🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 404e2b3ecd486cf7a533790edbe22ab145c767f8c413a95570b0cc41c3b46143. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LegionLoader


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 404e2b3ecd486cf7a533790edbe22ab145c767f8c413a95570b0cc41c3b46143
SHA3-384 hash: 719bafdd53a6c0ea726e4d6e968774c97ca28f5e58592b56229a421e2d448a25f8babccbf59f4d0fef6f6087ff7cbe4e
SHA1 hash: c5efa38a646b02ea2263dacd5a17586295c6fcd3
MD5 hash: 99c84a1c2cf1acd2ddeb621561789acb
humanhash: angel-fifteen-early-blue
File name:setup.msi
Download: download sample
Signature LegionLoader
Create hunting rule
File size:60'336'524 bytes
First seen:2024-12-26 12:19:25 UTC
Last seen:Never
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 786432:zGZojVmrjV7eIAtehOTZ0oZ4sdUuzt/NCaY2ksCo:zGcVmrjV7eIvhOTZ5RjVCa1tP
TLSH T1D9D76C01B3FA4148F2F75EB17EBA45A594BABD521B30C0EF1204A60E1B71BC25BB5763
TrID 80.0% (.MSI) Microsoft Windows Installer (454500/1/170)
10.7% (.MST) Windows SDK Setup Transform script (61000/1/5)
7.8% (.MSP) Windows Installer Patch (44509/10/5)
1.4% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika msi
Reporter aachum
Tags:LegionLoader msi RobotDropper successroadway-com


Avatar
iamaachum
https://api.premiumexperiencegood.com/?353770=AM1GbWfqZQUAH4ECAEVTFwAMAAAAAABP.Phshop_26.2.rar.iso&flow_id=99&pkey=72e01ec8f10da660aaad&t=0.5&b=14.300670623779297&bt=new => https://api.premiumexperiencegood.com/s/dl/AM1GbWfqZQUAH4ECAEVTFwAMAAAAAABP/Phshop_26.2.rar-121238.iso

LegionLoader/RobotDropper C2: https://successroadway.com/updater.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
ES ES
Vendor Threat Intelligence
Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=676d49fd8a4d48ee35ffb33d
Tags:
spawn
Verdict:
Suspicious
Labled as:
Trojan.Injuke
Link:
https://www.hybrid-analysis.com/sample/404e2b3ecd486cf7a533790edbe22ab145c767f8c413a95570b0cc41c3b46143
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/1580946
Signature
AI detected suspicious sample
Bypasses PowerShell execution policy
Query firmware table information (likely to detect VMs)
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Script Execution From Temp Folder
Suricata IDS alerts for network traffic
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1580946 Sample: setup.msi Startdate: 26/12/2024 Architecture: WINDOWS Score: 68 49 successroadway.com 2->49 57 Suricata IDS alerts for network traffic 2->57 59 AI detected suspicious sample 2->59 61 Sigma detected: Suspicious Script Execution From Temp Folder 2->61 63 Sigma detected: Script Interpreter Execution From Suspicious Folder 2->63 9 msiexec.exe 139 107 2->9         started        12 msiexec.exe 2 2->12         started        signatures3 process4 file5 35 C:\Windows\Installer\MSI8C5C.tmp, PE32 9->35 dropped 37 C:\Windows\Installer\MSI8093.tmp, PE32 9->37 dropped 39 C:\Windows\Installer\MSI650B.tmp, PE32 9->39 dropped 41 52 other files (none is malicious) 9->41 dropped 14 msiexec.exe 14 9->14         started        19 cmd.exe 1 9->19         started        21 createdump.exe 1 9->21         started        process6 dnsIp7 51 successroadway.com 104.21.6.3, 443, 49737 CLOUDFLARENETUS United States 14->51 43 C:\Users\user\AppData\Local\...\scr8D00.ps1, Unicode 14->43 dropped 45 C:\Users\user\AppData\Local\...\pss8D12.ps1, Unicode 14->45 dropped 47 C:\Users\user\AppData\Local\...\msi8CFF.txt, Unicode 14->47 dropped 53 Query firmware table information (likely to detect VMs) 14->53 55 Bypasses PowerShell execution policy 14->55 23 powershell.exe 17 14->23         started        25 ImporterREDServer.exe 1 19->25         started        27 conhost.exe 19->27         started        29 conhost.exe 21->29         started        file8 signatures9 process10 process11 31 conhost.exe 23->31         started        33 conhost.exe 25->33         started       
Score:
92%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/404e2b3ecd486cf7a533790edbe22ab145c767f8c413a95570b0cc41c3b46143
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ibhcwpwnjbwppjjtpehnxyrkwfc4oz7yyqj2svlqwdgedq5umfbq._file
Result
Malware family:
n/a
Score:
  6/10
Tags:
discovery execution persistence privilege_escalation
Link:
https://tria.ge/reports/241226-phq1bsvrep/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: PowerShell
Event Triggered Execution: Installer Packages
System Location Discovery: System Language Discovery
Drops file in Windows directory
Executes dropped EXE
Loads dropped DLL
Drops file in System32 directory
Blocklisted process makes network request
Enumerates connected drives
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/c0d7a109-a7ed-4027-b535-ec82fd3d605d
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LegionLoader

iso 01b8b7240a20bd3eefe8b6ce48616fbccaffe26828f0cdc6b065b372f2c10a64

LegionLoader

Microsoft Software Installer (MSI) msi 404e2b3ecd486cf7a533790edbe22ab145c767f8c413a95570b0cc41c3b46143

(this sample)

  
Link
https://tria.ge/241226-patq9avnfs/
  
Dropped by
SHA256 01b8b7240a20bd3eefe8b6ce48616fbccaffe26828f0cdc6b065b372f2c10a64
  
Delivery method
Distributed via web download
  
Dropped by
MD5 1151e31e4976c6313efe6782e17f0c59

Comments