MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 669cde998d0245ceaad815e30c1ab30d8ad94011e1179b9cbb76b68cd6480429. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	669cde998d0245ceaad815e30c1ab30d8ad94011e1179b9cbb76b68cd6480429
SHA3-384 hash:	2730db1cf6d40e6ef3a597e211bc85e7d051c81aec2b0d9e5721bcda874cab9becc46807350fb1e403a95112008b8ab3
SHA1 hash:	7796a692f3ff9882d8839adf91b0716a8205c67e
MD5 hash:	369f5b71c3c82b0236de3582fd05e537
humanhash:	river-connecticut-whiskey-fillet
File name:	Setup.msi
Download:	download sample
Signature	LegionLoader Alert Create hunting rule
File size:	60'682'240 bytes
First seen:	2025-01-12 14:24:09 UTC
Last seen:	Never
File type:	msi
MIME type:	application/x-msi
ssdeep	786432:IrBQuVmrjV7eIAteQOTZboh7DaQvJZ+16ZhHNY9jyWSwXO/hdYO:IrBVmrjV7eIvQOTZbcaQvO16Zh4W3Y
TLSH	T1C4D77C01B3FA4148F2F75E717EBA95A5947ABD521B30C0EF1204A60E1B72BC25BB1763
TrID	80.0% (.MSI) Microsoft Windows Installer (454500/1/170) 10.7% (.MST) Windows SDK Setup Transform script (61000/1/5) 7.8% (.MSP) Windows Installer Patch (44509/10/5) 1.4% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika	msi
Reporter	aachum
Tags:	LegionLoader msi RobotDropper staticmaxepress-com

iamaachum

https://hitcopperapp.monster/?t=7faf7547293c2e09beedcffee24f25c7 => https://mega.nz/file/x2FHzTqJ#DlI4oMksk702Gt9gr-lXTtd9c808WmZ3gvUGlPbMIdE

LegionLoader/RobotDropper C2: https://staticmaxepress.com/updater2.php

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

32

Origin country :

ES

Vendor Threat Intelligence

CyberFortress Clean

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6783d0c92c8240e189bc19b1

Tags:

n/a

Hybrid Analysis Trojan.Injuke

Verdict:

Suspicious

Labled as:

Trojan.Injuke

Link:

https://www.hybrid-analysis.com/sample/669cde998d0245ceaad815e30c1ab30d8ad94011e1179b9cbb76b68cd6480429

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

68 / 100

Link:

https://www.joesandbox.com/analysis/1589444

Signature

AI detected suspicious sample

Bypasses PowerShell execution policy

Potentially malicious time measurement code found

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Script Execution From Temp Folder

Suricata IDS alerts for network traffic

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

ARCHIVE

Link:

https://malprob.io/report/669cde998d0245ceaad815e30c1ab30d8ad94011e1179b9cbb76b68cd6480429

CERT.PL MWDB

Gathering data

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=m2on5gmnajc45kwycxrqygvtbwfnsqar4elzxhf3o23izvsiaquq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  6/10

Tags:

discovery execution persistence privilege_escalation

Link:

https://tria.ge/reports/250112-rrae2sylbk/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: PowerShell

Event Triggered Execution: Installer Packages

System Location Discovery: System Language Discovery

Drops file in Windows directory

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Blocklisted process makes network request

Enumerates connected drives

Threat.Zone Suspicious

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/1ec549f4-19ae-4fae-a396-a5931db6f488

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.