JaySploit.zip
- SHA256 5888b095ec1f401edce920d33a37cfd0bd0c8443ce688482c2cbaa4679a65bac
Behavioral task
behavioral1
Sample
JaySploit.exe
Resource
win11-20240508-en
windows11-21h2-x64
16 signatures
150 seconds
General
- Target JaySploit.zip
- Size 80.2MB
- Sample240526-kclffacd3v
- SHA256 5888b095ec1f401edce920d33a37cfd0bd0c8443ce688482c2cbaa4679a65bac
- MD5 6885d747565ddeec228357d52d76960b
- SHA1 b90bd7c05dbdf339bb3071d32541bd86d9d1b8a1
- SHA512 41cc6d9c442fe61f676448461ffaf6ff558534eba21b1089c0a2a8247a12bb5882d935119eaad04ccd38f927de8c71c0671eec2823b447cf08c33aeeace1227b
- SSDEEP 1572864:mBpPDgSYXnxCI6234p1E1bLq3mERMJW9XMutfKVGXs7S6JhBQBojmFq5UO3YFumV:mBpPDgjBCItozc23mEp132S6L9V5UO2Z
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detect Pysilon 1 IoCs
resource yara_rule static1/unpack002/source_prepared.pyc pysilon - Pysilon family
- Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/JaySploit.exe pyinstaller - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/JaySploit.exe
File Explorer
-
JaySploit.zip.zip 80.2MB
-
JaySploit.exe.exe 80.5MB
-
discord_token_grabber.pyc17KB
-
get_cookies.pyc10KB
-
misc.pyc5KB
-
passwords_grabber.pyc8KB
-
source_prepared.pyc185KB
JaySploit.exe
- IMPHASH f4f2e2b03fe5666a721620fcea3aea9b
- SHA256 d39f8469e2fb40c4e614fb95f8b63ce8b5ac883a82374b90cd9ff3def626bfca
- MD5 980f6afd45c4de00bd97c5d067b3175c
- SHA1 5e26d2786ba4a74eb4e21852f8fadee6a597e229
- SHA512 e093f5c6c5ebcb8c22d5f77d13d48a1834c005f7d2b52a3293318c24999be3b4498db4f9ed1678062e9bec3af47a014970173790aeca70122b3cae1c5c6ec23c
- SSDEEP 1572864:LvNBYQ3jQ3Sk8IpG7V+VPhqb+TnE7KjCeePRQvljSvOul/JGZGHkVDWh9/orsVz5:LvNBY+4SkB05awb+Tzu/2wOuNzIS9/Dz
- MD5 SHA1 SHA512 SSDEEP
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
50496
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
CreateWindowExW
PostMessageW
GetMessageW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW
comctl32
ord380
kernel32
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
HeapReAlloc
FlushFileBuffers
GetCurrentDirectoryW
GetACP
GetOEMCP
GetModuleHandleW
MulDiv
GetLastError
SetDllDirectoryW
CreateFileW
GetFinalPathNameByHandleW
CloseHandle
GetModuleFileNameW
CreateSymbolicLinkW
GetCPInfo
GetCommandLineW
GetEnvironmentVariableW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
CreateDirectoryW
GetTempPathW
WaitForSingleObject
Sleep
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
FreeLibrary
LoadLibraryExW
SetConsoleCtrlHandler
FindClose
FindFirstFileExW
GetCurrentProcess
LocalFree
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
WriteConsoleW
SetEndOfFile
GetProcAddress
GetSystemTimeAsFileTime
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
RemoveDirectoryW
FindNextFileW
SetStdHandle
DeleteFileW
ReadFile
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
advapi32
OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
gdi32
SelectObject
DeleteObject
CreateFontIndirectW
Name
.text
Size
172KB
Virtual Size
171KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
76KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=259, version=30795,
count=188, id=261, version=30795,
count=10, id=260, version=30795,
count=1, productName=Unmarked objects (old),
count=4, id=253, version=33030,
count=40, id=261, version=33030,
count=17, id=260, version=33030,
count=17, id=259, version=33030,
count=11, id=257, version=30795,
count=142, id=1, productName=Unmarked objects,
count=21, id=260, version=33135,
count=1, id=258, version=33135,
discord_token_grabber.pyc
- SHA256 8ae6baddc552f9a47c488760a3d3b04f217f7c999dbffc1a548bb09532e6bf77
- MD5 e523026b612006e580e96bd9e2a8882c
- SHA1 03b9938701f7eff11a0c3632ed805e8188598c88
- SHA512 a0f15f5edecbab4894aa3b85092fc2bde34b76f6048b198ce387d59a56d6c74969201cc43d19cd27a9ff0a6ab72268884a90ef206f0be34a5707a7f6ea24a853
- SSDEEP 384:cGllyAavwS9F0RW807PPQviowoYbCj+Mo8WWIc02a8:cIlytvX9iRW8inQ6owoYOyM0d2a8
- MD5 SHA1 SHA512 SSDEEP
get_cookies.pyc
- SHA256 85a7c34afad2c270ca690a5b4c30cc8bf16967e623fc77f4de4497901030a93b
- MD5 b38f506528b3d6d5dbd851426c347b95
- SHA1 e91bf4ef42128267934e21be0176e552480f5977
- SHA512 ab110dc92eba564fd0ec6c6a75e779f588518dc1aa461f072ab02b96bc11fbe25e09faa6a556dc6a127c3e8826382697b72037a0cefbdaf32fd70a723e746295
- SSDEEP 192:TzOCIeinQfUF9LdwOEVOFc1mNe47+o+zEzzzzz1zz+HoowAE:TzOUiQccEe4KoOIAE
- MD5 SHA1 SHA512 SSDEEP
misc.pyc
- SHA256 b522284f1a7e518c269c0414160407ec7834a4397f85ef389433b49367b5df9c
- MD5 31aa260c6cdeaa9d942cd0dcfcadd16a
- SHA1 a6818f3acf5c2ab9d65b41a81cb92b36b85cc932
- SHA512 0dd277ef948315a3554bd8c5110e27afa9b2eac88defc1211771c050cdd27b3668484dec35ec5c5010bff00b62c2cebd9e7286c0b114ad28437719b42bd0fc2c
- SSDEEP 96:DSajAihmJG4n3B4SmSSSSlSSSShDwegPbbVxlj0nIAEDS5ejmw01k9Bddpq:eYAfn3ySmSSSSlSSSSeeOPVxx0nIAZeQ
- MD5 SHA1 SHA512 SSDEEP
passwords_grabber.pyc
- SHA256 1fd284f1e27263bd2a16050c6989933a382c7d196f4c9f247187cc3b3f6ba3ac
- MD5 704dced7f7530b19a34a5f7a71c26b10
- SHA1 608d9647488cfa2b5f84a891028168a973bfcfa9
- SHA512 e4a6710abef2c45d631745c91d8135873be06e5b240a61362e341d05ecc1dedf885487a554b648c328a3c5cc17fcf74e6d066b2e3f51379358ba28c2a0f2f39f
- SSDEEP 192:+CE34EAL/GFf/PomdPO23NsDmqFUhkxNivLI9dRvL:Y4EAL/AfRBO8NsxuOxNn
- MD5 SHA1 SHA512 SSDEEP
source_prepared.pyc
- SHA256 94ad449f7a7b065e6ce3a45dff4a47bb3b97ff4e7951b82319e792b5555b1aee
- MD5 60204318ffa2f037879356afb4b03881
- SHA1 f64af513c6fb98d060dad38995fa210ae1d5a5f5
- SHA512 c04a8a4b6dcff1c740f04d34fabb552084c5426eb8438ffc271a2725e7f84d5fcffcde23ebd1e6e4a78c4851e73e458a2a3d3960c053d61f4efd982981af68f8
- SSDEEP 3072:wTAkLaiI6A9MmlbJo2PEtelZN+tVZa/zqge6/qcCkn0:wTvWiILHJo28cN+7Za/zqgeqPCh
- MD5 SHA1 SHA512 SSDEEP
-
Detect Pysilon