ef376a11d9885a63bccb347e20be711999e63e6cd2c01c0b76e4c364b2e78b57

Sharing

Copy URL Twitter E-mail

General

Target
legionstealer.exe
Size 6.1MB
Sample261024-1ghs4set2m
SHA256 ef376a11d9885a63bccb347e20be711999e63e6cd2c01c0b76e4c364b2e78b57
MD5 702f98f64eedd69def18c80c91f77dcc
SHA1 ab1a60f60348c9c71b0235b9a923be9d0ca3fbd9
SHA512 f54e29dcd9f62cf32bbc1bc6c5d86a68a059dd621ad158704377442faa261d939a350ea239770d5377e8fcb659d8efe9116b0bc23f84dee08c4f853df92015d6
SSDEEP 98304:j+FPMJeFPMJQaFPMJ9wT7DFPMJkh75dV5RPdnmCvE/t7ZCWqrxToDqe1iSGuA+iy:Ug3V5RcJ/tVrMt4qeo9uAyJ
TLSH
T14C5622636A7BFB95F07602B525715A80D7A64E798058EFC99EE030CF1D23FA0D7091CA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  legionstealer.exe
- Size 6.1MB
- SHA256 ef376a11d9885a63bccb347e20be711999e63e6cd2c01c0b76e4c364b2e78b57
- MD5 702f98f64eedd69def18c80c91f77dcc
- SHA1 ab1a60f60348c9c71b0235b9a923be9d0ca3fbd9
- SHA512 f54e29dcd9f62cf32bbc1bc6c5d86a68a059dd621ad158704377442faa261d939a350ea239770d5377e8fcb659d8efe9116b0bc23f84dee08c4f853df92015d6
- SSDEEP 98304:j+FPMJeFPMJQaFPMJ9wT7DFPMJkh75dV5RPdnmCvE/t7ZCWqrxToDqe1iSGuA+iy:Ug3V5RcJ/tVrMt4qeo9uAyJ
- TLSH
  T14C5622636A7BFB95F07602B525715A80D7A64E798058EFC99EE030CF1D23FA0D7091CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral1
- Target
  bunifu.licensing.dll
- Size 1.3MB
- SHA256 985cf52f94bf2375372e7d3f70678f5ab76cf2764a34772e110ffe4336113df9
- MD5 e494278d822fd75a15fd50a519c92836
- SHA1 8fdf1c70cffc856e24679cfe96c24cee8cabc94d
- SHA512 eb378c7deda3df622931a3742ce706d24b2950010383d91e918ea88218a6fd8dd5ce991bdd99a7c24a6b3a9eec787c78df36e4d02d1aefaad5f91259109af7ae
- SSDEEP 24576:JbkurkdR5uuMeiPUf2lHmdpjrcbYdwcqMw5LTvBrq/WGs1xGofGUC9iu:J1roD9MeiUDDjrW4bqD5LDBrqWG0Gofn
- TLSH
  T11155F150B7F9AF26E1BEB7F56970120807F0BD979835D30C8EDA01EE1B62B848494767
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  costura.dll
- Size 4KB
- SHA256 41bb464ac7c0d192641077e44a59d7d89860c3c620a59961f2fc4a4be47deae3
- MD5 501981c7fc457d59238eb99780efb615
- SHA1 f1f25c01f6acf33bdd62c4f82d3ef078e76f0906
- SHA512 5921d0662add6c8aa075106878cc56335ccbf059d8bc7f359fe9e02a52ec657c3e5df1c718929564c09f205e4bd299b086f3e7424141f5e55ed0d756f65ee1e8
- SSDEEP 48:6F+lni2qJfjVRPGwzCo4MhTN0KDdilETrVsH4/QWk1qyFVT2IbG:7g7KedGEiYIWM2
- TLSH
  T1F791A51097A8477BE9BB0FB6ACB3534A4275FA61DC27CB2F19C562172C123180A31F72
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  costura.pdb
- Size 2KB
- SHA256 89b13aa6efbc0b04745a00bb5fcf05b7a4e3537095bde974ed3490a9cf582d17
- MD5 34b42a5776a3ad022b429124d55e576d
- SHA1 6c6000a5eaf8579850ab82a89bd6268776eb51ad
