MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 88c43adcd94580235deb526cd4f0f4934b3b0ea0030e1ceca54f9414c77f2975. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LgoogLoader


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 88c43adcd94580235deb526cd4f0f4934b3b0ea0030e1ceca54f9414c77f2975
SHA3-384 hash: 0a07ff7ce5393ecc94ced2cc96e9fe0c62f072ec01d10e523d92c3744500f2decc3d69757aee4cd2161f0f8f7b7d28d8
SHA1 hash: e545edbd605f38975666ca85a09c9912b9dbf15f
MD5 hash: 4d9405747b19b1e8d8f87cd28a414801
humanhash: muppet-snake-cat-missouri
File name:file
Download: download sample
Signature LgoogLoader
Create hunting rule
File size:1'270'200 bytes
First seen:2022-11-15 18:34:37 UTC
Last seen:2022-11-16 19:18:55 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 0ebb3c09b06b1666d307952e824c8697 (15 x RedLineStealer, 13 x LgoogLoader, 7 x NanoCore)
ssdeep 24576:q6ir3Adpd6jRlXMvb9fJQ1vNyFeKQ+91DDIhYoNLg4VkG:lir3Avd6jRdyJ34rQDIHLgK
TLSH T1EA458C92A54A0057F7625DF0485E58A121532EBAA429B20D21C6FE1E95F337700FFBFE
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon d0ee8696968eead4 (1 x LgoogLoader)
Reporter andretavare5
Tags:exe LgoogLoader


Avatar
andretavare5
Sample downloaded from https://myfileexe.s3.ap-northeast-3.amazonaws.com/dFhhxUY.exe

Intelligence

File Origin
# of uploads :
21
# of downloads :
206
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2022-11-15 18:36:27 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/1a99f9a3-5c3d-490d-a03c-c5333002fb8a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/334461/
Detection(s):
SecuriteInfo.com.Backdoor.Win32.Agent.myukqd.4645.24206.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% subdirectories
Searching for the window
Launching a process
Creating a process with a hidden window
Running batch commands
Launching cmd.exe command interpreter
Sending a custom TCP request
Creating a file
Moving a file to the %temp% subdirectory
Creating a process from a recently created file
DNS request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
advpack.dll overlay packed rundll32.exe setupapi.dll shell32.dll
Link:
https://www.filescan.io/uploads/6373dbd8f75d59fef0b97cad/reports/6470ad2f-b84b-4596-8161-d1b6b2bfe2b1/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/57d58157-7765-43fa-8d53-9b6a15130248
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/1114141
Signature
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Obfuscated command line found
Submitted sample is a known malware sample
Uses nslookup.exe to query domains
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 746840 Sample: file.exe Startdate: 15/11/2022 Architecture: WINDOWS Score: 68 35 Multi AV Scanner detection for submitted file 2->35 37 Machine Learning detection for sample 2->37 8 file.exe 1 5 2->8         started        11 rundll32.exe 2->11         started        process3 signatures4 43 Uses nslookup.exe to query domains 8->43 13 cmd.exe 1 8->13         started        16 nslookup.exe 1 8->16         started        process5 signatures6 45 Submitted sample is a known malware sample 13->45 47 Obfuscated command line found 13->47 49 Uses ping.exe to sleep 13->49 51 Uses ping.exe to check the status of other devices and networks 13->51 18 cmd.exe 2 13->18         started        21 conhost.exe 13->21         started        23 PING.EXE 1 13->23         started        25 conhost.exe 16->25         started        process7 signatures8 39 Obfuscated command line found 18->39 41 Uses ping.exe to sleep 18->41 27 powershell.exe 11 18->27         started        29 powershell.exe 11 18->29         started        31 PING.EXE 1 18->31         started        33 findstr.exe 1 18->33         started        process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/88c43adcd94580235deb526cd4f0f4934b3b0ea0030e1ceca54f9414c77f2975/
Threat name:
Win32.Trojan.Privateloader
Create hunting rule
Status:
Suspicious
First seen:
2022-11-15 18:35:12 UTC
File Type:
PE (Exe)
Extracted files:
28
AV detection:
11 of 26 (42.31%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rdcdvxgziwacgxplkjwnj4husnftwdvaamhbz3ffj6kbjr37ff2q._file
Verdict:
malicious
Result
Malware family:
lgoogloader
Create hunting rule
Score:
  10/10
Tags:
family:lgoogloader downloader persistence
Link:
https://tria.ge/reports/221115-w8brnafc33/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Loads dropped DLL
Executes dropped EXE
Detects LgoogLoader payload
LgoogLoader
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/b2c40b64-a657-4e89-a74d-fdffbc36a16a
Unpacked files
SH256 hash:
88c43adcd94580235deb526cd4f0f4934b3b0ea0030e1ceca54f9414c77f2975
MD5 hash:
4d9405747b19b1e8d8f87cd28a414801
SHA1 hash:
e545edbd605f38975666ca85a09c9912b9dbf15f
Link:
https://www.unpac.me/results/2c7f06df-d137-4a89-be68-703731b18a88/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/88c43adcd94580235deb526cd4f0f4934b3b0ea0030e1ceca54f9414c77f2975

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
Cape
Cape
https://www.capesandbox.com/analysis/334461/
  
URLhaus
https://urlhaus.abuse.ch/url/2414169/

Comments