MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 885268e2da486a7c3473e76c11a1a51595efe389c33af5ece150a44166cee80d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	885268e2da486a7c3473e76c11a1a51595efe389c33af5ece150a44166cee80d
SHA3-384 hash:	28ab9160e378c66eaaaa2697f9dd688dd5455855afad171bb874c3b6c4c405c9899185fc0ccfbc5d1cac8c16bad6032b
SHA1 hash:	c483ac63bc6073c3178880d8a49398ad971fdafe
MD5 hash:	1679ec43df5f9bbe66dbec7eda17e1a1
humanhash:	steak-social-virginia-bluebird
File name:	setup.msi
Download:	download sample
Signature	LegionLoader Alert Create hunting rule
File size:	58'535'936 bytes
First seen:	2025-05-07 18:56:11 UTC
Last seen:	Never
File type:	msi
MIME type:	application/x-msi
ssdeep	786432:tSlP7ZdJuUg6/vsytOTZjJTF7DQ9IBE4KAeRpqCg+:ElP7ZdJuUg6tOTZ1hDQ9IC4KAeCX
Threatray	213 similar samples on MalwareBazaar
TLSH	T16DD76C01B3FA4148F2F76E717EBA89A5947ABD521B30C0EF1204664E1B71BC25BB1763
TrID	80.0% (.MSI) Microsoft Windows Installer (454500/1/170) 10.7% (.MST) Windows SDK Setup Transform script (61000/1/5) 7.8% (.MSP) Windows Installer Patch (44509/10/5) 1.4% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika	msi
Reporter	aachum
Tags:	fmecoutsm-com LegionLoader msi

iamaachum

https://api.linkloungepodcubeoodoo.com/?rt=7f6872205e1829ba6a17fa2e829f650c => https://mega.nz/file/7YtAiarA#sMRQtz0PbgXFP2WR5xm-0iMu3wa-ei2VOfPaivd0ZtE

LegionLoader First C2: https://fmecoutsm.com/diagnostics.php
Stage 2 C2: http://baleturn.com/front.php?a=KoaQhyudfYI7Wze&id=0

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

85

Origin country :

ES

Vendor Threat Intelligence

CyberFortress Clean

Verdict:

Clean

Score:

89.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=681bad366c95617a27b5d96f

Tags:

n/a

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

adaptive-context anti-debug anti-vm cmd expand expired-cert fingerprint keylogger lolbin packed packed packed remote short-lived-cert wix

Link:

https://www.filescan.io/uploads/681bacdc0b64e174c41c77f9/reports/76f145a9-7b74-4921-8e1e-c2eec3cd6aef/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/885268e2da486a7c3473e76c11a1a51595efe389c33af5ece150a44166cee80d

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

rans.evad

Score:

60 / 100

Link:

https://www.joesandbox.com/analysis/1683611

Signature

Drops PE files with a suspicious file extension

Suricata IDS alerts for network traffic

Tries to detect virtualization through RDTSC time measurements

Writes a notice file (html or txt) to demand a ransom

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

ARCHIVE

Link:

https://malprob.io/report/885268e2da486a7c3473e76c11a1a51595efe389c33af5ece150a44166cee80d

CERT.PL MWDB

Gathering data

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=rbjgryw2jbvhyndt45wbdinfcwk67y4jym5pl3hbkcseczwo5agq._file

Threatray sourshark

Verdict:

malicious

Label(s):

sourshark

Alert

Create hunting rule

Similar samples:

3ae9657b921ba4edac1e727c356ee4ac57ebfa0a1d5900a932176606dda211fa

LegionLoader

585ab6c1cdaa65c9d08decf4e1ab1cf9327f00e18d13e85e338268ccc3587aab

LegionLoader

885268e2da486a7c3473e76c11a1a51595efe389c33af5ece150a44166cee80d

LegionLoader

94c6d1fe9c7daf7293c8244eb3788b41addf4e998e603d0b64fd99702519dfe5

LegionLoader

db15ad02cbec94f4cc65b6fc5d93636721c93ba0a712fd25efedee686f991b5c

LegionLoader

e70d976f524d73561644e830a62e575b6d46f3b42f1dbcdfa35450c4d15f8b6a

LegionLoader

error

LegionLoader

+ 203 additional samples on MalwareBazaar

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  6/10

Tags:

discovery persistence privilege_escalation

Link:

https://tria.ge/reports/250507-xlk79avwdv/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Modifies data under HKEY_USERS

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Browser Information Discovery

Enumerates physical storage devices

Event Triggered Execution: Installer Packages

System Location Discovery: System Language Discovery

Drops file in Program Files directory

Drops file in Windows directory

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

Blocklisted process makes network request

Enumerates connected drives

Threat.Zone Suspicious

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/48c5a9ae-71f9-4dfc-85fd-59eee6a4adfe

VMRay LegionLoader

Malware family:

LegionLoader

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/885268e2da48/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.