🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dd40e2fc9b6975fbdf70ebbe0818e91b25fc6789095d5a70583109820fa2bcd1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LegionLoader


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dd40e2fc9b6975fbdf70ebbe0818e91b25fc6789095d5a70583109820fa2bcd1
SHA3-384 hash: 410e036e96619f095a36092dcb70c549d6408b34ec198032b9eff728fec51c15780d6684ae7966ade3e0bd92b08e1bd3
SHA1 hash: cd92c4e9c78ba5e6038876d1fb0d80c658f26834
MD5 hash: 74e369b8de19264610a1034454bde28b
humanhash: zulu-blue-floor-carpet
File name:setup.msi
Download: download sample
Signature LegionLoader
Create hunting rule
File size:59'401'736 bytes
First seen:2025-01-18 16:18:01 UTC
Last seen:Never
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 786432:CovnVmrjV7eIAtusOTZLoh7Da2yjWldWjIHrXdBkttySrdV3H:CofVmrjV7eILsOTZLcaHEdWErIZrfX
TLSH T113D76C01B3FA4148F2F75E717EBA55A594BABD521B30C0EF1204A60E1B72BC25BB1763
TrID 80.0% (.MSI) Microsoft Windows Installer (454500/1/170)
10.7% (.MST) Windows SDK Setup Transform script (61000/1/5)
7.8% (.MSP) Windows Installer Patch (44509/10/5)
1.4% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika msi
Reporter aachum
Tags:flash3hit-com LegionLoader msi RobotDropper


Avatar
iamaachum
https://gaelic-dane-deflea-badan.com/?352509=AIzRi2f9YAUA0oICAEVTFwAMAAAAAAD9.relise_2.3.zip.7z&flow_id=99&pkey=72e01ec8f10da660aaad&t=0.5&b=32.63990020751953&bt=reg => https://gaelic-dane-deflea-badan.com/s/dl/AIzRi2f9YAUA0oICAEVTFwAMAAAAAAD9/relise_2.3.zip37.7z

LegionLoader/RobotDropper C2: http://flash3hit.com/front.php?a=jO07wDS86KDtUB7&id=0

Intelligence

File Origin
# of uploads :
1
# of downloads :
36
Origin country :
ES ES
Vendor Threat Intelligence
Verdict:
Clean
Score:
89.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=678bd588aa9c8e7858dfd356
Tags:
n/a
Verdict:
Suspicious
Labled as:
Trojan.Injuke
Link:
https://www.hybrid-analysis.com/sample/dd40e2fc9b6975fbdf70ebbe0818e91b25fc6789095d5a70583109820fa2bcd1
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/1594265
Signature
Allocates memory in foreign processes
Contains functionality to inject code into remote processes
Found direct / indirect Syscall (likely to bypass EDR)
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Multi AV Scanner detection for dropped file
Potentially malicious time measurement code found
Query firmware table information (likely to detect VMs)
Sample uses process hollowing technique
System process connects to network (likely due to code injection or exploit)
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1594265 Sample: setup.msi Startdate: 18/01/2025 Architecture: WINDOWS Score: 92 45 flash3hit.com 2->45 49 Multi AV Scanner detection for dropped file 2->49 51 Contains functionality to inject code into remote processes 2->51 53 Potentially malicious time measurement code found 2->53 8 msiexec.exe 135 101 2->8         started        11 msiexec.exe 2 2->11         started        signatures3 process4 file5 37 C:\Windows\Installer\MSI3305.tmp, PE32 8->37 dropped 39 C:\Windows\Installer\MSI32C5.tmp, PE32 8->39 dropped 41 C:\Windows\Installer\MSI3276.tmp, PE32 8->41 dropped 43 49 other files (10 malicious) 8->43 dropped 13 obs-ffmpeg-mux.exe 1 8->13         started        16 msiexec.exe 8->16         started        18 UnRar.exe 3 8->18         started        21 createdump.exe 1 8->21         started        process6 file7 57 Injects code into the Windows Explorer (explorer.exe) 13->57 59 Writes to foreign memory regions 13->59 61 Allocates memory in foreign processes 13->61 65 3 other signatures 13->65 23 explorer.exe 13->23         started        27 conhost.exe 13->27         started        29 WerFault.exe 2 13->29         started        63 Query firmware table information (likely to detect VMs) 16->63 35 C:\Users\user\AppData\Roaming\...\obs.dll, PE32+ 18->35 dropped 31 conhost.exe 18->31         started        33 conhost.exe 21->33         started        signatures8 process9 dnsIp10 47 flash3hit.com 169.150.247.37, 49738, 80 SPIRITTEL-ASUS United States 23->47 55 System process connects to network (likely due to code injection or exploit) 23->55 signatures11
Score:
90%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/dd40e2fc9b6975fbdf70ebbe0818e91b25fc6789095d5a70583109820fa2bcd1
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3vaof7e3nf27xx3q5o7aqghjdms7yz4jbfovu4cygeeyed5cxtiq._file
Result
Malware family:
n/a
Score:
  6/10
Tags:
discovery persistence privilege_escalation
Link:
https://tria.ge/reports/250118-trzq2sxpas/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Event Triggered Execution: Installer Packages
System Location Discovery: System Language Discovery
Drops file in Windows directory
Executes dropped EXE
Loads dropped DLL
Suspicious use of SetThreadContext
Enumerates connected drives
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/681e6830-40cb-4186-a494-ac81920df081
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LegionLoader

Microsoft Software Installer (MSI) msi dd40e2fc9b6975fbdf70ebbe0818e91b25fc6789095d5a70583109820fa2bcd1

(this sample)

LegionLoader

Executable exe 5e95fdaf12b88ff185b4426f247b2708df934178b528b188011913cb71eedd60

  
Link
https://tria.ge/250118-tmng8axmhy/
  
Delivery method
Distributed via web download
  
Dropping
SHA256 5e95fdaf12b88ff185b4426f247b2708df934178b528b188011913cb71eedd60
  
Dropping
MD5 96f42110dbac74a1dd013c54caef4985

Comments