legion | 2b61b3b00aa5d548e41dc305cb1271c26dc387601a7a7cdb63600b49c270bb30

Reason

config extraction: missing cfgextr callback for rule "legion_loader"

General

Target
2b61b3b00aa5d548e41dc305cb1271c26dc387601a7a7cdb63600b49c270bb30
Size 184KB
Sample220615-cvcl9agefn
SHA256 2b61b3b00aa5d548e41dc305cb1271c26dc387601a7a7cdb63600b49c270bb30
MD5 d103074755792906a0aab038103444e3
SHA1 ffb8d5a1d2d3dda1fa013168017bd833aaa28064
SHA512 30be12dba187e19d797e6a5b502185ac37848ef80e9431e0cfb98c4b64c104f122fa2101538a0805513b7658bc8585a31ce0a8f00b725f33b8f70645e82e4660
SSDEEP 3072:oUZF2pKMp8r2+6LqAlkNQu2BaYP138oC2C5L:PZF2jpwARBsXL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

downloader legion

Malware Config

Signatures

Legion downloader 1 IoCs

Detected Legion downloader HTTP request code and PowerShell execution.

downloader

resource	yara_rule
sample	legion_downloader

Legion family
legion

File Explorer

2b61b3b00aa5d548e41dc305cb1271c26dc387601a7a7cdb63600b49c270bb30

.exe 184KB

2b61b3b00aa5d548e41dc305cb1271c26dc387601a7a7cdb63600b49c270bb30

IMPHASH 16a80e323bb12dca5944a63e26c95aab
SHA256 2b61b3b00aa5d548e41dc305cb1271c26dc387601a7a7cdb63600b49c270bb30
MD5 d103074755792906a0aab038103444e3
SHA1 ffb8d5a1d2d3dda1fa013168017bd833aaa28064
SHA512 30be12dba187e19d797e6a5b502185ac37848ef80e9431e0cfb98c4b64c104f122fa2101538a0805513b7658bc8585a31ce0a8f00b725f33b8f70645e82e4660
SSDEEP 3072:oUZF2pKMp8r2+6LqAlkNQu2BaYP138oC2C5L:PZF2jpwARBsXL
MD5 SHA1 SHA512 SSDEEP

windows x86

Legion downloader

Detected Legion downloader HTTP request code and PowerShell execution.

downloader

Minor OS version

Major OS version

Entry point

13239

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

Sleep CloseHandle ExitProcess GetProcessHeap CreateProcessA GetCurrentDirectoryA LoadLibraryA GetProcAddress CreateFileW DecodePointer GetModuleHandleA GetConsoleCP FlushFileBuffers HeapReAlloc HeapSize SetFilePointerEx GetStringTypeW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte MultiByteToWideChar GetCommandLineW GetCommandLineA GetCPInfo VirtualProtect GetConsoleMode GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose LCMapStringW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwind RaiseException GetLastError SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile HeapFree HeapAlloc GetFileType WriteConsoleW

user32

PostQuitMessage EndPaint UpdateWindow GetDesktopWindow BeginPaint LoadIconA GetWindowRect LoadCursorA DestroyWindow CreateWindowExW EndDialog DialogBoxParamA RegisterClassExW LoadStringW ShowWindow DefWindowProcA

advapi32

RegGetValueA

wininet

InternetOpenW HttpSendRequestW InternetCloseHandle InternetConnectW InternetReadFile HttpOpenRequestW

Sharing

Errors