MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ce23b56615c9b0625799dca8c83558eb1016cce8aec1919dd52d31bf646eface. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

LegionLoader

Vendor detections: 9

Intelligence 9 IOCs YARA 3 File information Comments

SHA256 hash:	ce23b56615c9b0625799dca8c83558eb1016cce8aec1919dd52d31bf646eface
SHA3-384 hash:	69de43e14c6159bea983ec21ff9ebfc45d1f6addb2d38c9bfc05e69a54cb0a87fe2d2ac9df14d78ed33e46bdd6e08af9
SHA1 hash:	34250e233be1f6dfc22212b556503c625df02075
MD5 hash:	dcfbe94f7ead20bb942b06ecb67937fd
humanhash:	december-white-failed-fix
File name:	a.exe
Download:	download sample
Signature	LegionLoader Create hunting rule
File size:	653'312 bytes
First seen:	2026-07-04 03:47:31 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	85bddbdc3c4b221d91aa501a1aedc0fc (1 x LegionLoader)
ssdeep	12288:rFcwAHYHsQSzOLkvAFh8qKHeVg1Vuayk2REYlteoDUMYFrXILmJ2xWq8Nrb:rFSYMQStvA78qKs2VDeNltbDUMtCJ2o
TLSH	T14ED4026C1CD717EDC135C63842D3B33AF96EF7E12A254FD3C70292A96A35ED429A1A01
TrID	51.9% (.EXE) Win64 Executable (generic) (6522/11/2) 16.1% (.EXE) OS/2 Executable (generic) (2029/13) 15.9% (.EXE) Generic Win/DOS Executable (2002/3) 15.9% (.EXE) DOS Executable (generic) (2000/1)
Magika	pebin
dhash icon	0b0787e270ac8603 (1 x LegionLoader)
Reporter	aachum
Tags:	ClickFix exe eyuboglutv-com LegionLoader

iamaachum

https://yivf.flickpoploaderfast.monster/ => http://authorization-code.beer/b63cb5afeacc6761a867557484b8c5189ad6f379af762b1afb1100fad75c3c0a

LegionLoader C2: https://eyuboglutv.com/nfront.php

Intelligence

File Origin

# of uploads :

# of downloads :

135

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

a.exe

Verdict:

No threats detected

Analysis date:

2026-07-04 03:48:05 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/03142364-e9ee-408c-be36-0a667dc1c769

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/72784/

Detection(s):

SecuriteInfo.com.Win64.MalwareX-gen.91551543.UNOFFICIAL

Verdict:

Clean

Score:

89.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a488274762b0b26f3cf95a6

Tags:

n/a

Result

Verdict:

Clean

Maliciousness:

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

anti-debug packed

Link:

https://www.filescan.io/uploads/6a48826581111823993a6bfd/reports/0a202a9d-b71d-47e0-9652-8004696a5249/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_60%

Link:

https://www.hybrid-analysis.com/sample/ce23b56615c9b0625799dca8c83558eb1016cce8aec1919dd52d31bf646eface

Verdict:

Unknown

File Type:

Link:

https://opentip.kaspersky.com/ce23b56615c9b0625799dca8c83558eb1016cce8aec1919dd52d31bf646eface/results?tab=lookup

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/576d6a40-4657-4523-a956-d122027716ba

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1937370

Signature

Allocates memory in foreign processes

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Contains functionality to inject code into remote processes

Early bird code injection technique detected

Hijacks the control flow in another process

Multi AV Scanner detection for submitted file

Queues an APC in another process (thread injection)

Suricata IDS alerts for network traffic

Unusual module load detection (module proxying)

Writes to foreign memory regions

Behaviour

Behavior Graph:

Download SVG

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/ce23b56615c9b0625799dca8c83558eb1016cce8aec1919dd52d31bf646eface

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ce23b56615c9b0625799dca8c83558eb1016cce8aec1919dd52d31bf646eface/

Verdict:

Susipicious

Link:

https://tip.neiki.dev/file/ce23b56615c9b0625799dca8c83558eb1016cce8aec1919dd52d31bf646eface

Threat name:

Win64.Malware.Generic

Status:

Suspicious

First seen:

2026-07-04 03:48:15 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

11 of 36 (30.56%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zyr3kzqvzgygev4z3sumqnky5mibnthiv3azdhovfuy36zdo7lha._file

Result

Malware family:

n/a

Score:

6/10

Tags:

n/a

Link:

https://tria.ge/reports/260704-eckagsey8n/

Behaviour

Looks up external IP address via web service

Unpacked files

SH256 hash:

ce23b56615c9b0625799dca8c83558eb1016cce8aec1919dd52d31bf646eface

MD5 hash:

dcfbe94f7ead20bb942b06ecb67937fd

SHA1 hash:

34250e233be1f6dfc22212b556503c625df02075

Link:

https://www.unpac.me/results/1451f803-7752-46e3-9609-b75ccebbd3cc/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.60

Link:

https://yomi.yoroi.company/submissions/ce23b56615c9b0625799dca8c83558eb1016cce8aec1919dd52d31bf646eface

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.