MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fae4abd3d779a55ebef6b421d14465262e711dbdedf3670909ef89e46ee8d109. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

LgoogLoader

Vendor detections: 12

Intelligence 12 IOCs YARA 1 File information Comments

SHA256 hash:	fae4abd3d779a55ebef6b421d14465262e711dbdedf3670909ef89e46ee8d109
SHA3-384 hash:	7b207616b44192822d3510e242014241d030e7a57a4a1c8dbfafd20e9f928ca3860dc1f643068e6baef63ca2aa69d20c
SHA1 hash:	a5d905a2a6f9e9ab39a71e48a537d3c1215ecf4b
MD5 hash:	9c6fe5f7657051af0b167d9d006a89ed
humanhash:	diet-asparagus-mobile-stream
File name:	9c6fe5f7657051af0b167d9d006a89ed.exe
Download:	download sample
Signature	LgoogLoader Create hunting rule
File size:	1'532'312 bytes
First seen:	2022-12-13 17:25:18 UTC
Last seen:	2022-12-13 18:40:55 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	545349dda8d13c4ab678a9966d7c7a40 (6 x LgoogLoader)
ssdeep	24576:PrR6cEO1lM+hWA7dC7SSilKnUgg0pa7GeqfE1RxP4jUvpA6LPzL:AcEOLbUU3LGerTqUxFz
TLSH	T1C86580738AA37C35E3A9227830E24D2F9058616916A643CED4CCB5E9DF4CFD0D89B365
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	f0cc86a38a86e0f0 (1 x LgoogLoader, 1 x XWorm)
Reporter	abuse_ch
Tags:	exe LgoogLoader signed

Code Signing Certificate

Organisation:	lookup.com
Issuer:	R3
Algorithm:	sha256WithRSAEncryption
Valid from:	2022-11-05T00:28:07Z
Valid to:	2023-02-03T00:28:06Z
Serial number:	03c2e604302d845fb41c24444f929609736e
Intelligence:	4 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:	SHA256
Thumbprint:	804869666d7f081f4ea8c49c540ef8bf1cc556371a35c175bce2dd7fe559c774
Source:	This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin

# of uploads :

# of downloads :

169

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

9c6fe5f7657051af0b167d9d006a89ed.exe

Verdict:

Suspicious activity

Analysis date:

2022-12-13 17:27:51 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/eca76598-2e67-4961-81c4-e8bce32479cc

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/345972/

Detection(s):

SecuriteInfo.com.Trojan.GenericKD.64221383.14008.32428.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

DNS request

Launching a process

Sending an HTTP GET request

Creating a file in the %temp% directory

Sending a custom TCP request

Query of malicious DNS domain

Sending a TCP request to an infection source

Unauthorized injection to a system process

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware overlay packed

Link:

https://www.filescan.io/uploads/6398b5acd4d7598ad90551fb/reports/04f2e40e-99f5-4f13-9142-d82a37c3006e/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

NetWalker Ransomware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/b275f2ec-2e68-4321-930a-cfa52abb71ea

Result

Threat name:

RedLine, lgoogLoader

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1133637

Signature

Allocates memory in foreign processes

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Contain functionality to detect virtual machines

Contains functionality to infect the boot sector

Contains functionality to inject code into remote processes

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Uses known network protocols on non-standard ports

Writes to foreign memory regions

Yara detected lgoogLoader

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/fae4abd3d779a55ebef6b421d14465262e711dbdedf3670909ef89e46ee8d109/

Threat name:

Win32.Spyware.RedLine

Status:

Malicious

First seen:

2022-12-13 03:32:47 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

21 of 26 (80.77%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7lskxu6xpgsv5pxwwqq5crdfeyxhchn55xzwocij56e6i3xi2eeq._file

Verdict:

malicious

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/221213-vzvbzafc58/

Behaviour

Suspicious behavior: EnumeratesProcesses

Program crash

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/b5d00f51-1428-49f9-9ce9-c9e3705276ad

Unpacked files

SH256 hash:

ebc0ebe77ab31e9f699ad8da405d458b8a3ac879254cdaf1ff542647fdf90139

MD5 hash:

558c2f7d5bf97969f0f327ec02f650d4

SHA1 hash:

cea7dd32a39bc66f3c098ab1520f08f06ae4b67c

Link:

https://www.unpac.me/results/30869219-a9f5-4cff-8fe9-f2797c6dba5c/

SH256 hash:

fae4abd3d779a55ebef6b421d14465262e711dbdedf3670909ef89e46ee8d109

MD5 hash:

9c6fe5f7657051af0b167d9d006a89ed

SHA1 hash:

a5d905a2a6f9e9ab39a71e48a537d3c1215ecf4b

Link:

https://www.unpac.me/results/30869219-a9f5-4cff-8fe9-f2797c6dba5c/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/fae4abd3d779/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.76

Link:

https://yomi.yoroi.company/submissions/fae4abd3d779a55ebef6b421d14465262e711dbdedf3670909ef89e46ee8d109

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.