MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 763bbf36766a12f4c3b16c73ee7dc8a083dc43ed98b9be9bcff931ca2a7478a5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LgoogLoader


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 763bbf36766a12f4c3b16c73ee7dc8a083dc43ed98b9be9bcff931ca2a7478a5
SHA3-384 hash: 61443e29356368db631002e8d0e8eeb20a0bbb2b7397724daab1e346724717facacbb91fb02e1b768c6f1081af83dbc0
SHA1 hash: 54368cffabec358ec702efa40b591970b350735b
MD5 hash: 5a624a20e7eee11bea3997c0b83933b0
humanhash: emma-music-william-foxtrot
File name:file
Download: download sample
Signature LgoogLoader
Create hunting rule
File size:943'872 bytes
First seen:2022-11-06 16:04:38 UTC
Last seen:2022-11-08 17:46:44 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 0ebb3c09b06b1666d307952e824c8697 (15 x RedLineStealer, 13 x LgoogLoader, 7 x NanoCore)
ssdeep 24576:V7gdojWaH1Us4I+H8KGpoQWcluWrvF2vGLV/Vp:KdojWJO6bGxWdY9fV/D
Threatray 75 similar samples on MalwareBazaar
TLSH T134151213D6E5A137C48443B052E6A7532338BDA02B1D57C7814FB9B66EB13E2367838E
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 40b97070e9682048 (1 x LgoogLoader)
Reporter jstrosch
Tags:exe LgoogLoader

