Overview

overview

10

Static

static

10

2c5266c105...30.exe

windows7_x64

10

2c5266c105...30.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2c5266c1053b343bcbd38d7bbfbf4a3b0be3d40b8f57320bed91b5ac26dacf30

  • Size

    1.5MB

  • Sample

    220614-241g4shdfk

  • MD5

    5ee1227e20fe723538b50b7025ee546e

  • SHA1

    21bdb503540c936fe3d0e5a06b8505f8aaaf9f28

  • SHA256

    2c5266c1053b343bcbd38d7bbfbf4a3b0be3d40b8f57320bed91b5ac26dacf30

  • SHA512

    0804de2124b34e627541d2485670af87bafc3418b90546d252d6379d37059635b4fadb27c83f0eebaa50f001bcdac215f217d095ac8c1eded971dab753b89e08

Score
10/10
legiondownloaderevasionsuricata

Malware Config

Targets

    • Target

      2c5266c1053b343bcbd38d7bbfbf4a3b0be3d40b8f57320bed91b5ac26dacf30

    • Size

      1.5MB

    • MD5

      5ee1227e20fe723538b50b7025ee546e

    • SHA1

      21bdb503540c936fe3d0e5a06b8505f8aaaf9f28

    • SHA256

      2c5266c1053b343bcbd38d7bbfbf4a3b0be3d40b8f57320bed91b5ac26dacf30

    • SHA512

      0804de2124b34e627541d2485670af87bafc3418b90546d252d6379d37059635b4fadb27c83f0eebaa50f001bcdac215f217d095ac8c1eded971dab753b89e08

    Score
    10/10
    evasionsuricata

    • suricata: ET MALWARE APT-C-23 Activity (GET)

      suricata: ET MALWARE APT-C-23 Activity (GET)

      suricata

    • suricata: ET MALWARE Legion Loader Activity Observed (suspira)

      suricata: ET MALWARE Legion Loader Activity Observed (suspira)

      suricata

    • suricata: ET MALWARE Possible Malicious Macro DL EXE Feb 2016

      suricata: ET MALWARE Possible Malicious Macro DL EXE Feb 2016

      suricata

    • suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

      suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

      suricata

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Looks for VMWare Tools registry key

      evasion
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks