🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3c7d6a0c5cdee7aa478fa1aec2035c1b8173a5f1ebb19efacc5b53ea30545714. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RobotDropper


Vendor detections: 7


Intelligence 7 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3c7d6a0c5cdee7aa478fa1aec2035c1b8173a5f1ebb19efacc5b53ea30545714
SHA3-384 hash: e548ea78f069a15799fcc2150edfd8792d9eed3a8260f3bc7c32fdcde4899fc63d6ed237fbf4aed32a568d46c7b9761d
SHA1 hash: fbe74d5cf74e01306330337eea48098c3d0ce54e
MD5 hash: a23f8020d704c06c89c2a62b89db8050
humanhash: uranus-failed-neptune-arkansas
File name:setup.msi
Download: download sample
Signature RobotDropper
Create hunting rule
File size:50'288'354 bytes
First seen:2025-02-06 15:14:30 UTC
Last seen:Never
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 786432:ZraQl2j6PQQLiG8BqjDXdjHmrfB2cnAPH/h6mjhxR1MjwgHyR1NiehDM+OuU6sW+:ZraQl221irqjLcOfhbjhxRYw4cNdM+O0
Threatray 141 similar samples on MalwareBazaar
TLSH T1F7B733213C6D857EFA6F25724537769A913D2CE20BB209EB92E1B93D56305C27231F83
TrID 80.0% (.MSI) Microsoft Windows Installer (454500/1/170)
10.7% (.MST) Windows SDK Setup Transform script (61000/1/5)
7.8% (.MSP) Windows Installer Patch (44509/10/5)
1.4% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika msi
Reporter aachum
Tags:gliempleo-com LegionLoader msi RobotDropper


Avatar
iamaachum
https://overly-polity.com/?352509=ANPPpGf9YAUA0oICAEVTFwAMAAAAAABT.file.7z&flow_id=99&pkey=72e01ec8f10da660aaad&t=0.5&b=1.1201801300048828&bt=reg

LegionLoader/RobotDropper C2: http://gliempleo.com/front.php?a=53ba9MvlseDcrH4&id=0

Intelligence

File Origin
# of uploads :
1
# of downloads :
99
Origin country :
ES ES
Vendor Threat Intelligence
Verdict:
Clean
Score:
89.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67a4d3252dcee78dd819d0d9
Tags:
n/a
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
adaptive-context anti-vm cmd crypto evasive fingerprint fingerprint lolbin obfuscated remote wix
Link:
https://www.filescan.io/uploads/67a4d211ba420adaa784a52b/reports/7e33eadc-d69d-40ea-bd42-2465b629e52f/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/3c7d6a0c5cdee7aa478fa1aec2035c1b8173a5f1ebb19efacc5b53ea30545714
Result
Threat name:
n/a
Detection:
malicious
Classification:
troj.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/1608482
Signature
Allocates memory in foreign processes
Contains functionality to inject code into remote processes
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Multi AV Scanner detection for dropped file
NDIS Filter Driver detected (likely used to intercept and sniff network traffic)
Sample uses process hollowing technique
System process connects to network (likely due to code injection or exploit)
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1608482 Sample: setup.msi Startdate: 06/02/2025 Architecture: WINDOWS Score: 84 41 gliempleo.com 2->41 45 Multi AV Scanner detection for dropped file 2->45 47 NDIS Filter Driver detected (likely used to intercept and sniff network traffic) 2->47 49 Contains functionality to inject code into remote processes 2->49 8 msiexec.exe 135 134 2->8         started        11 msiexec.exe 2 2->11         started        signatures3 process4 file5 33 C:\Windows\Installer\MSI87B.tmp, PE32 8->33 dropped 35 C:\Windows\Installer\MSI82C.tmp, PE32 8->35 dropped 37 C:\Windows\Installer\MSI7BD.tmp, PE32 8->37 dropped 39 52 other files (11 malicious) 8->39 dropped 13 openvpn.exe 1 8->13         started        16 console.q.exe 3 8->16         started        19 msiexec.exe 8->19         started        process6 file7 53 Injects code into the Windows Explorer (explorer.exe) 13->53 55 Writes to foreign memory regions 13->55 57 Allocates memory in foreign processes 13->57 59 2 other signatures 13->59 21 explorer.exe 13->21         started        25 conhost.exe 13->25         started        27 WerFault.exe 2 13->27         started        31 C:\Users\user\...\libpkcs11-helper-1.dll, PE32+ 16->31 dropped 29 conhost.exe 16->29         started        signatures8 process9 dnsIp10 43 gliempleo.com 169.150.247.39, 49759, 80 SPIRITTEL-ASUS United States 21->43 51 System process connects to network (likely due to code injection or exploit) 21->51 signatures11
Score:
100%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/3c7d6a0c5cdee7aa478fa1aec2035c1b8173a5f1ebb19efacc5b53ea30545714
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hr6wudc433t2ur4pugxmea24doaxhjpr5oyz56wmlnj6umcuk4ka._file
Verdict:
malicious
Label(s):
sourshark
Create hunting rule
Similar samples:
3f84979ca8de7378a2f963ebb84923d631d36db6eaefa88365081da9d71586e8
RobotDropper
50fa7ac33819cfe08bd46f7e7261dc0abf075b96c005d47c49b62238f7a09073
RobotDropper
62f740ee34e5f426b8591bab23229722d77ebf16a0c5717fe1ba7977c00bb73b
RobotDropper
7dac55cda93bc09dd7f11b192320b837cb7ea0383a81decb837632e489b0ef89
RobotDropper
bdfecf574ba864ad209ae5e7f1ef57fcc6c461f46e9fd8f21d94cb9312ec9a45
RobotDropper
ce94ab782a6ddf1502903d5a1e6d18813944a9cebce9b65724d0ac6853bad940
RobotDropper
error
RobotDropper
+ 131 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  6/10
Tags:
discovery persistence privilege_escalation
Link:
https://tria.ge/reports/250206-sm3fpsylbx/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Embeds OpenSSL
Enumerates physical storage devices
Event Triggered Execution: Installer Packages
System Location Discovery: System Language Discovery
Drops file in Windows directory
Executes dropped EXE
Loads dropped DLL
Suspicious use of SetThreadContext
Enumerates connected drives
Verdict:
Informative
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/df389ea3-fefd-4dfd-bcab-3ce535efa0d1
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3c7d6a0c5cdee7aa478fa1aec2035c1b8173a5f1ebb19efacc5b53ea30545714

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Detect_LATAM_MSI_Banker
Create hunting rule
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:RobotDropper
Create hunting rule
Author:NDA0E
Description:Detects RobotDropper
Rule name:suspicious_msi_file
Create hunting rule
Author:Johnk3r
Description:Detects common strings, DLL and API in Banker_BR
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:upxHook
Create hunting rule
Author:@r3dbU7z
Description:Detect artifacts from 'upxHook' - modification of UPX packer
Reference:https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RobotDropper

Microsoft Software Installer (MSI) msi 3c7d6a0c5cdee7aa478fa1aec2035c1b8173a5f1ebb19efacc5b53ea30545714

(this sample)

  
Link
https://tria.ge/250206-sjqmqsykct/
  
Delivery method
Distributed via web download

Comments