- SHA512 c24bf10e1d95a07fcd65c1f7841d2d4bdf25c5db02f5f4912286c8d6c077fe8bd3fc564cb249cb4ae01aed10889f25cc22a48bd9698499ed556560d0621a64f4
- TLSH
  T1F35193776F04C291ED9884B28513DA492B3047127602EE7AE9E51B05CCFFDF8077286B
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral4
- Target
  guna.ui.dll
- Size 876KB
- SHA256 fb23fa4fca8f28bebe7b7e39593a211cd3c3405de5f948ec520e859b1bcaf91e
- MD5 6d6a1f28978d42ad2f0a8f278eaac966
- SHA1 b09168ec88109422ca29cf4f1b6462d51930873d
- SHA512 76ddf88255a9355fc3c781880e23d94206acca4decf5623712411f7a733e91ca9ea37944860401cf9667f10e8c33a087803a4726f91faff1f23e3e0592ddf41d
- SSDEEP 12288:bXlW6JhG2lO8FbG5byJR//uXShuqO3daKScHj/mTnGS:bE6JY2sYS5GJRuHkcHqTnGS
- TLSH
  T145155B6577E4D99BC05987BA503346E86B74E004BFA7F34BD419B2AC0ECB3AB1C19943
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  jose-jwt.dll
- Size 81KB
- SHA256 a02b713b6a99cb0b3f85e9f389275bf904eee8be848b2a8c41507c64b264133a
- MD5 3932710fd1cfc829efaee90f08e74208
- SHA1 105d65bfbc12e8e9c27d6dde9484bc85e7a7f77e
- SHA512 0ecb5a5b1ab5308f6c48428e244639f8d5f9a4514f9822a92f29798b1b3e7a0d60922c93543e637abd22613643feeb18cc17cdc9e906a06bc649971e678c0715
- SSDEEP 1536:OglH/sWHgmHzzCr51o+ZpKEusq5RIH+qh7D259P5h3+F1AAy/Dc:OgyN1nK86Q7D2jPn3+F1AAyg
- TLSH
  T131832B1C3BEC4605E1FF6E79A6F053504BB5F42A7533FB5C1D80A5FE1822B828A51B62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  mono.cecil.dll
- Size 352KB
- SHA256 71c8b01208ab37a5164f5bacd69054899db9fc00f2da87dbd07dc1ee40fc06a8
- MD5 037dbbacc199b24bc0ee91f60a561f06
- SHA1 3f82ecbe123c783b24705862c066018f827355b6
- SHA512 dfa108f22e5e9250d0fdecb91317278c6212773d87b9fa36ab896c3f7a66a549da3d57f71b24778fe0727408eab89cc078f260dfd245c8738a0fe78b9c812549
- SSDEEP 6144:krsdKY7ap3A+oQ8suUmk/yC/tyPyJH+dIz1R:gpY7YuXAyPysIz
- TLSH
  T1CB748E3963EC462BE68E537BE056446E42F6DC1AB34BEB8C9DC4E6FD4C83B525500263
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  mono.cecil.mdb.dll
- Size 42KB
- SHA256 d65e445a02dc2d2a189d19745f14368c6a24d05914e36bbc7ed9732962998ea5
- MD5 a97d8b05414aaaa056d6aec577ab15a8
- SHA1 19b2a8967106dddbdb60d09d6012bae36d0d17ea
- SHA512 be05b237d8beaa52ae22a97a27280341a5eab3f88e59816c9c699ca9fe74ac22b0e5e8611cf4ddce1f13d5f8afc2153422906fe08dffc74c742529dd4358dc25
- SSDEEP 768:Yr5EYZep98C87KHeBUZwrEe9EAnlF+em5Kktn4CRIcZwMRTIzCuAtpx:Yr59g98C87KHeBUbTAnXGVXdwMRTOAtr
- TLSH
  T1AD1319156BFC8B27C29E51FEA4D226060BF19178A513FBA79EC0E5F7BC43B45450222B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  mono.cecil.mdb.pdb
- Size 18KB
