MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6aa8c7811e02d48797f51fd635e97060112122222638a725306ba6b690f691d1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LgoogLoader


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6aa8c7811e02d48797f51fd635e97060112122222638a725306ba6b690f691d1
SHA3-384 hash: c0c156537147d104525cc6573c98865e0829e665f0077feb2c45791744d7fd964fe8ca8fc55809b7ec53811f68003798
SHA1 hash: 48a52802dac363a31837a6490f30373f11b36e1d
MD5 hash: 6bc6eb30308ddef71d513866b4f3b8ce
humanhash: snake-island-paris-july
File name:file
Download: download sample
Signature LgoogLoader
Create hunting rule
File size:1'419'080 bytes
First seen:2022-11-16 18:08:11 UTC
Last seen:2022-11-16 19:52:15 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 310638d36ec921f029e67a7144e7c280 (2 x ArkeiStealer, 2 x Smoke Loader, 2 x LgoogLoader)
ssdeep 24576:/HG3QV/XnliwfhE50A+NEqDc468KtywYhP1BfClqOfSNQUn:OgV/U50A6E4c46DwLZbYOQi
Threatray 16'448 similar samples on MalwareBazaar
TLSH T12A65F12B3D2A873EC627E73808D808F3346A207F23398F97566D2BAD947576E1D01579
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon f0ccb6ae8ecef0f0 (1 x LgoogLoader)
Reporter jstrosch
Tags:exe LgoogLoader signed

Code Signing Certificate

Organisation:forgiato.com
Issuer:Go Daddy Secure Certificate Authority - G2
Algorithm:sha256WithRSAEncryption
Valid from:2022-07-15T23:39:20Z
Valid to:2023-08-16T23:39:20Z
Serial number: 103ec8d8d08d08a8
Intelligence: 6 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: 70f5720501c6f5a216350d80fc24081927508eead9c16ced0faf7290b9f68353
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
2
# of downloads :
192
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2022-11-16 18:15:30 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/29f9aa89-19f8-4649-9c03-24cd4c4696b2

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/334996/
Detection(s):
SecuriteInfo.com.Variant.Jaik.104121.9503.9733.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
DNS request
Launching a process
Sending a custom TCP request
Sending an HTTP GET request
Creating a file in the %temp% directory
Creating a process from a recently created file
Сreating synchronization primitives
Creating a file
Reading critical registry keys
Running batch commands
Creating a process with a hidden window
Forced shutdown of a system process
Stealing user critical data
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware overlay packed
Link:
https://www.filescan.io/uploads/6375273e7db879aacbceb285/reports/4f686de2-1eae-4bcd-942c-328157581a5b/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/d0e7e8ed-d076-42bf-9800-8e205faf3893
Result
Threat name:
Vidar, lgoogLoader
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1115181
Signature
Allocates memory in foreign processes
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Contain functionality to detect virtual machines
Contains functionality to infect the boot sector
Contains functionality to inject code into remote processes
Drops PE files with benign system names
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
Yara detected lgoogLoader
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 747885 Sample: file.exe Startdate: 16/11/2022 Architecture: WINDOWS Score: 100 45 Malicious sample detected (through community Yara rule) 2->45 47 Multi AV Scanner detection for dropped file 2->47 49 Multi AV Scanner detection for submitted file 2->49 51 5 other signatures 2->51 8 file.exe 19 2->8         started        process3 dnsIp4 33 www.imarket-eg.com 8->33 35 dtwpymwiy.yq8zo5frebgizxis81wow0lowelizxub 8->35 37 imarket-eg.com 160.153.50.70, 443, 49714, 49715 AS-26496-GO-DADDY-COM-LLCUS United States 8->37 25 C:\Users\user\AppData\Local\...\svchost.exe, PE32 8->25 dropped 27 C:\Users\user\AppData\Local\...\advapi32.dll, PE32 8->27 dropped 29 C:\Users\user\AppData\...\library[1].bin, PE32 8->29 dropped 31 C:\Users\user\AppData\...\resource[1].bin, PE32 8->31 dropped 53 Writes to foreign memory regions 8->53 55 Allocates memory in foreign processes 8->55 57 Drops PE files with benign system names 8->57 59 Injects a PE file into a foreign processes 8->59 13 svchost.exe 17 8->13         started        17 ngentask.exe 8->17         started        file5 signatures6 process7 dnsIp8 39 116.202.3.228, 49720, 80 HETZNER-ASDE Germany 13->39 41 hacexq0nogu8aey7j7mjmuuoez16h9a.pjt6jrec2cva 13->41 43 t.me 149.154.167.99, 443, 49719 TELEGRAMRU United Kingdom 13->43 61 Antivirus detection for dropped file 13->61 63 System process connects to network (likely due to code injection or exploit) 13->63 65 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 13->65 73 3 other signatures 13->73 19 cmd.exe 1 13->19         started        67 Contains functionality to infect the boot sector 17->67 69 Contain functionality to detect virtual machines 17->69 71 Contains functionality to inject code into remote processes 17->71 signatures9 process10 process11 21 conhost.exe 19->21         started        23 timeout.exe 1 19->23         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6aa8c7811e02d48797f51fd635e97060112122222638a725306ba6b690f691d1/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2022-11-16 16:49:55 UTC
File Type:
PE (Exe)
Extracted files:
27
AV detection:
18 of 25 (72.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nkumpai6alkipf7vd7ldl2lqmaiscircey4kojjqnotlnehwshiq._file
Verdict:
malicious
Similar samples:
040aa152e739826874a268f4ffb8be80dd256e7817cdb2c25329d25a5264671e
LgoogLoader
2bc35780b427873d03d777f75b112473d6593fdf7eab195dd75a6ba1ec1daec9
LgoogLoader
2fbf3507320d77ce68ad429c66ddcf0d53cedcb3cf8396c1057c820737bf9e11
LgoogLoader
3e38c14c9a27966b7768fa6a61a0bc86b79fdf8f554d232c26d0a13cd8dcdc36
LgoogLoader
4268c628b2cfcf6700dc00f43a474bd0fa720b43008bc3684631453542523bea
LgoogLoader
49263745f35d59a6845e6d654980d96ec831d0f7be41ae11a4669098f3a50740
LgoogLoader
9d5670638fac6e9e5670cd6985894e9b2fcf1fb334973e5e3424fb246f835e11
LgoogLoader
ba4fb2a15fa8baf942cdb9bddc882288290dbb6663b701b67e9ae48c85d362cb
LgoogLoader
e61234a0934d7955c0bafda460b8220f7012958415e05635d61d433a6e0c9006
LgoogLoader
+ 16'438 additional samples on MalwareBazaar
Result
Malware family:
lgoogloader
Create hunting rule
Score:
  10/10
Tags:
family:lgoogloader downloader
Link:
https://tria.ge/reports/221116-wrfdhscc59/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Detects LgoogLoader payload
LgoogLoader
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/af900237-fb6d-4b25-a0e0-95e61a10e7a0
Unpacked files
SH256 hash:
6aa8c7811e02d48797f51fd635e97060112122222638a725306ba6b690f691d1
MD5 hash:
6bc6eb30308ddef71d513866b4f3b8ce
SHA1 hash:
48a52802dac363a31837a6490f30373f11b36e1d
Link:
https://www.unpac.me/results/42b8e6f8-b6a6-450b-85b4-691018b47042/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6aa8c7811e02d48797f51fd635e97060112122222638a725306ba6b690f691d1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:malware_shellcode_hash
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect shellcode api hash value
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LgoogLoader

Executable exe 6aa8c7811e02d48797f51fd635e97060112122222638a725306ba6b690f691d1

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/334996/
  
URLhaus
https://urlhaus.abuse.ch/url/2415264/

Comments