🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d14acce52061baa353ffd5698c16dd07a9cca9d86b28c1de64d51e21c3c3c6ac. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LegionLoader


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d14acce52061baa353ffd5698c16dd07a9cca9d86b28c1de64d51e21c3c3c6ac
SHA3-384 hash: c6432f4e1b4477af6c5248d4f49c8e0d841886e75f3b69eec7930e09a60713dacc59759d0ef79950db1724ba578ed5cf
SHA1 hash: 3b685880e7ec090ab3ead12d591b2aca1ac3dcfe
MD5 hash: 0c7afa785117afdb85ab29b0a12edc51
humanhash: vegan-friend-fix-two
File name:setup.msi
Download: download sample
Signature LegionLoader
Create hunting rule
File size:60'336'401 bytes
First seen:2024-12-26 11:51:22 UTC
Last seen:Never
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 786432:zGZojVmrjV7eIAtehOTZ0oZ4sdUuzt/NCaY2ksCo:zGcVmrjV7eIvhOTZ5RjVCa1tP
TLSH T1FFD76C01B3FA4148F2F75EB17EBA45A594BABD521B30C0EF1204A60E1B71BC25BB5763
TrID 80.0% (.MSI) Microsoft Windows Installer (454500/1/170)
10.7% (.MST) Windows SDK Setup Transform script (61000/1/5)
7.8% (.MSP) Windows Installer Patch (44509/10/5)
1.4% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika msi
Reporter aachum
Tags:LegionLoader msi RobotDropper successroadway-com


Avatar
iamaachum
https://premiumexperiencegood.com/2024/12/08/sustainable-investing-balancing-profits-and-environmental-impact-268/?utm_term=%7BQUERY%7D&utm_content=%7BSUBID1%7D&utm_medium=%7BSUBID2%7D%3FutmPass%3DmVZoK3W9T0&token=wFbV&date=1735212956&=3 => https://premiumexperiencegood.com/2024/12/08/sustainable-investing-balancing-profits-and-environmental-impact-268/?download=file-111233.iso&utm_source=ADlAbWfzZAUAH4ECAEVTFwAMAAAAAABA&v=

RobotDropper/LegionLoader C2: https://successroadway.com/updater.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
57
Origin country :
ES ES
Vendor Threat Intelligence
Verdict:
Clean
Score:
89.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=676d436f8a4d48ee35ffad04
Tags:
malware
Verdict:
Suspicious
Labled as:
Trojan.Injuke
Link:
https://www.hybrid-analysis.com/sample/d14acce52061baa353ffd5698c16dd07a9cca9d86b28c1de64d51e21c3c3c6ac
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/1580907
Signature
AI detected suspicious sample
Bypasses PowerShell execution policy
Query firmware table information (likely to detect VMs)
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Script Execution From Temp Folder
Suricata IDS alerts for network traffic
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1580907 Sample: setup.msi Startdate: 26/12/2024 Architecture: WINDOWS Score: 68 49 successroadway.com 2->49 57 Suricata IDS alerts for network traffic 2->57 59 AI detected suspicious sample 2->59 61 Sigma detected: Suspicious Script Execution From Temp Folder 2->61 63 Sigma detected: Script Interpreter Execution From Suspicious Folder 2->63 9 msiexec.exe 139 107 2->9         started        12 msiexec.exe 2 2->12         started        signatures3 process4 file5 35 C:\Windows\Installer\MSIAFE1.tmp, PE32 9->35 dropped 37 C:\Windows\Installer\MSIA3C9.tmp, PE32 9->37 dropped 39 C:\Windows\Installer\MSI8718.tmp, PE32 9->39 dropped 41 52 other files (none is malicious) 9->41 dropped 14 msiexec.exe 14 9->14         started        19 cmd.exe 1 9->19         started        21 createdump.exe 1 9->21         started        process6 dnsIp7 51 successroadway.com 104.21.6.3, 443, 49730 CLOUDFLARENETUS United States 14->51 43 C:\Users\user\AppData\Local\...\scrB094.ps1, Unicode 14->43 dropped 45 C:\Users\user\AppData\Local\...\pssB0A6.ps1, Unicode 14->45 dropped 47 C:\Users\user\AppData\Local\...\msiB093.txt, Unicode 14->47 dropped 53 Query firmware table information (likely to detect VMs) 14->53 55 Bypasses PowerShell execution policy 14->55 23 powershell.exe 17 14->23         started        25 ImporterREDServer.exe 1 19->25         started        27 conhost.exe 19->27         started        29 conhost.exe 21->29         started        file8 signatures9 process10 process11 31 conhost.exe 23->31         started        33 conhost.exe 25->33         started       
Score:
90%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/d14acce52061baa353ffd5698c16dd07a9cca9d86b28c1de64d51e21c3c3c6ac
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2ffmzzjamg5kgu772vuyyfw5a6u4zkoynmumdxte2upcdq6dy2wa._file
Result
Malware family:
n/a
Score:
  6/10
Tags:
discovery execution persistence privilege_escalation
Link:
https://tria.ge/reports/241226-n1q8davlew/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: PowerShell
Event Triggered Execution: Installer Packages
System Location Discovery: System Language Discovery
Drops file in Windows directory
Executes dropped EXE
Loads dropped DLL
Drops file in System32 directory
Blocklisted process makes network request
Enumerates connected drives
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/92f58b74-b145-4022-997e-1747c316030f
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LegionLoader

iso 645dcda040b6ee18582470f03f14ee916e3edb6809e0dd54bfc48b9a8ca1f7b9

LegionLoader

Microsoft Software Installer (MSI) msi d14acce52061baa353ffd5698c16dd07a9cca9d86b28c1de64d51e21c3c3c6ac

(this sample)

  
Link
https://tria.ge/241226-ns5e2avlep/
  
Dropped by
SHA256 645dcda040b6ee18582470f03f14ee916e3edb6809e0dd54bfc48b9a8ca1f7b9
  
Delivery method
Distributed via web download
  
Dropped by
MD5 b129db12c9766885d80c5cc939a4c926

Comments