Intelligence

File Origin
# of uploads :
33
# of downloads :
158
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2022-11-06 16:07:37 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/5734ee79-9215-4a14-b51a-d97d0e6e0a8c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/329476/
Detection(s):
SecuriteInfo.com.Backdoor.Win32.Agent.myukqd.4645.24206.UNOFFICIAL
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% subdirectories
Launching a process
Creating a process with a hidden window
Running batch commands
Launching cmd.exe command interpreter
Using the Windows Management Instrumentation requests
Moving a file to the %temp% subdirectory
Creating a process from a recently created file
DNS request
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/49283/overview
Behaviour
MalwareBazaar
SystemUptime
MeasuringTime
EvasionGetTickCount
EvasionQueryPerformanceCounter
CheckCmdLine
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
advpack.dll overlay packed rundll32.exe setupapi.dll shell32.dll
Link:
https://www.filescan.io/uploads/6367db303c6c57b4ec4142e2/reports/4990442f-f2aa-4295-9d0f-4288b979628f/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/684af7e6-f5f8-469d-8449-1266a9840e61
Result
Threat name:
lgoogLoader
Create hunting rule
Detection:
malicious
Classification:
troj.evad.phis.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1106652
Signature
Contain functionality to detect virtual machines
Contains functionality to infect the boot sector
Contains functionality to inject code into remote processes
Detected unpacking (creates a PE file in dynamic memory)
DLL reload attack detected
Drops PE files with a suspicious file extension
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Obfuscated command line found
Renames NTDLL to bypass HIPS
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Yara detected lgoogLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 739313 Sample: file.exe Startdate: 06/11/2022 Architecture: WINDOWS Score: 100 45 Multi AV Scanner detection for submitted file 2->45 47 Yara detected lgoogLoader 2->47 49 Machine Learning detection for sample 2->49 9 file.exe 1 5 2->9         started        11 rundll32.exe 2->11         started        process3 process4 13 cmd.exe 1 9->13         started        16 TapiUnattend.exe 9->16         started        signatures5 63 Obfuscated command line found 13->63 65 Uses ping.exe to sleep 13->65 67 Drops PE files with a suspicious file extension 13->67 69 Uses ping.exe to check the status of other devices and networks 13->69 18 cmd.exe 2 13->18         started        22 conhost.exe 13->22         started        24 PING.EXE 1 13->24         started        process6 file7 39 C:\Users\user\AppData\Local\...\Slave.exe.pif, PE32 18->39 dropped 51 Obfuscated command line found 18->51 53 Uses ping.exe to sleep 18->53 26 Slave.exe.pif 1 18->26         started        31 tasklist.exe 1 18->31         started        33 tasklist.exe 1 18->33         started        35 4 other processes 18->35 signatures8 process9 dnsIp10 43 txLWmsILyUgnBTNIGmIDLI.txLWmsILyUgnBTNIGmIDLI 26->43 41 C:\Users\user\AppData\...\bttCOlDCPn.dll, PE32 26->41 dropped 55 DLL reload attack detected 26->55 57 Detected unpacking (creates a PE file in dynamic memory) 26->57 59 Contains functionality to infect the boot sector 26->59 61 4 other signatures 26->61 37 Slave.exe.pif 26->37         started        file11 signatures12 process13
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/763bbf36766a12f4c3b16c73ee7dc8a083dc43ed98b9be9bcff931ca2a7478a5/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2022-11-06 16:05:11 UTC
File Type:
PE (Exe)
Extracted files:
22
AV detection:
10 of 26 (38.46%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=oy536ntwnijpjq5rnrz647oiucb5yq7ntc435g6p7ey4uktupcsq._file
Verdict:
unknown
Similar samples:
5c19fb2da50d67ae379047a6a30c01a418aefc98956d0d1662404742e9d84878
LgoogLoader
661a812991c0211d5a20990080bb5160888835d80a99a4cebe2f895b948be62d
LgoogLoader
713ecd61ef27c081ca2c5aab8bc73a87fe277987a53746731e1aa14c54062953
LgoogLoader
717957544dcfbf0a92f33a1ab039d4197fd7c4b21615ec2fa9a730ef74e24c85
LgoogLoader
7fe10c2e9e135621141b2d02b3aabda8aad3f852ff1f016ab8278efb8ab24b18
LgoogLoader
8f754e2bfa013020f14d498b5ade5c139163e31dae1ec34975381efeff30f2e3
LgoogLoader
9c9b326ea0ae9aec4786fbb1ecd3522d31ea652a7658137c5a9c5d07df7b0c87
LgoogLoader
b4b8d49ce8ac2c756f6d65399e71a15fc46814f4aee055bcc99cbb7d1d50cd88
LgoogLoader
+ 65 additional samples on MalwareBazaar
Result
Malware family:
lgoogloader
Create hunting rule
Score:
  10/10
Tags:
family:lgoogloader downloader persistence
Link:
https://tria.ge/reports/221106-tjg62acfal/
Behaviour
Enumerates processes with tasklist
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Loads dropped DLL
Executes dropped EXE
Detects LgoogLoader payload
LgoogLoader
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/c307da76-bb66-43bc-ae0e-22f5a34f0d8a
Unpacked files
SH256 hash:
c08159a512e78460e8904b4c0bbf05f0a55ca0043884ed8678dcfb0b461d9bb1
MD5 hash:
7ef6732afe8c285e6f1974316982b265
SHA1 hash:
809d00bbe07717a76018276f67352647782851ae
Link:
https://www.unpac.me/results/fb715589-382b-46e5-b4e8-178be91159d9/
SH256 hash:
763bbf36766a12f4c3b16c73ee7dc8a083dc43ed98b9be9bcff931ca2a7478a5
MD5 hash:
5a624a20e7eee11bea3997c0b83933b0
SHA1 hash:
54368cffabec358ec702efa40b591970b350735b
Link:
https://www.unpac.me/results/fb715589-382b-46e5-b4e8-178be91159d9/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.31
Link:
https://yomi.yoroi.company/submissions/763bbf36766a12f4c3b16c73ee7dc8a083dc43ed98b9be9bcff931ca2a7478a5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LgoogLoader

Executable exe 763bbf36766a12f4c3b16c73ee7dc8a083dc43ed98b9be9bcff931ca2a7478a5

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/329476/
  
URLhaus
https://urlhaus.abuse.ch/url/2402508/

Comments