Extracted

Extracted

• • Target
    __x64___setup___x32__/setup.msi
  • Size 34.8MB
  • SHA256 d9324c156a90b828e3f110a871b6eca08bb6251fc34dcb8b570c05f48a6b642d
  • MD5 1086315ee22b1c20eb4aa7a57cbb8b6b
  • SHA1 1c734fc3f48e355a438cfed270f927b3922ef0ac
  • SHA512 f6fdfd4751e9b717b7acef31973e34219d2c1e49869b956c27f2a675461ad70b4d727fefb8dba5910954ef8012232913e79549acaa75558015e4de24ee804c05
  • SSDEEP 786432:wqqRkI57hVSZmlNdonqUuhGMCiEIS/vTis1Mscz:wq+T57jSZmGnqUezSTtqz
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  discoverypersistenceprivilege_escalationlegionrhadamanthyscredential_accessdownloaderexecutionloaderstealer

  • Legion family

    legion

  • Legion, RobotDropper, Satacom

    Legion aka 'RobotDropper' or 'Satacom' is a malware downloader written in C++ and Legion stealer is written C#.

    downloaderstealerlegion

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • Rhadamanthys family

    rhadamanthys

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Blocklisted process makes network request

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3