MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3ae9657b921ba4edac1e727c356ee4ac57ebfa0a1d5900a932176606dda211fa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	3ae9657b921ba4edac1e727c356ee4ac57ebfa0a1d5900a932176606dda211fa
SHA3-384 hash:	bf0b8246e89305f7b51e72b8d1c0d5857a7bd4a8e93f2b092ed8b6b3543ec316d004542c80783aac0cd3b08b0e171af5
SHA1 hash:	5aa9dcc901e9a90a77176ccf6ff99f4528cc4c9e
MD5 hash:	d0cb8af1d620906dd48be954396174a0
humanhash:	august-pip-october-speaker
File name:	setup.msi
Download:	download sample
Signature	LegionLoader Alert Create hunting rule
File size:	57'826'304 bytes
First seen:	2025-04-17 17:11:17 UTC
Last seen:	Never
File type:	msi
MIME type:	application/x-msi
ssdeep	786432:tjaVmrjV7eIAtCGOTZ1JTF7DQ9IBE4KAeRpqCg+U:tmVmrjV7eI/GOTZThDQ9IC4KAeCX
TLSH	T1FDC76C01B3F64148F2F75EB17EBA55A594BABD521B30C0EF1204A60E1B72BC25BB1763
TrID	80.0% (.MSI) Microsoft Windows Installer (454500/1/170) 10.7% (.MST) Windows SDK Setup Transform script (61000/1/5) 7.8% (.MSP) Windows Installer Patch (44509/10/5) 1.4% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika	msi
Reporter	aachum
Tags:	kerryoutdesigns-com LegionLoader msi

iamaachum

https://appsuccess.monster/?rt=518c65b4885bdd19518cfbf3d1ad7e18 => https://mega.nz/file/MrIhAZBD#d5SpH7dehrxkuNWwTHULFvOnHSdsispbGXf1p2aTfXw

LegionLoader C2: https://kerryoutdesigns.com/diagnostics.php

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

73

Origin country :

ES

Vendor Threat Intelligence

CyberFortress Clean

Verdict:

Clean

Score:

82.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68013bbb2203b3e10cd06685

Tags:

n/a

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

adaptive-context anti-debug anti-vm cmd expand expired-cert fingerprint keylogger keylogger lolbin packed packed remote wix

Link:

https://www.filescan.io/uploads/6801364590767142c3d96024/reports/2b9104dc-9c52-4e8f-b90a-21372003fe8d/overview

Hybrid Analysis Trojan.Injuke

Verdict:

Malicious

Labled as:

Trojan.Injuke

Link:

https://www.hybrid-analysis.com/sample/3ae9657b921ba4edac1e727c356ee4ac57ebfa0a1d5900a932176606dda211fa

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

rans.evad

Score:

60 / 100

Link:

https://www.joesandbox.com/analysis/1667767

Signature

Drops PE files with a suspicious file extension

Suricata IDS alerts for network traffic

Tries to detect virtualization through RDTSC time measurements

Writes a notice file (html or txt) to demand a ransom

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

ARCHIVE

Link:

https://malprob.io/report/3ae9657b921ba4edac1e727c356ee4ac57ebfa0a1d5900a932176606dda211fa

CERT.PL MWDB

Gathering data

ReversingLabs TitaniumCloud Win32.Trojan.Generic

Threat name:

Win32.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2025-04-17 08:02:57 UTC

File Type:

Binary (Archive)

Extracted files:

885

AV detection:

3 of 24 (12.50%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=hluwk64sdoso3la6oj6dk3xevrl6x6qkdvmqbkjsc5tanxncch5a._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  6/10

Tags:

discovery persistence privilege_escalation

Link:

https://tria.ge/reports/250417-vqhltawva1/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Modifies data under HKEY_USERS

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Browser Information Discovery

Enumerates physical storage devices

Event Triggered Execution: Installer Packages

System Location Discovery: System Language Discovery

Drops file in Program Files directory

Drops file in Windows directory

Executes dropped EXE

Loads dropped DLL

Blocklisted process makes network request

Enumerates connected drives

Threat.Zone Suspicious

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/208af2d9-54de-4690-ab09-208db77a469e

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.