New Legion Loader Delivers a Variety of Malware

guest · Dec 19, 2019

New Legion Loader Delivers a Variety of Malware
December 19, 2019
https://www.securityweek.com/new-legion-loader-delivers-variety-malware

Legion Loader is a new dropper that is already in wide use. It is distinctive by the wide range of malware it has been seen to drop, and its continuing development. The implication is that it is available for hire as part of the burgeoning malware-as-a-service black market. [...] -- Legion is already known to drop a wide range of malware.

A Legion campaign has been detected, and the dropper used has been analyzed by researchers at Deep Instinct. The analysis was 'fairly straightforward': although it includes several sandbox and research tool evasions, it lacks string obfuscation.
They do not give any indication of how Legion is initially installed on the victim, but rather describe what it does. The targets currently appear to be largely in the U.S. and Europe.

Every dropper is designed to deliver 2-3 additional malwares, and includes a built-in fileless crypto currency stealer and browser credential harvester.
Click to expand...

It is too early to know how widely Legion will be adopted by the criminal fraternity in the future, but the range of malware it has been seen to drop suggests that it has not been developed by a criminal gang to deliver a particular malware, but is designed to offer a service to deliver malware of choice.
Click to expand...

Deep Instinct: Untangling Legion Loader’s Hornet Nest of Malware

Log in or Sign up

New Legion Loader Delivers a Variety of Malware

guest Guest

Log in or Sign up

New Legion Loader Delivers a Variety of Malware

guest Guest

Useful Searches