MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3f84979ca8de7378a2f963ebb84923d631d36db6eaefa88365081da9d71586e8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	3f84979ca8de7378a2f963ebb84923d631d36db6eaefa88365081da9d71586e8
SHA3-384 hash:	8537b438aa9d01d7de4b87c04534c7d8f7c00fc78dfaf6f083c800b2b9d39d4f8e82ffb4f0ed971379936c6087436a0c
SHA1 hash:	4f9c7f35f4bfcbc79705ba3e9418479f0909810a
MD5 hash:	fa363bd82c394fdfe37c5ff5efdd257d
humanhash:	sodium-sweet-blossom-lake
File name:	setup.msi
Download:	download sample
Signature	LegionLoader Alert Create hunting rule
File size:	62'173'184 bytes
First seen:	2025-01-31 15:42:55 UTC
Last seen:	2025-01-31 16:19:13 UTC
File type:	msi
MIME type:	application/x-msi
ssdeep	1572864:v+8VmrjV7eILEOTZeca6HBdVNzdE+ein:mD0cPdhn
Threatray	137 similar samples on MalwareBazaar
TLSH	T1CED76C01B3FA4148F2F75EB17EBA55B594BABD521B30C0EF1204A60E1A71BC25BB1763
TrID	77.3% (.MSI) Microsoft Windows Installer (454500/1/170) 10.3% (.MST) Windows SDK Setup Transform script (61000/1/5) 7.5% (.MSP) Windows Installer Patch (44509/10/5) 3.3% (.WPS) Kingsoft WPS Office document (alt.) (19502/3/2) 1.3% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika	msi
Reporter	PHP
Tags:	LegionDropper LegionLoader msi

PHP

https://loadpremiumapp.monster/?t=d65fdc45106b2ed9788b74ca8f6cca48 -> https://loadpremiumapp.monster/?t=d65fdc45106b2ed9788b74ca8f6cca48

Intelligence

---

File Origin

# of uploads :

5

# of downloads :

87

Origin country :

FR

Vendor Threat Intelligence

CyberFortress Malicious

Verdict:

Malicious

Score:

90.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=679cf09b6d96a8d7e4ce3646

Tags:

virus hype

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

adaptive-context anti-debug anti-vm anti-vm cmd evasive fingerprint fingerprint lolbin packed packed remote wix

Link:

https://www.filescan.io/uploads/679cef8c414c56eb9503a4e4/reports/db0a4360-30f0-449e-9196-b0ec94cbe1e4/overview

Hybrid Analysis Trojan.Injuke

Verdict:

Suspicious

Labled as:

Trojan.Injuke

Link:

https://www.hybrid-analysis.com/sample/3f84979ca8de7378a2f963ebb84923d631d36db6eaefa88365081da9d71586e8

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

96 / 100

Link:

https://www.joesandbox.com/analysis/1603913

Signature

Contains functionality to inject code into remote processes

Found direct / indirect Syscall (likely to bypass EDR)

Hides threads from debuggers

Injects a PE file into a foreign processes

Injects code into the Windows Explorer (explorer.exe)

Joe Sandbox ML detected suspicious sample

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

PE file contains section with special chars

Potentially malicious time measurement code found

System process connects to network (likely due to code injection or exploit)

Tries to detect debuggers (CloseHandle check)

Tries to evade analysis by execution special instruction (VM detection)

Writes to foreign memory regions

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

ARCHIVE

Link:

https://malprob.io/report/3f84979ca8de7378a2f963ebb84923d631d36db6eaefa88365081da9d71586e8

CERT.PL MWDB

Gathering data

ReversingLabs TitaniumCloud Win32.Infostealer.Tinba

Threat name:

Win32.Infostealer.Tinba

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-01-31 11:58:13 UTC

File Type:

Binary (Archive)

Extracted files:

697

AV detection:

3 of 38 (7.89%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=h6cjphfi3zzxrixzmpv3qsjd2yy5g3nw5lx2ra3fbao2tvyvq3ua._file

Threatray sourshark

Verdict:

malicious

Label(s):

sourshark

Alert

Create hunting rule

Similar samples:

38072285421b1dda58ca4d8f722346d3cdf32b43203ae6ec5254dcdc24546b65

LegionLoader

3f84979ca8de7378a2f963ebb84923d631d36db6eaefa88365081da9d71586e8

LegionLoader

50fa7ac33819cfe08bd46f7e7261dc0abf075b96c005d47c49b62238f7a09073

LegionLoader

62f740ee34e5f426b8591bab23229722d77ebf16a0c5717fe1ba7977c00bb73b

LegionLoader

bdfecf574ba864ad209ae5e7f1ef57fcc6c461f46e9fd8f21d94cb9312ec9a45

LegionLoader

ce94ab782a6ddf1502903d5a1e6d18813944a9cebce9b65724d0ac6853bad940

LegionLoader

error

LegionLoader

+ 127 additional samples on MalwareBazaar

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  6/10

Tags:

discovery persistence privilege_escalation

Link:

https://tria.ge/reports/250131-s5xceazlcw/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Event Triggered Execution: Installer Packages

System Location Discovery: System Language Discovery

Drops file in Windows directory

Executes dropped EXE

Loads dropped DLL

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Enumerates connected drives

Threat.Zone Informative

Verdict:

Informative

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/2d94d986-0919-4064-bb64-092474ff3f81

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.