MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9b59aa79432ee430a8d11a809f5e1de7234bbccfd0aad23f53c86add18184b41. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	9b59aa79432ee430a8d11a809f5e1de7234bbccfd0aad23f53c86add18184b41
SHA3-384 hash:	54a118c60ba020c3e05dffec61b36b6196ab57fe9eda07827ee393b9f17380870c3a6f8437aa3281bfd813fef5195f36
SHA1 hash:	950accb24de4bbc9b3f29fb462311dcb54e6e6b2
MD5 hash:	674652ba6a8e5bff5f9566bb4a68b649
humanhash:	oscar-table-mirror-chicken
File name:	setup.msi
Download:	download sample
Signature	LegionLoader Alert Create hunting rule
File size:	74'339'328 bytes
First seen:	2025-05-09 18:59:35 UTC
Last seen:	Never
File type:	msi
MIME type:	application/x-msi
ssdeep	1572864:VlP7ZdJuUgI3OTZkmcFpX/kyYM0iY5L3Hh7vuTPXXLrB:NPbFpX0iJ/Xn
TLSH	T18FF79D01B3F64108F2F76E717EBA59A594BABD521B30C0EF1204664E1B72BC25BB1763
TrID	80.0% (.MSI) Microsoft Windows Installer (454500/1/170) 10.7% (.MST) Windows SDK Setup Transform script (61000/1/5) 7.8% (.MSP) Windows Installer Patch (44509/10/5) 1.4% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika	msi
Reporter	aachum
Tags:	cbsnaturalway-com LegionLoader msi

iamaachum

https://api.linkloungepodcubeoodoo.com/?rt=98c8f8d6716d2a5f83a63b64eff26dc1 => https://mega.nz/file/3fAyWDzY#YETUaFenArlWd2OLvb3Tq0KpmXwsSBLcojERUdxHKiQ

LegionLoader C2: https://cbsnaturalway.com/diagnostics.php

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

82

Origin country :

ES

Vendor Threat Intelligence

CyberFortress Clean

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=681e51e24a59e5a2ce0371f1

Tags:

n/a

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

adaptive-context anti-debug anti-vm cmd expand expired-cert fingerprint keylogger lolbin packed packed remote short-lived-cert threat wix

Link:

https://www.filescan.io/uploads/681e50c5d95f3e34e9656c1a/reports/1d6be501-81ae-47ab-8f54-5b39eb733c5e/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/9b59aa79432ee430a8d11a809f5e1de7234bbccfd0aad23f53c86add18184b41

Joe Sandbox suspicious

Result

Threat name:

n/a

Detection:

suspicious

Classification:

evad

Score:

26 / 100

Link:

https://www.joesandbox.com/analysis/1685933

Signature

Contain functionality to detect virtual machines

Suricata IDS alerts for network traffic

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

ARCHIVE

Link:

https://malprob.io/report/9b59aa79432ee430a8d11a809f5e1de7234bbccfd0aad23f53c86add18184b41

CERT.PL MWDB

Gathering data

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=tnm2u6kdf3sdbkgrdkaj6xq544ruxpgp2cvnep2tzbvn2gayjnaq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  6/10

Tags:

discovery persistence privilege_escalation

Link:

https://tria.ge/reports/250509-xnqkrax1cx/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Event Triggered Execution: Installer Packages

System Location Discovery: System Language Discovery

Drops file in Windows directory

Executes dropped EXE

Loads dropped DLL

Blocklisted process makes network request

Enumerates connected drives

Threat.Zone Suspicious

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/dd6eb550-e94b-4408-9787-2c83ef212045

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.