legionlocker | a4e002898d11ea511868a11a43dd29011dbe97bcbd9ee4b9fbcb0520d860f975

General

Target

LegionLocker4.1.exe
Size

3.2MB
Sample

210726-6ddeaaha2s
MD5

563059c1ba238fb233200b053327313d
SHA1

c50908fe140fe127a6c2168ad7a07df6b9836186
SHA256

a4e002898d11ea511868a11a43dd29011dbe97bcbd9ee4b9fbcb0520d860f975
SHA512

9bbfe87044543ecf7fc6c865fad533ce864309c63cbff070c7f69ec1373392d149628c58bc7312bf72aae2aaecd6874c5ec95542042df6f34d65570da5d810bb

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\LegionReadMe.txt

Ransom Note

Ooops! All your important files are encrypted! What happend to my computer? All your important files are encrypted. No one can help you to restore files without our special decryptor. Backups were either encrypted or deleted. Shadow copies also removed. If you want to restore some of your files for free write to email (contact is below) and attach 2-3 encrypted files. You will receive decrypted samples. To decrypt other files you have to pay $50. How do i pay? Payment is accepted in Bitcoin only. Please check the current price of Bitcoin and buy some Bitcoins. And send the correct amount to the address specified at the bottom of the sheet. Contact: 1.Download Tor browser (https://www.torproject.org/) 2.Create account on mail2tor (http://mail2tor2zyjdctd.onion/) 3.Write email to us (LegionLocker@mail2tor.com) In case of no anwser in 72 hours write us to this email: CobraLocker@mail2tor.com What if i already paid? Send your Bitcoin wallet ID to e-mail provided above. Attention! 1.Do not modify encrypted files. 2.Do not try decrypt your data using third party software, it may cause pernament data loss. Our Bitcoin address: 131fjhrB4wH8j6adZXudp1Wn23pR33tpAh

Emails

LegionLocker@mail2tor.com

CobraLocker@mail2tor.com

Wallets

131fjhrB4wH8j6adZXudp1Wn23pR33tpAh

URLs

http://mail2tor2zyjdctd.onion/

Targets

- Target
  
  LegionLocker4.1.exe
- Size
  
  3.2MB
- MD5
  
  563059c1ba238fb233200b053327313d
- SHA1
  
  c50908fe140fe127a6c2168ad7a07df6b9836186
- SHA256
  
  a4e002898d11ea511868a11a43dd29011dbe97bcbd9ee4b9fbcb0520d860f975
- SHA512
  
  9bbfe87044543ecf7fc6c865fad533ce864309c63cbff070c7f69ec1373392d149628c58bc7312bf72aae2aaecd6874c5ec95542042df6f34d65570da5d810bb
Score

10^/10

discovery evasion exploit persistence ransomware spyware stealer themida trojan
- Modifies WinLogon for persistence
  persistence
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Disables Task Manager via registry modification
  evasion
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  evasion trojan
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2