Overview
overview
8Static
static
8PySilon-ma...nux.sh
ubuntu-18.04-amd64
1PySilon-ma...nux.sh
debian-9-armhf
1PySilon-ma...nux.sh
debian-9-mips
PySilon-ma...nux.sh
debian-9-mipsel
PySilon-ma...on.bat
windows7-x64
1PySilon-ma...on.bat
windows10-2004-x64
1PySilon-ma...der.py
windows7-x64
3PySilon-ma...der.py
windows10-2004-x64
3PySilon-ma...ler.py
windows7-x64
3PySilon-ma...ler.py
windows10-2004-x64
3PySilon-ma...ber.py
windows7-x64
3PySilon-ma...ber.py
windows10-2004-x64
3PySilon-ma...ies.py
windows7-x64
3PySilon-ma...ies.py
windows10-2004-x64
6PySilon-ma...64.dll
windows7-x64
1PySilon-ma...64.dll
windows10-2004-x64
1PySilon-ma...isc.py
windows7-x64
3PySilon-ma...isc.py
windows10-2004-x64
3PySilon-ma...ber.py
windows7-x64
3PySilon-ma...ber.py
windows10-2004-x64
3PySilon-ma...ons.py
windows7-x64
3PySilon-ma...ons.py
windows10-2004-x64
3PySilon-ma...rol.py
windows7-x64
3PySilon-ma...rol.py
windows10-2004-x64
3PySilon-ma...put.py
windows7-x64
3PySilon-ma...put.py
windows10-2004-x64
3PySilon-ma...sod.py
windows7-x64
3PySilon-ma...sod.py
windows10-2004-x64
3PySilon-ma...per.py
windows7-x64
3PySilon-ma...per.py
windows10-2004-x64
3PySilon-ma...ing.py
windows7-x64
3PySilon-ma...ing.py
windows10-2004-x64
3Resubmissions
10/06/2024, 13:26
240610-qpxbcsxbra 810/06/2024, 13:22
240610-qmq2kaxfll 810/06/2024, 13:16
240610-qh9m4swhle 8Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
10/06/2024, 13:26
Behavioral task
behavioral1
Sample
PySilon-malware-main/PySilon-linux.sh
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral2
Sample
PySilon-malware-main/PySilon-linux.sh
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral3
Sample
PySilon-malware-main/PySilon-linux.sh
Resource
debian9-mipsbe-20240226-en
Behavioral task
behavioral4
Sample
PySilon-malware-main/PySilon-linux.sh
Resource
debian9-mipsel-20240418-en
Behavioral task
behavioral5
Sample
PySilon-malware-main/PySilon.bat
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
PySilon-malware-main/PySilon.bat
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
PySilon-malware-main/builder.py
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
PySilon-malware-main/builder.py
Resource
win10v2004-20240426-en
Behavioral task
behavioral9
Sample
PySilon-malware-main/compiler.py
Resource
win7-20240215-en
Behavioral task
behavioral10
Sample
PySilon-malware-main/compiler.py
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
PySilon-malware-main/resources/discord_token_grabber.py
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
PySilon-malware-main/resources/discord_token_grabber.py
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
PySilon-malware-main/resources/get_cookies.py
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
PySilon-malware-main/resources/get_cookies.py
Resource
win10v2004-20240426-en
Behavioral task
behavioral15
Sample
PySilon-malware-main/resources/libopus-0.x64.dll
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
PySilon-malware-main/resources/libopus-0.x64.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral17
Sample
PySilon-malware-main/resources/misc.py
Resource
win7-20240508-en
Behavioral task
behavioral18
Sample
PySilon-malware-main/resources/misc.py
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
PySilon-malware-main/resources/passwords_grabber.py
Resource
win7-20240215-en
Behavioral task
behavioral20
Sample
PySilon-malware-main/resources/passwords_grabber.py
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
PySilon-malware-main/resources/protections.py
Resource
win7-20240508-en
Behavioral task
behavioral22
Sample
PySilon-malware-main/resources/protections.py
Resource
win10v2004-20240426-en
Behavioral task
behavioral23
Sample
PySilon-malware-main/resources/source_code/audio_control.py
Resource
win7-20240508-en
Behavioral task
behavioral24
Sample
PySilon-malware-main/resources/source_code/audio_control.py
Resource
win10v2004-20240426-en
Behavioral task
behavioral25
Sample
PySilon-malware-main/resources/source_code/block_input.py
Resource
win7-20240419-en
Behavioral task
behavioral26
Sample
PySilon-malware-main/resources/source_code/block_input.py
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
PySilon-malware-main/resources/source_code/bsod.py
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
PySilon-malware-main/resources/source_code/bsod.py
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
PySilon-malware-main/resources/source_code/crypto_clipper.py
Resource
win7-20240220-en
Behavioral task
behavioral30
Sample
PySilon-malware-main/resources/source_code/crypto_clipper.py
Resource
win10v2004-20240426-en
Behavioral task
behavioral31
Sample
PySilon-malware-main/resources/source_code/file_downloading.py
Resource
win7-20240508-en
Behavioral task
behavioral32
Sample
PySilon-malware-main/resources/source_code/file_downloading.py
Resource
win10v2004-20240226-en
General
-
Target
PySilon-malware-main/resources/source_code/crypto_clipper.py
-
Size
4KB
-
MD5
8e512488105128ef43b45a026c02bcb2
-
SHA1
3728ddbb7f1af53bd3c0a3afce4bf38e99fa7b6f
-
SHA256
a10f1d124d8b4d22cb0a612493c747d06209dd3a793965fda8b4de9d075ff34e
-
SHA512
46118eac86c291bb7e46bf1a9ea07d62388a3e09f25d79c69e08d42f3bdaf6be68dcb60d8e69936c80f97b0dddfcacc6e073a221736f808a4d744ba6aabc8864
-
SSDEEP
96:a1LoVOBa5ASQtCd45yO5HvgyKo/WzIRLTwM/hRBSLUrPlb/W/R//tXM/xR0:xOBa5ASQtCd4IO5Pv+0iMJXTZ+/Z/pMQ
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.py rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.py\ = "py_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file\shell rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file\shell\Read\command rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2676 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2676 AcroRd32.exe 2676 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2860 wrote to memory of 2624 2860 cmd.exe 29 PID 2860 wrote to memory of 2624 2860 cmd.exe 29 PID 2860 wrote to memory of 2624 2860 cmd.exe 29 PID 2624 wrote to memory of 2676 2624 rundll32.exe 30 PID 2624 wrote to memory of 2676 2624 rundll32.exe 30 PID 2624 wrote to memory of 2676 2624 rundll32.exe 30 PID 2624 wrote to memory of 2676 2624 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\PySilon-malware-main\resources\source_code\crypto_clipper.py1⤵
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\PySilon-malware-main\resources\source_code\crypto_clipper.py2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\PySilon-malware-main\resources\source_code\crypto_clipper.py"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2676
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD586acd1d1acacb21cd12cb099323a9028
SHA12f12a3d92f6740307dff3df0ec707bff8e36e9df
SHA2563191d299d723a165a19905c33c16f6c130a02e80f2250b2df9a46c0b4ad1b7a5
SHA5129a3890541868c989e274f8a4fc16f7bdd12ff0130236cb8c0a49e6d646b1dd9ecc7965f9ba681da9046cd6c0618e69bf65e43e8d5d8e2abdb477837538f24f75