Untangling Legion Loader's Hornet Nest of Malware
released on 2019-12-20 @ 07:41:25 PM
Analysis of the dropper and the campaign it is associated with, revealed it involves multiple types of malware. The quantity and variety of which, earned its reference as a "Hornet's Nest".
Included in this campaign is a grab-bag mix of multiple types of info-stealers, backdoors, a file-less crypto-currency stealer built into the dropper, and occasionally a crypto-miner as well. Such volume and variety are uncommon in the general landscape and are highly suggestive of a dropper-for-hire campaign.