Extracted

• • Target

    malware.exe

  • Size

    7.3MB

  • MD5

    11d9aaa73cc74c7fab4a59ddb06a167c

  • SHA1

    f831c54a7ab079fad39e78ed331d8043f703b3b7

  • SHA256

    f12736051e4df3d70a26da397ab6b5f7b54f8de9ffec759afb99a91b59568019

  • SHA512

    076c24988ea3ad1a9f4bcd40e461010f73b96b71812e36646d77a379bde7314c46a81beb84ba73fff2e264c723c9aeee12588c9e66595acb5ccf8680bea031d4

  • SSDEEP

    196608:CUKvea9kMvSU7rBoI5HV2xzm478B27oynUV1l46w:Cfve25p350pm68EXoP

  Score

  10^/10

  upxlegiondiscoverydownloaderloaderstealer

  • Legion family

    legion

  • Legion, RobotDropper, Satacom

    Legion aka 'RobotDropper' or 'Satacom' is a malware downloader written in C++ and Legion stealer is written C#.

    downloaderstealerlegion

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2