Extracted

• • Target
    Setup.exe
  • Size 1.4MB
  • SHA256 d4a0fe56316a2c45b9ba9ac1005363309a3edc7acf9e4df64d326a0ff273e80f
  • MD5 68f9b52895f4d34e74112f3129b3b00d
  • SHA1 c5e2018bf7c0f314fed4fd7fe7e69fa2e648359e
  • SHA512 1cd875f9d0301b14645ea608fe61560a229ee395fa061f32675c3d84e41916998f887278d8497a5e875be22ba8fcbcfcbd878a5e2ed1746dc75430b7aed5fede
  • SSDEEP 24576:fsmjNvgp+pxECAucO9iWFT0z7rLuUhFP3MGX:PFgpAiIiWdzUz35X
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  legiondiscoverydownloaderloaderstealer

  • Legion, RobotDropper, Satacom

    Legion aka 'RobotDropper' or 'Satacom' is a malware downloader written in C++ and Legion stealer is written C#.

    downloaderstealerlegion

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    plugins/NetworkTools.dll
  • Size 844KB
  • SHA256 6f0a1df27838aaedfd8ceb6eb670b01a3a8ca398960fad661451bf605a23f5a7
  • MD5 9142efa8e5b6fa9c95229d8c217b9211
  • SHA1 9ad24a90b73d274731b44724816d461c9f36a202
  • SHA512 6936f09fff7e2c89c46d7561f6acc6de0a3781e18c2b98313b0eb82b777ceeb12123ad2b7e54a9a40ab4149d6f5011b172e8046d61f69a416acd33482710f3b0
  • SSDEEP 12288:nWGTBYmTAvj6JJ9vuCGgDiBLIG78Kkz82azvCtyAvsEUE5XVNPvOZFn6T8XTWJ/Y:WGTB1TrjD/SeGVqqClScz
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  legiondiscoverydownloaderloaderstealer

  • Legion, RobotDropper, Satacom

    Legion aka 'RobotDropper' or 'Satacom' is a malware downloader written in C++ and Legion stealer is written C#.

    downloaderstealerlegion

  • Suspicious use of SetThreadContext

  behavioral3behavioral4