Overview

overview

10

Static

static

10

legionstealer.exe

windows10-1703-x64

10

legionstealer.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    legionstealer.exe

  • Size

    4.5MB

  • Sample

    241025-de55astfpq

  • MD5

    3fb902d7bebd886d73671bbfad1f6aaa

  • SHA1

    6acfbe5dadceb210f6fe2cee04589e10bc5efbc8

  • SHA256

    95ffadb2749e8aafb5d4d96a33ca7f1e62c20448b556f616ace2796fc60f1431

  • SHA512

    8cbbc2ba84977cb7689cb573988c3ce72203f03438178a1b05415c919a8345ee76352af1e8a13ebf16e7402ef19a6c0521b8fa55c845d9b8fb85688b9c5995e6

  • SSDEEP

    98304:D0FPMJ2FPMJcaFPMJ9wT7DFPMJkhzHdV5RPdnASGuA+i1iK8Po:6gxV5Rm9uAmfw

Score
10/10
neshtadiscoverypersistencespywarestealer

Malware Config

Targets

    • Target

      legionstealer.exe

    • Size

      4.5MB

    • MD5

      3fb902d7bebd886d73671bbfad1f6aaa

    • SHA1

      6acfbe5dadceb210f6fe2cee04589e10bc5efbc8

    • SHA256

      95ffadb2749e8aafb5d4d96a33ca7f1e62c20448b556f616ace2796fc60f1431

    • SHA512

      8cbbc2ba84977cb7689cb573988c3ce72203f03438178a1b05415c919a8345ee76352af1e8a13ebf16e7402ef19a6c0521b8fa55c845d9b8fb85688b9c5995e6

    • SSDEEP

      98304:D0FPMJ2FPMJcaFPMJ9wT7DFPMJkhzHdV5RPdnASGuA+i1iK8Po:6gxV5Rm9uAmfw

    Score
    10/10
    neshtadiscoverypersistencespywarestealer

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks