General

  • Target

    penis.exe

  • Size

    18.2MB

  • MD5

    7d4d56acb60cdedb31c8aa44be15e0d4

  • SHA1

    3df1e1f5f56ac8831f4ff686ad5c901eb03057ed

  • SHA256

    e2dae09576faee6f95557bc2637816f14d612c38a4d4efd0f22200b026fd66f6

  • SHA512

    40495802422bb4b54838ff73e34650f68762da2bc5630a2fe97cb220c23550d6d805bc1b45734c50aed8aaa73c7ab2ae96471e77bcaab0953a383e3e8153e2d2

  • SSDEEP

    393216:0iIE7Yo5/27QbpUTLfhJsW+eGQRU93iOblRS/PcLz9ikmlO6oCJdntE:N7r7dUTLJSW+e5R09BR+c1iL02

Malware Config

Signatures

  • An infostealer written in Python and packaged with PyInstaller. 1 IoCs
  • Crealstealer family
  • Detects Pyinstaller 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • penis.exe
    .exe windows:5 windows x64 arch:x64

    bae3d3e8262d7ce7e9ee69cc1b630d3a


    Headers

    Imports

    Sections

  • Creal.pyc