General

  • Target

    Legion Exec.zip

  • Size

    62.5MB

  • MD5

    e42ca35bfb59552441a41e1aee1df4dc

  • SHA1

    23f57f7c1c420b8ce123504af66d32247526d65e

  • SHA256

    ebd95187a1deb99bded54ff493b38081c0f4da90c5b2363cdb2f61ce7e74eb9a

  • SHA512

    4479a45bca6faf0415aed1c72e83102f2e637577725a31d038b5f01069e333610faeb57eda3635debf63828b8a410b386ecde189345303c5d459d1590d105fc0

  • SSDEEP

    1572864:xX6uBGcoPKPD13IyQAvOkNjDYvKNnXi74nPK6tD:4+GhKrF5TxvFXDtD

Score
3/10

Malware Config

Signatures

  • Embeds OpenSSL 1 IoCs

    Embeds OpenSSL, may be used to circumvent TLS interception.

  • Unsigned PE 7 IoCs

    Checks for missing Authenticode signature.

Files

  • Legion Exec.zip
    .zip
  • Legion Exec/ForlornApi.dll
    .dll windows:4 windows x64 arch:x64


    Headers

    Sections

  • Legion Exec/InternalX.exe
    .exe windows:6 windows x64 arch:x64

    753845d2c9ef7d478e4225bf1d78584a


    Headers

    Imports

    Exports

    Sections

  • Legion Exec/bin/ForlornInject.dll
    .dll windows:6 windows x64 arch:x64

    dc5ffe84bd3b4405ea83f693b055c515


    Headers

    Imports

    Exports

    Sections

  • Legion Exec/bin/libcrypto-3-x64.dll
    .dll windows:6 windows x64 arch:x64

    680b5c239d82da8e527bf24b921948fd


    Headers

    Imports

    Exports

    Sections

  • Legion Exec/bin/libssl-3-x64.dll
    .dll windows:6 windows x64 arch:x64

    b14ebe784f458189a17382fee793f658


    Headers

    Imports

    Exports

    Sections

  • Legion Exec/bin/xxhash.dll
    .dll windows:6 windows x64 arch:x64

    fba6b233846a2ea5e6907e23b2de9a26


    Headers

    Imports

    Exports

    Sections

  • Legion Exec/bin/zstd.dll
    .dll windows:6 windows x64 arch:x64

    f32e8587cacdf9095c309b87f2877ebb


    Headers

    Imports

    Exports

    Sections

  • Legion Exec/runtimes/win-x64/native/WebView2Loader.dll
    .dll windows:10 windows x64 arch:x64

    f6946d311bccc86e2042a388e375de41


    Code Sign

    Headers

    Imports

    Exports

    Sections