MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dfd88d1b834dac64cb82037099eff4e0d062011c712b7d413041a801ba0ac0ae. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LgoogLoader


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dfd88d1b834dac64cb82037099eff4e0d062011c712b7d413041a801ba0ac0ae
SHA3-384 hash: 36b5ff6e27cb5e6042bcc32779fbaf2b7dd3f1e0a00585cfec8d85ff333e6523029f1708dc059be4a9397353e9169aa5
SHA1 hash: 0a60ed32ba9c50d437d66bca85f48c05798c0d40
MD5 hash: 99a680e7d710652344ed23a9fe40e832
humanhash: nebraska-hamper-sixteen-apart
File name:file
Download: download sample
Signature LgoogLoader
Create hunting rule
File size:1'656'288 bytes
First seen:2022-12-03 13:13:26 UTC
Last seen:2022-12-03 19:21:24 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 2272bd1fadcc3c967b255c33596d9f56 (2 x LgoogLoader, 2 x RedLineStealer)
ssdeep 24576:xefSX7ktn93nXwm9pn0vONAbkqkQyHNbRfdJuOfA45TLqJqJFBURqUH:c6r4ZnWPQqkQIdw0ASJF+qUH
TLSH T16975230477A1D037E0261230C961EBB71739F8718A72C38BAB895BAD4DF27C26679753
TrID 40.3% (.EXE) Win64 Executable (generic) (10523/12/4)
19.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
17.2% (.EXE) Win32 Executable (generic) (4505/5/1)
7.7% (.EXE) OS/2 Executable (generic) (2029/13)
7.6% (.EXE) Generic Win/DOS Executable (2002/3)
File icon (PE):PE icon
dhash icon f0c48696aab2ccf0 (1 x LgoogLoader)
Reporter andretavare5
Tags:exe LgoogLoader signed

Code Signing Certificate

Organisation:*.fandom.com
Issuer:GlobalSign Atlas R3 DV TLS CA 2022 Q2
Algorithm:sha256WithRSAEncryption
Valid from:2022-05-29T16:20:14Z
Valid to:2023-06-30T16:20:13Z
Serial number: 0140594ccaad5348bfaf7de297272e29
Intelligence: 4 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: 95b644d57785b2e7b98947789bf54e757b88e3170e76a4e6f4c5b83494eaeaf8
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


Avatar
andretavare5
Sample downloaded from https://myexes.s3.ap-northeast-1.amazonaws.com/Adsme.exe

Intelligence

File Origin
# of uploads :
7
# of downloads :
193
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2022-12-03 13:14:28 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/d67fb1dd-89d9-498a-9340-ec4ac3595890

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/342260/
Detection(s):
SecuriteInfo.com.Unwanted-Program.004d2a1d1.19367.18685.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
DNS request
Launching a process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware overlay packed
Link:
https://www.filescan.io/uploads/638b4b9d55eb3470cd4fc332/reports/c98854aa-7020-4ecc-ae55-ec1d04f14438/overview
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Mustang Panda
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/7911f435-cdd9-4a55-8806-deeb93832ad9
Result
Threat name:
RedLine, lgoogLoader
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1127081
Signature
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contain functionality to detect virtual machines
Contains functionality to infect the boot sector
Contains functionality to inject code into remote processes
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
Yara detected lgoogLoader
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 759805 Sample: file.exe Startdate: 03/12/2022 Architecture: WINDOWS Score: 100 33 Snort IDS alert for network traffic 2->33 35 Malicious sample detected (through community Yara rule) 2->35 37 Multi AV Scanner detection for dropped file 2->37 39 6 other signatures 2->39 6 file.exe 17 2->6         started        process3 dnsIp4 23 www.sealicensing.com 6->23 25 wt3nwm6qdz3eqyq1ncmqwvunrjb7kpr8.q7kq3cx0tw6gzdfbzzj 6->25 27 sealicensing.com 198.23.62.100, 443, 49705, 49706 STEADFASTUS United States 6->27 21 C:\Users\user\AppData\Local\...\advapi32.dll, PE32 6->21 dropped 41 Writes to foreign memory regions 6->41 43 Allocates memory in foreign processes 6->43 45 Injects a PE file into a foreign processes 6->45 11 fontview.exe 15 5 6->11         started        15 ngentask.exe 6->15         started        17 ngentask.exe 6->17         started        19 ngentask.exe 6->19         started        file5 signatures6 process7 dnsIp8 29 109.206.243.58, 49708, 81 AWMLTNL Germany 11->29 31 api.ip.sb 11->31 47 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 11->47 49 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 11->49 51 Tries to harvest and steal browser information (history, passwords, etc) 11->51 53 Tries to steal Crypto Currency Wallets 11->53 55 Contains functionality to infect the boot sector 15->55 57 Contain functionality to detect virtual machines 15->57 59 Contains functionality to inject code into remote processes 15->59 signatures9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dfd88d1b834dac64cb82037099eff4e0d062011c712b7d413041a801ba0ac0ae/
Threat name:
Win32.Trojan.Privateloader
Create hunting rule
Status:
Suspicious
First seen:
2022-12-03 13:14:12 UTC
File Type:
PE (Exe)
Extracted files:
28
AV detection:
14 of 26 (53.85%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=37mi2g4djwwgjs4canyjt37u4digeai4oevx2qjqiguadoqkycxa._file
Verdict:
malicious
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/221203-qgm3qagc9s/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Program crash
Verdict:
Informative
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/15d6f163-e44e-4f8e-872f-e53c1fada80b
Unpacked files
SH256 hash:
7d38d2c806a9940b313a0ac1e294dcf5cdbc9d317cf30d173290aa2af34bb6e2
MD5 hash:
301265d77da71b86f79bb128596696ed
SHA1 hash:
56f50d2aa0e153fe9886d1cc48e585424a6e4ca0
Link:
https://www.unpac.me/results/1e6f25e7-1638-4532-9846-8242af4285bb/
SH256 hash:
dfd88d1b834dac64cb82037099eff4e0d062011c712b7d413041a801ba0ac0ae
MD5 hash:
99a680e7d710652344ed23a9fe40e832
SHA1 hash:
0a60ed32ba9c50d437d66bca85f48c05798c0d40
Link:
https://www.unpac.me/results/1e6f25e7-1638-4532-9846-8242af4285bb/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/dfd88d1b834dac64cb82037099eff4e0d062011c712b7d413041a801ba0ac0ae

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
Cape
Cape
https://www.capesandbox.com/analysis/342260/

Comments