Extracted

• • Target

    d103074755792906a0aab038103444e3_JaffaCakes118

  • Size

    184KB

  • MD5

    d103074755792906a0aab038103444e3

  • SHA1

    ffb8d5a1d2d3dda1fa013168017bd833aaa28064

  • SHA256

    2b61b3b00aa5d548e41dc305cb1271c26dc387601a7a7cdb63600b49c270bb30

  • SHA512

    30be12dba187e19d797e6a5b502185ac37848ef80e9431e0cfb98c4b64c104f122fa2101538a0805513b7658bc8585a31ce0a8f00b725f33b8f70645e82e4660

  • SSDEEP

    3072:oUZF2pKMp8r2+6LqAlkNQu2BaYP138oC2C5L:PZF2jpwARBsXL

  Score

  10^/10

  discoverylegiondownloaderexecutionstealer

  • Legion

    Legion is a malware downloader written in C++ and stealer written C#.

    downloaderstealerlegion

  • Legion downloader

    Detected Legion downloader HTTP request code and PowerShell execution.

    downloader

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2