legion | f12736051e4df3d70a26da397ab6b5f7b54f8de9ffec759afb99a91b59568019 | Triage

Submit
Reports

Overview

overview

Static

static

5

malware.exe

windows10-ltsc 2021-x64

malware.exe

windows11-21h2-x64

Sharing

General

Target

malware.exe
Size

7.3MB
Sample

241121-lvftcazhqd
MD5

11d9aaa73cc74c7fab4a59ddb06a167c
SHA1

f831c54a7ab079fad39e78ed331d8043f703b3b7
SHA256

f12736051e4df3d70a26da397ab6b5f7b54f8de9ffec759afb99a91b59568019
SHA512

076c24988ea3ad1a9f4bcd40e461010f73b96b71812e36646d77a379bde7314c46a81beb84ba73fff2e264c723c9aeee12588c9e66595acb5ccf8680bea031d4
SSDEEP

196608:CUKvea9kMvSU7rBoI5HV2xzm478B27oynUV1l46w:Cfve25p350pm68EXoP

Score

10^/10

legion discovery downloader loader stealer upx

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

malware.exe

Resource

win10ltsc2021-20241023-en

legion discovery downloader loader stealer upx

windows10-ltsc 2021-x64

7 signatures

60 seconds

Behavioral task

behavioral2

Sample

malware.exe

Resource

win11-20241007-en

legion discovery downloader loader stealer upx

windows11-21h2-x64

7 signatures

60 seconds

Malware Config

Extracted

Family

legion

C2

dns-beast.com

Attributes

url_paths
test_gate0117.php

gate2.php?a=

error.php?text=
user_agent
Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko

Targets

- Target
  
  malware.exe
- Size
  
  7.3MB
- MD5
  
  11d9aaa73cc74c7fab4a59ddb06a167c
- SHA1
  
  f831c54a7ab079fad39e78ed331d8043f703b3b7
- SHA256
  
  f12736051e4df3d70a26da397ab6b5f7b54f8de9ffec759afb99a91b59568019
- SHA512
  
  076c24988ea3ad1a9f4bcd40e461010f73b96b71812e36646d77a379bde7314c46a81beb84ba73fff2e264c723c9aeee12588c9e66595acb5ccf8680bea031d4
- SSDEEP
  
  196608:CUKvea9kMvSU7rBoI5HV2xzm478B27oynUV1l46w:Cfve25p350pm68EXoP
Score

10^/10

legion discovery downloader loader stealer upx
- Legion family
  legion
- Legion, RobotDropper, Satacom
  Legion aka 'RobotDropper' or 'Satacom' is a malware downloader written in C++ and Legion stealer is written C#.
  downloader stealer legion
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

legiondiscoverydownloaderloaderstealerupx

behavioral2

legiondiscoverydownloaderloaderstealerupx

© 2018-2025

Terms | Privacy

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.