Extracted

• • Target
    45.27.241.188.zip
  • Size 25.5MB
  • SHA256 a635117713d2803b77763a576b579c26ea79503704d3efad8e59eb42859bee67
  • MD5 1e26a23af6c5ff0a56841485543087b9
  • SHA1 7519922d5c41732c33e72e11154dd7325b14fda7
  • SHA512 6c2fec0ed85d4c4661844f8709b84c01b763202f1ee417fcedc82cbb329872c39d86574d7f411aafcb905c1d0f0eb08cee8246f0c7c906afad1ff71a7154b7b1
  • SSDEEP 786432:2xv/wjJb2NCG2g/tXBRjytNDiv6y4/ImD:U/4JyJ2KtRRuzDm6LgmD
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral1behavioral2
• • Target
    2025 - PASSWORD.png
  • Size 33KB
  • SHA256 82b96451cb85681e845d1d147eb7a7c57b4f3b6ae0ef43930f9210d67f0430b8
  • MD5 960555cb59374995ac8074a8bb2353d2
  • SHA1 47f14dc0ebca52907424a668e1e200f59d4013a3
  • SHA512 f92f83f43c9ab79fe85f0ccd6a7a5db43fb85b207fb72897a4f1764c8b66e43a5bf5894ba4eb6c7e6e1dc0d8d090edaab5f46f053787023eeac5d7f5b7d93222
  • SSDEEP 768:8v02/IcWKeurm06RlGlzvT5t8HmmuvF6I:8v02QcWKeurYl23
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral3behavioral4
• • Target
    Free_Apps_v3.4.7z
  • Size 25.5MB
  • SHA256 6bf1e861222fc2305b934336d45416503c33eab6552fdf73ed96b49d1641bb44
  • MD5 42e673f1e9c73c1648e06d2c3acccb4c
  • SHA1 70dac399c6998a8a76acca0937c5d556e7f0eff0
  • SHA512 3d56b81234c677337bd0a0eb01479d492980021051874acc6c86ba9a1f61455f8ec5a9d510d5f78419950e14426681c7e0bed6029789acd3297490d1ecd83e8d
  • SSDEEP 786432:yxv/wjJb2NCG2g/tXBRjytNDiv6y4/ImX:o/4JyJ2KtRRuzDm6LgmX
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  legiondiscoverydownloaderloaderstealer

  • Legion family

    legion

  • Legion, RobotDropper, Satacom

    Legion aka 'RobotDropper' or 'Satacom' is a malware downloader written in C++ and Legion stealer is written C#.

    downloaderstealerlegion

  • Executes dropped EXE

  • Loads dropped DLL

  • Blocklisted process makes network request

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral5behavioral6