🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 82dfd306f4161cc8da08ce5e7434e8010f73d58d434fc0c31ef89fe8785e7f77. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LunexLoader


Vendor detections: 12


Intelligence 12 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 82dfd306f4161cc8da08ce5e7434e8010f73d58d434fc0c31ef89fe8785e7f77
SHA3-384 hash: adf6093f046b7fd4c6b25f55b8e9fb5bbabc96f6509092961f702f8d1ff48b9cb815fe1fee0281c64a8fdc23db29df10
SHA1 hash: 215d0f3b64b7e86fd4c634c3cd9ae64c0cc0c9d8
MD5 hash: 98bd1a9b870dcc04926c8c17ed156d03
humanhash: sad-venus-comet-salami
File name:build_unitservice.exe
Download: download sample
Signature LunexLoader
Create hunting rule
File size:3'369'234 bytes
First seen:2026-11-01 11:36:27 UTC
Last seen:Never
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash 9e8441cb15d1c923e092059c50770339 (1 x LunexLoader)
ssdeep 49152:V0/FlmvHGWD9OifYpr1k8YlEL8KKN55cZiirHNVO/6VDfxhRtQq0:givHGWD4pr1R8zjirHNVb5vQ3
TLSH T1BAF5BEDD470024DADFCD28F82DD6FF8DF108D56112D919C94AA274A54B2B639B32CCAB
TrID 51.9% (.EXE) Win64 Executable (generic) (6522/11/2)
16.1% (.EXE) OS/2 Executable (generic) (2029/13)
15.9% (.EXE) Generic Win/DOS Executable (2002/3)
15.9% (.EXE) DOS Executable (generic) (2000/1)
Magika pebin
Reporter abuse_ch
Tags:exe LunexLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
184
Origin country :
SE SE
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-11-01 12:52:22 UTC
Tags:
pdfwkrnl-sys vuln-driver
Link:
https://app.any.run/tasks/3b1b1842-49e4-4a23-9fe4-e6a45e608cdc

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/96548/
Detection(s):
SecuriteInfo.com.Trojan.Siggen36.56685.9668.11725.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Score:
50%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ae72479b175ade21dcee53a
Tags:
injection extens blic
Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Creating a process with a hidden window
DNS request
Connection attempt
Sending a custom TCP request
Sending an HTTP GET request
Creating a file in the %temp% directory
Creating a file
Creating a service
Launching a service
Loading a system driver
Deleting a recently created file
Enabling autorun for a service
Connection attempt to an infection source
Gathering data
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/82dfd306f4161cc8da08ce5e7434e8010f73d58d434fc0c31ef89fe8785e7f77
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-11-01T04:54:00Z UTC
Last seen:
2026-11-02T01:10:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/82dfd306f4161cc8da08ce5e7434e8010f73d58d434fc0c31ef89fe8785e7f77/results?tab=lookup
Malware family:
Mistic
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/7921afdc-4b2d-4a05-8f72-0269dd01b9eb
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/1996128
Signature
Antivirus detection for URL or domain
Changes security center settings (notifications, updates, antivirus, firewall)
Drops PE files to the user root directory
Found direct / indirect Syscall (likely to bypass EDR)
May modify the system service descriptor table (often done to hook functions)
Multi AV Scanner detection for submitted file
Sample is not signed and drops a device driver
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1996128 Sample: build_unitservice.exe Startdate: 01/11/2026 Architecture: WINDOWS Score: 76 42 Antivirus detection for URL or domain 2->42 44 Multi AV Scanner detection for submitted file 2->44 46 May modify the system service descriptor table (often done to hook functions) 2->46 7 build_unitservice.exe 1 2->7         started        11 svchost.exe 2->11         started        13 svchost.exe 8 2->13         started        15 6 other processes 2->15 process3 file4 36 C:\Users\Public\t0vel47q.sys, PE32+ 7->36 dropped 48 Drops PE files to the user root directory 7->48 50 May modify the system service descriptor table (often done to hook functions) 7->50 52 Sample is not signed and drops a device driver 7->52 54 Found direct / indirect Syscall (likely to bypass EDR) 7->54 17 curl.exe 2 7->17         started        20 curl.exe 1 7->20         started        22 WerFault.exe 22 16 7->22         started        24 WmiPrvSE.exe 7->24         started        56 Changes security center settings (notifications, updates, antivirus, firewall) 11->56 26 MpCmdRun.exe 2 11->26         started        28 WerFault.exe 2 13->28         started        signatures5 process6 dnsIp7 38 127.0.0.1 unknown unknown 17->38 30 conhost.exe 17->30         started        40 107.175.82.242, 9000 ONEPROVIDER-ASBrainStormNetworkIncCA United States 20->40 32 conhost.exe 20->32         started        34 conhost.exe 26->34         started        process8
Score:
74%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/82dfd306f4161cc8da08ce5e7434e8010f73d58d434fc0c31ef89fe8785e7f77
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/98bd1a9b870dcc04926c8c17ed156d03
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/82dfd306f4161cc8da08ce5e7434e8010f73d58d434fc0c31ef89fe8785e7f77/
Threat name:
Win64.Trojan.Ravartar
Create hunting rule
Status:
Malicious
First seen:
2026-11-01 09:53:53 UTC
File Type:
PE+ (Exe)
Extracted files:
3
AV detection:
26 of 38 (68.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qlp5gbxucyomrwqizzphinhiaehxhvmninh4bqy67cp6q6c6p53q._file
Verdict:
malicious
Label(s):
LunexLoader
Create hunting rule
Link:
https://reports.threatray.com/7f0a928f-368e-4385-85f9-db573129cdb5
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery
Link:
https://tria.ge/reports/261101-nrbrbsvscx/
Behaviour
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Reads the TCP/IP host and domain name from the registry
Unpacked files
SH256 hash:
82dfd306f4161cc8da08ce5e7434e8010f73d58d434fc0c31ef89fe8785e7f77
MD5 hash:
98bd1a9b870dcc04926c8c17ed156d03
SHA1 hash:
215d0f3b64b7e86fd4c634c3cd9ae64c0cc0c9d8
Link:
https://www.unpac.me/results/9f6876cf-9a7b-4432-910d-ea865df3ad94/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/82dfd306f4161cc8da08ce5e7434e8010f73d58d434fc0c31ef89fe8785e7f77

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:WIN_Malware_Unknown_ForgeAuto_3ee43008
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Sample_Unique_69354b41
Create hunting rule
Author:Marjoriefort
Description:Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LunexLoader

Executable exe 82dfd306f4161cc8da08ce5e7434e8010f73d58d434fc0c31ef89fe8785e7f77

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/4049455/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/96548/

Comments