legion | 3933da33446b776c22ea0e84b7cc3e93a122be7960985231027a3be80a068759

Reason

config extraction: missing cfgextr callback for rule "legion_loader"

General

Target
3933da33446b776c22ea0e84b7cc3e93a122be7960985231027a3be80a068759
Size 1.8MB
Sample220625-vw4fgafdb5
SHA256 3933da33446b776c22ea0e84b7cc3e93a122be7960985231027a3be80a068759
MD5 b826bb2b62dab956a48a12d4e27ea3a5
SHA1 b3dfdb88640cfad86d42d7f65bc70fb7831076c0
SHA512 c15233dedf2fc24de8d8f5f01c63e98a2844c18303dc3b10528e1441067c1b1f85a32f417027ea90a7f4c82764cf2a53482300e8af54a4055c0cfa4c713c2c03
SSDEEP 24576:AaOFh+ds0PWjESh0K/4UGz72So29Ps9cbGG8BS9BExfmnrthH3NVKsKvKkjm/Bq:EhiPcN/45z7p9PgYGG8BQBCqnNyKbBq
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

downloader legion

Malware Config

Signatures

Legion downloader 1 IoCs

Detected Legion downloader HTTP request code and PowerShell execution.

downloader

resource	yara_rule
sample	legion_downloader

Legion family
legion

File Explorer

3933da33446b776c22ea0e84b7cc3e93a122be7960985231027a3be80a068759

.exe 1.8MB

3933da33446b776c22ea0e84b7cc3e93a122be7960985231027a3be80a068759

IMPHASH 413763809bdc0d508632e00585bd725e
SHA256 3933da33446b776c22ea0e84b7cc3e93a122be7960985231027a3be80a068759
MD5 b826bb2b62dab956a48a12d4e27ea3a5
SHA1 b3dfdb88640cfad86d42d7f65bc70fb7831076c0
SHA512 c15233dedf2fc24de8d8f5f01c63e98a2844c18303dc3b10528e1441067c1b1f85a32f417027ea90a7f4c82764cf2a53482300e8af54a4055c0cfa4c713c2c03
SSDEEP 24576:AaOFh+ds0PWjESh0K/4UGz72So29Ps9cbGG8BS9BExfmnrthH3NVKsKvKkjm/Bq:EhiPcN/45z7p9PgYGG8BQBCqnNyKbBq
MD5 SHA1 SHA512 SSDEEP

windows x86

Legion downloader

Detected Legion downloader HTTP request code and PowerShell execution.

downloader

Minor OS version

Major OS version

Entry point

13287

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateToolhelp32Snapshot Sleep Process32Next CloseHandle ExitProcess GetProcessHeap lstrcmpiA CreateProcessA GetCurrentDirectoryA LoadLibraryA GetProcAddress CreateFileW DecodePointer GetConsoleMode GetConsoleCP FlushFileBuffers HeapReAlloc HeapSize SetFilePointerEx GetStringTypeW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte MultiByteToWideChar GetCommandLineW Process32First GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwind RaiseException GetLastError SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile HeapFree HeapAlloc GetFileType LCMapStringW WriteConsoleW

user32

LoadIconA EndPaint UpdateWindow PostQuitMessage BeginPaint LoadCursorA DestroyWindow CreateWindowExW EndDialog DialogBoxParamA RegisterClassExW LoadStringW ShowWindow DefWindowProcA

advapi32

RegGetValueA

wininet

InternetOpenW HttpSendRequestW InternetCloseHandle InternetConnectW InternetReadFile HttpOpenRequestW

Sharing

Errors