MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bdfecf574ba864ad209ae5e7f1ef57fcc6c461f46e9fd8f21d94cb9312ec9a45. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	bdfecf574ba864ad209ae5e7f1ef57fcc6c461f46e9fd8f21d94cb9312ec9a45
SHA3-384 hash:	695916632d2c12896e07a99f251a346937e2b3a976ed48197f7bfdd6eb966ca43632a0d37a3886fb2d0c31ce7dc5f5fd
SHA1 hash:	b2b4e1e2b337e7de7dcef05dafaa249f6ced2eaa
MD5 hash:	c28e4d5c4719cca2ffe76f033e79e028
humanhash:	washington-august-four-virginia
File name:	setup.msi
Download:	download sample
Signature	LegionLoader Alert Create hunting rule
File size:	62'224'384 bytes
First seen:	2025-01-30 16:05:43 UTC
Last seen:	Never
File type:	msi
MIME type:	application/x-msi
ssdeep	786432:8++nVmrjV7eIAtuEOTZnoh7DaXiEBiDxKpnObo8hSvuabe3d8xSP6T:8+8VmrjV7eILEOTZnca2Dx9R3gSP6
Threatray	135 similar samples on MalwareBazaar
TLSH	T193D76C01B3FB4148F2F75EB16EBA45B594BABD521B30C0EF1244A60E1A71BC25BB1763
TrID	80.0% (.MSI) Microsoft Windows Installer (454500/1/170) 10.7% (.MST) Windows SDK Setup Transform script (61000/1/5) 7.8% (.MSP) Windows Installer Patch (44509/10/5) 1.4% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika	msi
Reporter	PHP
Tags:	LegionLoader msi

PHP

hxxps[:]//purecopperapp[.]monster/indexg[.]php?flow_id=107&externalid=38F6CD10-DF12-11EF-B443-A7EAE06FA3B7&cost=0[.]0015&source=326023&country=SK&creativeID=0&keyword=YourFile&cid=522262 -> https://bestpremiumapp.monster/?t=2845f28a539cf6e55a6ac3c29731fa40

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

137

Origin country :

FR

Vendor Threat Intelligence

CyberFortress Clean

Verdict:

Clean

Score:

89.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=679ba4f229ae628cf42bbd42

Tags:

n/a

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

adaptive-context anti-debug anti-vm anti-vm cmd evasive fingerprint fingerprint lolbin packed packed remote wix

Link:

https://www.filescan.io/uploads/679ba372ac8b38d9947ed7dd/reports/3bbb1016-5fc6-41ef-84ce-a2cc335f8b11/overview

Hybrid Analysis Trojan.Injuke

Verdict:

Suspicious

Labled as:

Trojan.Injuke

Link:

https://www.hybrid-analysis.com/sample/bdfecf574ba864ad209ae5e7f1ef57fcc6c461f46e9fd8f21d94cb9312ec9a45

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1603168

Signature

Contains functionality to inject code into remote processes

Found direct / indirect Syscall (likely to bypass EDR)

Hides threads from debuggers

Injects a PE file into a foreign processes

Injects code into the Windows Explorer (explorer.exe)

Joe Sandbox ML detected suspicious sample

Multi AV Scanner detection for dropped file

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

PE file contains section with special chars

Potentially malicious time measurement code found

System process connects to network (likely due to code injection or exploit)

Tries to detect debuggers (CloseHandle check)

Tries to evade analysis by execution special instruction (VM detection)

Writes to foreign memory regions

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

ARCHIVE

Link:

https://malprob.io/report/bdfecf574ba864ad209ae5e7f1ef57fcc6c461f46e9fd8f21d94cb9312ec9a45

CERT.PL MWDB

Gathering data

ReversingLabs TitaniumCloud Win32.Infostealer.Tinba

Threat name:

Win32.Infostealer.Tinba

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-01-30 16:06:11 UTC

File Type:

Binary (Archive)

Extracted files:

697

AV detection:

7 of 24 (29.17%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xx7m6v2lvbsk2ie24xt7d32x7tdmiypun2p5r4q5stfzgexmtjcq._file

Threatray sourshark

Verdict:

malicious

Label(s):

sourshark

Alert

Create hunting rule

Similar samples:

38072285421b1dda58ca4d8f722346d3cdf32b43203ae6ec5254dcdc24546b65

LegionLoader

404e2b3ecd486cf7a533790edbe22ab145c767f8c413a95570b0cc41c3b46143

LegionLoader

50fa7ac33819cfe08bd46f7e7261dc0abf075b96c005d47c49b62238f7a09073

LegionLoader

62f740ee34e5f426b8591bab23229722d77ebf16a0c5717fe1ba7977c00bb73b

LegionLoader

bdfecf574ba864ad209ae5e7f1ef57fcc6c461f46e9fd8f21d94cb9312ec9a45

LegionLoader

ce94ab782a6ddf1502903d5a1e6d18813944a9cebce9b65724d0ac6853bad940

LegionLoader

d14acce52061baa353ffd5698c16dd07a9cca9d86b28c1de64d51e21c3c3c6ac

LegionLoader

error

LegionLoader

+ 125 additional samples on MalwareBazaar

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  6/10

Tags:

discovery persistence privilege_escalation

Link:

https://tria.ge/reports/250130-tj3gzawkdw/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Event Triggered Execution: Installer Packages

System Location Discovery: System Language Discovery

Drops file in Windows directory

Executes dropped EXE

Loads dropped DLL

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Enumerates connected drives

Threat.Zone Informative

Verdict:

Informative

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/605d8e30-a72b-4f82-823f-cbbaa77fe35d

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/bdfecf574ba8/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.