Overview
overview
10Static
static
10LegionStea...der.js
windows7-x64
3LegionStea...der.js
windows10-2004-x64
3LegionStea...ts.vbs
windows7-x64
1LegionStea...ts.vbs
windows10-2004-x64
1LegionStea...ts.vbs
windows7-x64
1LegionStea...ts.vbs
windows10-2004-x64
1LegionStea...m1.vbs
windows7-x64
1LegionStea...m1.vbs
windows10-2004-x64
1LegionStea...ral.js
windows7-x64
3LegionStea...ral.js
windows10-2004-x64
3LegionStea...al.vbs
windows7-x64
1LegionStea...al.vbs
windows10-2004-x64
1LegionStea...in.vbs
windows7-x64
1LegionStea...in.vbs
windows10-2004-x64
1LegionStea...der.js
windows7-x64
3LegionStea...der.js
windows10-2004-x64
3LegionStea...er.vbs
windows7-x64
1LegionStea...er.vbs
windows10-2004-x64
1LegionStea...es.vbs
windows7-x64
1LegionStea...es.vbs
windows10-2004-x64
1LegionStea...ver.js
windows7-x64
3LegionStea...ver.js
windows10-2004-x64
3LegionStea...er.vbs
windows7-x64
1LegionStea...er.vbs
windows10-2004-x64
1LegionStea...lby.js
windows7-x64
3LegionStea...lby.js
windows10-2004-x64
3LegionStea...by.vbs
windows7-x64
1LegionStea...by.vbs
windows10-2004-x64
1LegionStea...er.exe
windows7-x64
3LegionStea...er.exe
windows10-2004-x64
3LegionStea...er.exe
windows7-x64
3LegionStea...er.exe
windows10-2004-x64
3Analysis
-
max time kernel
144s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
04-11-2024 18:34
Behavioral task
behavioral1
Sample
LegionStealer V1 SRC/Builder.js
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
LegionStealer V1 SRC/Builder.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
LegionStealer V1 SRC/Exploits.vbs
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
LegionStealer V1 SRC/Exploits.vbs
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
LegionStealer V1 SRC/Exploits.vbs
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
LegionStealer V1 SRC/Exploits.vbs
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
LegionStealer V1 SRC/Form1.vbs
Resource
win7-20241010-en
Behavioral task
behavioral8
Sample
LegionStealer V1 SRC/Form1.vbs
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
LegionStealer V1 SRC/General.js
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
LegionStealer V1 SRC/General.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
LegionStealer V1 SRC/General.vbs
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
LegionStealer V1 SRC/General.vbs
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
LegionStealer V1 SRC/Main.vbs
Resource
win7-20241010-en
Behavioral task
behavioral14
Sample
LegionStealer V1 SRC/Main.vbs
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
LegionStealer V1 SRC/NewBuilder.js
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
LegionStealer V1 SRC/NewBuilder.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
LegionStealer V1 SRC/Properties/Resources.Designer.vbs
Resource
win7-20241010-en
Behavioral task
behavioral18
Sample
LegionStealer V1 SRC/Properties/Resources.Designer.vbs
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
LegionStealer V1 SRC/Properties/Resources.vbs
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
LegionStealer V1 SRC/Properties/Resources.vbs
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
LegionStealer V1 SRC/Sver.js
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
LegionStealer V1 SRC/Sver.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
LegionStealer V1 SRC/Sver.vbs
Resource
win7-20241010-en
Behavioral task
behavioral24
Sample
LegionStealer V1 SRC/Sver.vbs
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
LegionStealer V1 SRC/asamlby.js
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
LegionStealer V1 SRC/asamlby.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
LegionStealer V1 SRC/asamlby.vbs
Resource
win7-20240729-en
Behavioral task
behavioral28
Sample
LegionStealer V1 SRC/asamlby.vbs
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
LegionStealer V1 SRC/bin/Debug/My_Stealer_l3gion/legionstealer.exe
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
LegionStealer V1 SRC/bin/Debug/My_Stealer_l3gion/legionstealer.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
LegionStealer V1 SRC/bin/Debug/legionstealer.exe
Resource
win7-20240729-en
Behavioral task
behavioral32
Sample
LegionStealer V1 SRC/bin/Debug/legionstealer.exe
Resource
win10v2004-20241007-en
General
-
Target
LegionStealer V1 SRC/bin/Debug/My_Stealer_l3gion/legionstealer.exe
-
Size
6.1MB
-
MD5
7681c2bf57c7ef0640195a82333a90b5
-
SHA1
e6ed571b3118c389afa844bcd432623aeba85aef
-
SHA256
ec726f4d9f821c282198ab703a469e6f3eaa4e73517eef344b9aab6a3daacbbc
-
SHA512
106abcdc8acd1bc882d4501367074d9c6282e341272f336749f523cb5427fb7a6b310fafa79ddc2b10906df011253944d0d71f6625ab0ce314666b5d9d83cd8e
-
SSDEEP
98304:s+FPMJeFPMJcaFPMJ9wT7DFPMJkhzHdV5RPdnmCvE/t7ZCWqrxToDqk14SGuA+iO:1gxV5RsJ/tVrMt4qkq9uAmf
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language legionstealer.exe