legionlocker | 9e3e436d4345c5b6f20bc060d766a7ee0c3ea8c4aebee80d0cfe3481515961a1

General

Target
9e3e436d4345c5b6f20bc060d766a7ee0c3ea8c4aebee80d0cfe3481515961a1
Size 3.2MB
Sample220206-2ebgpacdhn
SHA256 9e3e436d4345c5b6f20bc060d766a7ee0c3ea8c4aebee80d0cfe3481515961a1
MD5 faeaf4e3d7440fba8482c97cf510baa7
SHA1 6f69dc27f9c3f6fa6d3134cceddaab9d2888bf91
SHA512 7433a18a2b5b75b8faa8aed88c07bc264b034de048b6aa7063b33758d97e74477226b378905979c2cbaad552cff5df5a9fc136a417e53b2694356b003e700411
SSDEEP 98304:YdCLls4QRa0lgBYPjZc0MycNidipvd6b9MOOH+8CK21lIG1:rsN+0H0idip16JDOiV1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ransomware legionlocker

Malware Config

Signatures

Detected LegionLocker ransomware 1 IoCs

Sample contains strings associated with the LegionLocker family.

ransomware

resource	yara_rule
static1/unpack001/LegionLocker.bin	family_legionlocker

Legionlocker family
legionlocker

File Explorer

9e3e436d4345c5b6f20bc060d766a7ee0c3ea8c4aebee80d0cfe3481515961a1

.zip 3.2MB
LegionLocker.bin

.exe 3.4MB

9e3e436d4345c5b6f20bc060d766a7ee0c3ea8c4aebee80d0cfe3481515961a1

SHA256 9e3e436d4345c5b6f20bc060d766a7ee0c3ea8c4aebee80d0cfe3481515961a1
MD5 faeaf4e3d7440fba8482c97cf510baa7
SHA1 6f69dc27f9c3f6fa6d3134cceddaab9d2888bf91
SHA512 7433a18a2b5b75b8faa8aed88c07bc264b034de048b6aa7063b33758d97e74477226b378905979c2cbaad552cff5df5a9fc136a417e53b2694356b003e700411
SSDEEP 98304:YdCLls4QRa0lgBYPjZc0MycNidipvd6b9MOOH+8CK21lIG1:rsN+0H0idip16JDOiV1
MD5 SHA1 SHA512 SSDEEP

Password

infected

LegionLocker.bin

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 9d13fde85da13d3c9533ace39fdfb71c95419f002c946265e6d12030890d8b9d
MD5 ff781960baad7ac1974e254bbc7d8044
SHA1 263450e71b84d608d40448c73add2719875c4732
SHA512 fc572d058d0c4782621d069cc9d16b575363bdd51a3d50bedc4b91b12c0e6ac6d93256ae9266c5cac17878dd0da474477bc283735e8d4decf206e68150495d8a
SSDEEP 49152:ejomCybGTNoWwh3ZlhPIKdAIaCGhr/izxNoUuQzKDVwS3jiXsSHv:GCyQNM7Xbqx2fzKx3W8m
MD5 SHA1 SHA512 SSDEEP

windows x86

Detected LegionLocker ransomware

Sample contains strings associated with the LegionLocker family.

ransomware

Minor OS version

Major OS version

Entry point

3488554

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Sharing