- SHA256 a39544801392aa28d0061a2570e0f85c58c268fe41aa9c314d263c66878f9e66
- MD5 fadcd29d4ca06ec44e6d08a2af0ce82a
- SHA1 9c9eebb17d714ca4ac1ff6ec7b0b28ff4f90d46b
- SHA512 826b032990b09d8fc762acba1a5211f2ff17615b78d9d8c3c032371f8ab61b09e84be5286ccf5167d398423fc5dc9e6e32c7f5502839feca0a1f542eec1000f2
- SSDEEP 384:A9NdBvkE/zECNLuSY5oA/+yj7j02r6u9K2tmrNvnmBXizuXNYpkUeB8ukOVgDq/k:ABBvkE/znuSOtj7j/DF3B8uqK7g
- TLSH
  T16682A626D2C98359CB16557B9172932F63F6D1C1C58F0F0683ACAB79BCD172872A3705
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral9
- Target
  mono.cecil.pdb
- Size 182KB
- SHA256 c7f81c42b072979c73bf57731079125766252e2fa352d2763ac309aeeafdab45
- MD5 44c278b56dbb3b5aa973906678156233
- SHA1 8e69ba2487b8dc373cd39fe360e867269de9af19
- SHA512 297b73621e784dcb57f20aeeaec34183c480e9da9b27b3b92bdf67e6e78f473d470aaea296a4c6085f591af1010653ecad94503feb57d14d1e1508f385b56856
- SSDEEP 3072:j2DACw9iCUWQZQz9VldIas3I3uSZyMQ4kGeUG5svuXlTb:qD2kCUWX9NTAIeStmCvvuV
- TLSH
  T1D804080AE981B73DC6A944F6549332D22AF8928DD54F8B0563ACF235BC473287F93749
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10
- Target
  mono.cecil.pdb.dll
- Size 87KB
- SHA256 8e221211df8a917d69145239b71b71c87e61761fb0c96d5e997964c172dda4c0
- MD5 358ee793e3f5139ec1f835f0cf306baf
- SHA1 be0a3453276ae078d66eebed4f3516f246805cef
- SHA512 b48a78e55573c29ea925138753f4996309929cf1ada435e1c88ae3b9f97b13eaaccb2e756f929b341ab9110204f85b5d024e65364e023e286fe2f8e50c7d712c
- SSDEEP 1536:ifCEVETXo3f+yAvaDvNaPS/vSC6GOALYKXgAJGsZAhcbcvjCXej:kuiQPwvH6rArVJGXh+cveXej
- TLSH
  T196938D35E798672AE5DD797628A60D050BF1D2B9C153A70E4A84FEF83E0B7121973383
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  mono.cecil.pdb.pdb
- Size 26KB
- SHA256 e21e21ea1417f9f488311c39778afaa1666d5ae3176a595d7ff27c84cef86f90
- MD5 62455ea634b851e6c1caf5507ff144ab
- SHA1 5fe276894dd8622a389e503cacccbe8ad89ae0cc
- SHA512 4319a24c0ebe4b6926c06775fd518e961458d00f06a631926a9fea44c5f148bca48360aa250340b23cd90b97c4bec74496afa44d516f1b543f7b12ea594858d1
- SSDEEP 384:Rt7ZdhNC72Xtqp5dZ+li1NjEOsG0TSLJdTWhmtBsqMK13BwzCsLWpOyesLiRQkef:RR/CWwZtjDsGGQdcmUK1ohsuU
- TLSH
  T1DBC27222E6F4C628C936873D81B74322BBF4C189A7074B0B13ACF37D69977686D83655
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral12
- Target
  mono.cecil.rocks.dll
- Size 29KB
- SHA256 9db3edaa8bc6ccd7ac6e2517c743591658bd6bdd436a146e0eda101d30a1332e
- MD5 6fcdf77e1f173f269ff56752f273f094
- SHA1 d9d26753c23fab955bb20289a20e37a1812888dc
- SHA512 84f87537685ff55a681bf2acb4e35f77ea6ef3afc3cfb6257b7a72a62ba7f27e6a580fda89ddde2d8f9c22cce6a94622b58fe344d8fa52ff163d7cbc7d7a1804
