5c87c695b

(this sample)

  
Dropped by
SHA256 3f84979ca8de7378a2f963ebb84923d631d36db6eaefa88365081da9d71586e8
  
Dropped by
MD5 fa363bd82c394fdfe37c5ff5efdd257d

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high
Reviews
IDCapabilitiesEvidence
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegSetValueExW

Comments