pysilon | SynsX[.]exe

resource	yara_rule
static1/unpack001/source_prepared.pyc	pysilon

resource	yara_rule
sample	pyinstaller

resource
SynsX.exe

SynsX.exe

IMPHASH bae3d3e8262d7ce7e9ee69cc1b630d3a
SHA256 55c12edaade5479133cf5f586f74f0a03d32b7c8a1066d829d229f0a0b0ff16a
MD5 1fcbbc67e3176042323a59b187e98115
SHA1 279914fea04d036e33d14b4e48be8f2fef99a2cf
SHA512 8c10eefcd5bdf373ad33bd0ee699343e9eed730115538c02786a5a2960eeeba4d0f0f80436feb21786c996d200548475aba0f84c74b682354f4bb0fc6b299bab
SSDEEP 1572864:uvlQ3j0DGSk8IpG7V+VPhqcLE7YhjC0WlsnghowmaOllpWG9OoyXBqX:uvl+TSkB05awcvhujsghfxOllpP9OjXo
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

Detects Pyinstaller

pyinstaller
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

46800

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

GetWindowThreadProcessId ShowWindow

kernel32

GetModuleFileNameW CreateSymbolicLinkW GetProcAddress GetCommandLineW GetEnvironmentVariableW SetEnvironmentVariableW ExpandEnvironmentStringsW CreateDirectoryW GetTempPathW WaitForSingleObject Sleep GetExitCodeProcess CreateProcessW SetDllDirectoryW FreeLibrary LoadLibraryExW SetConsoleCtrlHandler FindClose FindFirstFileExW CloseHandle GetCurrentProcess GetCurrentProcessId LocalFree FormatMessageW MultiByteToWideChar WideCharToMultiByte GetConsoleWindow HeapSize GetLastError WriteConsoleW SetEndOfFile GetStartupInfoW TlsSetValue RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetModuleHandleW RtlUnwindEx SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsFree EncodePointer RaiseException RtlPcToFileHeader GetCommandLineA CreateFileW GetDriveTypeW GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetFullPathNameW RemoveDirectoryW FindNextFileW SetStdHandle DeleteFileW ReadFile GetStdHandle WriteFile ExitProcess GetModuleHandleExW HeapFree GetConsoleMode ReadConsoleW SetFilePointerEx GetConsoleOutputCP GetFileSizeEx HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetCurrentDirectoryW FlushFileBuffers HeapReAlloc GetFileAttributesExW GetStringTypeW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap GetTimeZoneInformation

advapi32

ConvertSidToStringSidW GetTokenInformation OpenProcessToken ConvertStringSecurityDescriptorToSecurityDescriptorW

Name

.text

Size

168KB

Virtual Size

167KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

74KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

35KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

discord_token_grabber.pyc

SHA256 8ae6baddc552f9a47c488760a3d3b04f217f7c999dbffc1a548bb09532e6bf77
MD5 e523026b612006e580e96bd9e2a8882c
SHA1 03b9938701f7eff11a0c3632ed805e8188598c88
SHA512 a0f15f5edecbab4894aa3b85092fc2bde34b76f6048b198ce387d59a56d6c74969201cc43d19cd27a9ff0a6ab72268884a90ef206f0be34a5707a7f6ea24a853
SSDEEP 384:cGllyAavwS9F0RW807PPQviowoYbCj+Mo8WWIc02a8:cIlytvX9iRW8inQ6owoYOyM0d2a8
MD5 SHA1 SHA512 SSDEEP

Detects Pyinstaller

pyinstaller

get_cookies.pyc

SHA256 85a7c34afad2c270ca690a5b4c30cc8bf16967e623fc77f4de4497901030a93b
MD5 b38f506528b3d6d5dbd851426c347b95
SHA1 e91bf4ef42128267934e21be0176e552480f5977
SHA512 ab110dc92eba564fd0ec6c6a75e779f588518dc1aa461f072ab02b96bc11fbe25e09faa6a556dc6a127c3e8826382697b72037a0cefbdaf32fd70a723e746295
SSDEEP 192:TzOCIeinQfUF9LdwOEVOFc1mNe47+o+zEzzzzz1zz+HoowAE:TzOUiQccEe4KoOIAE
MD5 SHA1 SHA512 SSDEEP

Detects Pyinstaller

pyinstaller

misc.pyc

SHA256 b522284f1a7e518c269c0414160407ec7834a4397f85ef389433b49367b5df9c
MD5 31aa260c6cdeaa9d942cd0dcfcadd16a
SHA1 a6818f3acf5c2ab9d65b41a81cb92b36b85cc932
SHA512 0dd277ef948315a3554bd8c5110e27afa9b2eac88defc1211771c050cdd27b3668484dec35ec5c5010bff00b62c2cebd9e7286c0b114ad28437719b42bd0fc2c
SSDEEP 96:DSajAihmJG4n3B4SmSSSSlSSSShDwegPbbVxlj0nIAEDS5ejmw01k9Bddpq:eYAfn3ySmSSSSlSSSSeeOPVxx0nIAZeQ
MD5 SHA1 SHA512 SSDEEP

Detects Pyinstaller

pyinstaller

passwords_grabber.pyc

SHA256 1fd284f1e27263bd2a16050c6989933a382c7d196f4c9f247187cc3b3f6ba3ac
MD5 704dced7f7530b19a34a5f7a71c26b10
SHA1 608d9647488cfa2b5f84a891028168a973bfcfa9
SHA512 e4a6710abef2c45d631745c91d8135873be06e5b240a61362e341d05ecc1dedf885487a554b648c328a3c5cc17fcf74e6d066b2e3f51379358ba28c2a0f2f39f
SSDEEP 192:+CE34EAL/GFf/PomdPO23NsDmqFUhkxNivLI9dRvL:Y4EAL/AfRBO8NsxuOxNn
MD5 SHA1 SHA512 SSDEEP

Detects Pyinstaller

pyinstaller

protections.pyc

SHA256 30453b28a8db14c4750bd4608bcec2eb15f6deef368337bdef31ebe0a64398f8
MD5 d9a854c510c172454bb2d3f0f4d81069
SHA1 9ce3805b81c39f9a982f88faf8f012cb6e2c0208
SHA512 af1d20ffe8b760298e56d9524e78588994d3d663a49b4b2edd4fb0cbc9873467e5080a4376383d5b4c46d848559ddb20df8ac20a2776a8468328af4eb50a4501
MD5 SHA1 SHA512

Detects Pyinstaller

pyinstaller

source_prepared.pyc

SHA256 68635cc888b7f42d6461aa93154e13f0aca66d9f27ae0d506687db1aa965d33b
MD5 f7b930081d3f7445e281ad962fb4835a
SHA1 557011a8ed451e8a9a5aa820e77306a987bed4b9
SHA512 5b3fa26428764234cd1e0f884a92e3b8abe15f0bb267e39a27c8d1cacdf2e3c5677e7610e10bdf3293d6999a0946691770db27edbfd7ee188e7ef98d3d4f64ab
SSDEEP 3072:3c0fI0c7dvOLh7+doqfeu2eA4PKZNsy4AgUo81COFa:3cgI0kdNdoqmFeA4yZNsy4AgUo4CZ
MD5 SHA1 SHA512 SSDEEP

Detect Pysilon
Detects Pyinstaller

pyinstaller

Sharing

General

Malware Config

Signatures

File Explorer

SynsX.exe

user32

kernel32

advapi32

generic

discord_token_grabber.pyc

get_cookies.pyc

misc.pyc

passwords_grabber.pyc

protections.pyc

source_prepared.pyc