MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 32e3b1b765b96992790ff890e6035bd3e40b0ac5362e0f014e4159137dbba517. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LgoogLoader


Vendor detections: 13


Intelligence 13 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 32e3b1b765b96992790ff890e6035bd3e40b0ac5362e0f014e4159137dbba517
SHA3-384 hash: a539d4d1817d6be0287d2c27ec2793dc131446000333556bdb4e98b844cbd1509a94df8676c83eb5234ee556b214e8f2
SHA1 hash: eb1eb05667b957a7828edaf48893afbbc8742d53
MD5 hash: 55446ec57374792e5a822c5d58a69e19
humanhash: virginia-kitten-early-delaware
File name:file
Download: download sample
Signature LgoogLoader
Create hunting rule
File size:494'952 bytes
First seen:2023-05-26 23:17:33 UTC
Last seen:2023-05-27 10:12:21 UTC
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 6144:SswGbzdJ0dxMaXylEiR8V28PvXVmRzWr2gJzpuR2oYg01c0/HxZXFuzpBKgEfHR:Se304dFRsJuzWrNJziYg0LFuzw
Threatray 1'452 similar samples on MalwareBazaar
TLSH T1B0B4CD265225710DF05D6231A36770260A23BDB19DD2F6B877D88C2E3A0BD1F9EC1BD9
TrID 44.4% (.EXE) Win64 Executable (generic) (10523/12/4)
21.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.7% (.ICL) Windows Icons Library (generic) (2059/9)
8.5% (.EXE) OS/2 Executable (generic) (2029/13)
8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Reporter andretavare5
Tags:exe LgoogLoader signed

Code Signing Certificate

Organisation:cnet inc
Issuer:cnet inc
Algorithm:sha256WithRSAEncryption
Valid from:2023-05-25T18:26:49Z
Valid to:2024-05-25T18:26:49Z
Serial number: 6b08b29c5b4a9218920eeb0b3cda2d10
Thumbprint Algorithm:SHA256
Thumbprint: f7bedb9c00feefa9c00125799c3fb25d948f31ce2202cfdea28e50b963542014
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


Avatar
andretavare5
Sample downloaded from http://85.217.144.228/files/123.exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
248
Origin country :
US US
Vendor Threat Intelligence
Malware family:
vidar
Create hunting rule
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2023-05-26 23:19:39 UTC
Tags:
opendir loader gcleaner stealer vidar trojan arkei rat redline smoke evasion
Link:
https://app.any.run/tasks/8aef9ea3-2d61-41fc-b049-258e5e295f3e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/392295/
Detection(s):
SecuriteInfo.com.Variant.Cerbu.178376.7709.21317.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %temp% directory
Creating a service
Loading a system driver
Launching a process
Creating a file
Enabling autorun for a service
Forced shutdown of a system process
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
overlay packed
Link:
https://www.filescan.io/uploads/64713e2acee6f44e1589e1df/reports/410a4de8-cdfd-4b24-86fa-d6b5e8045d2a/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/32e3b1b765b96992790ff890e6035bd3e40b0ac5362e0f014e4159137dbba517
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/ad527e23-9f23-4436-aed9-b60ec7fc8212
Result
Threat name:
n/a
Detection:
malicious
Classification:
expl.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/1243537
Signature
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sample is not signed and drops a device driver
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AntiVM3
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 876546 Sample: file.exe Startdate: 27/05/2023 Architecture: WINDOWS Score: 84 22 Malicious sample detected (through community Yara rule) 2->22 24 Multi AV Scanner detection for submitted file 2->24 26 Yara detected UAC Bypass using CMSTP 2->26 28 3 other signatures 2->28 6 file.exe 4 4 2->6         started        process3 file4 18 C:\Users\user\AppData\Local\Temp\?????.sys, PE32+ 6->18 dropped 20 C:\Users\user\AppData\Local\...\file.exe.log, CSV 6->20 dropped 30 Sample is not signed and drops a device driver 6->30 10 csc.exe 6->10         started        12 vbc.exe 6->12         started        14 jsc.exe 6->14         started        16 28 other processes 6->16 signatures5 process6
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/32e3b1b765b96992790ff890e6035bd3e40b0ac5362e0f014e4159137dbba517/
Threat name:
Win64.Trojan.Privateloader
Create hunting rule
Status:
Malicious
First seen:
2023-05-25 21:32:25 UTC
File Type:
PE+ (.Net Exe)
Extracted files:
3
AV detection:
20 of 37 (54.05%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=glr3dn3fxfuze6ip7cioma232psawcwfgyxa6akoifmrg7n3uulq._file
Verdict:
malicious
Similar samples:
18865070f9e9f47ac6f423496d02c85ef8f6d32ef045f838c427f8b2bd4a4fb7
LgoogLoader
41955ff332c22ffa3c2014f4bdffc2db6b5ae75d8289df443929a507dca525cd
LgoogLoader
4fe523babbfae3a14393d7b07afbbfc13be4f5084dba9588adb38913b3527c36
LgoogLoader
66bdde9f427859cc6b7cc1ff67bdf9d93ff8b0d7bc226185cb2195c746e28a0a
LgoogLoader
67ffb10d7ef8cc9b49ef3ad7affcd7f865391cac2cdbad7ae1d259ec6a4a0cb8
LgoogLoader
bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268
LgoogLoader
bbea7541f726c2ecb8eebbc87f6f52b50db57a836571ae9b0f1fd91dfb653b48
LgoogLoader
bc8560177aa43a687207e68c27c1c9378eb6fff83e61d279641c9256d79ea055
LgoogLoader
e2dbdd45e11e2b7e32caef9e2f4365d05e63eaf13724bea2ed842a503adb802f
LgoogLoader
+ 1'442 additional samples on MalwareBazaar
Result
Malware family:
lgoogloader
Create hunting rule
Score:
  10/10
Tags:
family:lgoogloader downloader persistence
Link:
https://tria.ge/reports/230526-299b7she69/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Sets service image path in registry
Detects LgoogLoader payload
LgoogLoader
Gathering data
Malware family:
RedNet
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/32e3b1b765b9/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/32e3b1b765b96992790ff890e6035bd3e40b0ac5362e0f014e4159137dbba517

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
  
URLhaus
https://urlhaus.abuse.ch/url/2627614/
Cape
Cape
https://www.capesandbox.com/analysis/392295/

Comments