- SSDEEP 768:7gVxLIKwiowt0j1KODTq7/hRssvewJ1pfFpFo:s/6wtm1J3Wjssvew3o
- TLSH
  T11AD22A0217A6CF3BC1EF5D7AB8F2132801B1C6863003DB664DCCA2E9694BB955B613E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  mono.cecil.rocks.pdb
- Size 9KB
- SHA256 dfd4428bc7cc44796355de0b7baa65ce8ea7ecda5c75131e2a65a279000f9207
- MD5 f20f8df203d6bf60baf93b1673ef77b3
- SHA1 4a2620ee8eadb5e8aba6905ea4f769ba30c52ae0
- SHA512 62fb132eb7d0a84d6f5d15ab2a12739d36976e9e4017c713c986cfbbc0992fa04ebc0f477ff22dbdc29baf4e85b86049e50974d88a3ea749882b8e8aaa7a1216
- SSDEEP 192:+3GYL4JSGEMUm10L6Nn5MNMtT9RS68Y4h0BKld9Mi0DEyKKJ2VjF+n:EnySGERN+9R7Qh0BKp7040AFa
- TLSH
  T1AF129107F8FC8F5DC98A09B9D163531977B0C60CD30A0B1492A6F635ED873A927B27A0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral14
- Target
  siticone.ui.dll
- Size 1.3MB
- SHA256 27c56a28cbde094157206da1bfcd7a395111ab97b8a5ff600b11c2175dcefb26
- MD5 750c58af2e56b6addecffcf152520ab8
- SHA1 14995e7f1d12498606d9d209d78d55fe6fd87802
- SHA512 2179790e23f61b3dfea828457f8609279c70b1e071cddc73b1dbda02caa664e0aae2553fc24a4956f9e89c477d66b1a704bde26fa23bc6db26c19e18db00abb5
- SSDEEP 24576:QVMCtIZJntOFmMlMqPilaiS4Yr6ugPngPfjv9tLF2cH8gb:u8NlaVeuHFb
- TLSH
  T1B755074433E09AABE406E77EA0A303657774E1087B56F31745B4927CBED372B4D09A2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  system.diagnostics.diagnosticsource.dll
- Size 34KB
- SHA256 d22133818a30313e0becf010d78a556a56b34ea361dbd33588c9817631fed540
- MD5 8d9df432109f1cfdd86723b5f171e3d7
- SHA1 85dc92edd4b0049ed9049e075c4def8a3d64e43b
- SHA512 5c83303934eecfa61c43a071d29c98e5804d37a5dc7f7b035772d6a168b0c5e65dfabef20b46214e65493c4bda44831cafee83615498fbe9e718c884f4650edf
- SSDEEP 384:iQobG82oiaPaf/gn5LQ0+0zdQUv2CtyW8fiFISWbW9pWJbWivT1Nq0GftpBjAvnC:nA299fI5dxzL2CC11vimvnEBBNFT
- TLSH
  T145F25B54EBAC8953DEE71D3062A4D9423A3AEB936C10C25E2699E18D0D83BD1EB11737
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  vestris.resourcelib.dll
- Size 76KB
- SHA256 7da3f0e77c4dddc82df7c16c8c781fade599b7c91e3d32eefbce215b8f06b12a
- MD5 944ce5123c94c66a50376e7b37e3a6a6
- SHA1 a1936ac79c987a5ba47ca3d023f740401f73529b
- SHA512 4c034ff51cc01567f3cb0796575528ca44623b864eb606266bcf955a9259ed26b20bec0086d79038158d3a5af2ada0a90f59d7c6aae9e545294fe77825dbe08b
- SSDEEP 1536:CSSYikTF0Z+sFGu11tIcyI1MtI9eDG3fL7:CJYD0Z9FGu11teI1r9ea3
- TLSH
  T13B731C1C977C8BE6C2FE06B9B422190667F0C706F22FE75EDDC8A4E97C957920612193
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Contacts third-party web service commonly abused for C2

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17