Dema_Beta.zip
- SHA256 7fd97cd5300874f5737db9d449133820812b4b9d75b7b9e53713a2d10b5d1743
Overview
overview
10Static
static
10Dema Beta/...er.exe
windows10-2004-x64
8Dema Beta/...er.exe
windows11-21h2-x64
8discord_to...er.pyc
windows10-2004-x64
3discord_to...er.pyc
windows11-21h2-x64
3get_cookies.pyc
windows10-2004-x64
3get_cookies.pyc
windows11-21h2-x64
3misc.pyc
windows10-2004-x64
3misc.pyc
windows11-21h2-x64
3passwords_grabber.pyc
windows10-2004-x64
3passwords_grabber.pyc
windows11-21h2-x64
3protections.pyc
windows10-2004-x64
3protections.pyc
windows11-21h2-x64
3source_prepared.pyc
windows10-2004-x64
3source_prepared.pyc
windows11-21h2-x64
3Behavioral task
behavioral1
Sample
Dema Beta/Thanks For Using Dema/Dema Bootstrapper.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
17 signatures
600 seconds
Behavioral task
behavioral2
Sample
Dema Beta/Thanks For Using Dema/Dema Bootstrapper.exe
Resource
win11-20240611-en
windows11-21h2-x64
14 signatures
600 seconds
Behavioral task
behavioral3
Sample
discord_token_grabber.pyc
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
600 seconds
Behavioral task
behavioral4
Sample
discord_token_grabber.pyc
Resource
win11-20240508-en
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral5
Sample
get_cookies.pyc
Resource
win10v2004-20240508-en
windows10-2004-x64
3 signatures
600 seconds
Behavioral task
behavioral6
Sample
get_cookies.pyc
Resource
win11-20240508-en
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral7
Sample
misc.pyc
Resource
win10v2004-20240508-en
windows10-2004-x64
5 signatures
600 seconds
Behavioral task
behavioral8
Sample
misc.pyc
Resource
win11-20240508-en
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral9
Sample
passwords_grabber.pyc
Resource
win10v2004-20240611-en
windows10-2004-x64
3 signatures
600 seconds
Behavioral task
behavioral10
Sample
passwords_grabber.pyc
Resource
win11-20240611-en
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral11
Sample
protections.pyc
Resource
win10v2004-20240508-en
windows10-2004-x64
3 signatures
600 seconds
Behavioral task
behavioral12
Sample
protections.pyc
Resource
win11-20240419-en
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral13
Sample
source_prepared.pyc
Resource
win10v2004-20240508-en
windows10-2004-x64
3 signatures
600 seconds
Behavioral task
behavioral14
Sample
source_prepared.pyc
Resource
win11-20240508-en
windows11-21h2-x64
3 signatures
600 seconds
General
- Target Dema_Beta.zip
- Size 76.0MB
- Sample240613-enbsgstdpe
- SHA256 7fd97cd5300874f5737db9d449133820812b4b9d75b7b9e53713a2d10b5d1743
- MD5 89a7493e42b5db911bff60a185c2dc50
- SHA1 a87b3076b8b95574183132ebe6846d157adb8dd3
- SHA512 fea1b66ca1a2f30e4dcd9953919884e3a155e86b4a94444b587f6d1bd21047b9476b913d1c5e2340db4c963734cf386a011410ebecddebf31ac8ce8ac5d9e71b
- SSDEEP 1572864:jraVkItNXpS20aR8nNsd9hqMlcYoPNfzCOtTdEZ5NEu8lJS5gt971joqiMS:aVztLS27mNWwqcLfGMO5NERtZih
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detect Pysilon 1 IoCs
resource yara_rule static1/unpack002/source_prepared.pyc pysilon - Pysilon family
- Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/Dema Beta/Thanks For Using Dema/Dema Bootstrapper.exe pyinstaller - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Dema Beta/Thanks For Using Dema/Dema Bootstrapper.exe
File Explorer
-
Dema_Beta.zip.zip 76.0MB
-
Dema Beta/Thanks For Using Dema/Dema Bootstrapper.exe.exe 76.4MB
-
discord_token_grabber.pyc15KB
-
get_cookies.pyc9KB
-
misc.pyc4KB
-
passwords_grabber.pyc7KB
-
protections.pyc1KB
-
source_prepared.pyc230KB
-
Dema Beta/Thanks For Using Dema/logs/executed_at_2024-06-11_20-19-19.log66B
Dema Beta/Thanks For Using Dema/Dema Bootstrapper.exe
- IMPHASH 5bc16b5845145eb0edb88983820691b1
- SHA256 e7ca1f5f5c494a6a6c77ab874f3d154dbcec1315f4a65f85ae066dd6a1570428
- MD5 6ba352942d85fa603be93afd073107d3
- SHA1 1049de118dc35932d71b73380d6b5c7d96754444
- SHA512 7dae153905a5e6f877bacd67630e824c7528ecb40b63cb1376906dc8fb9c1b95fd5a668f900920d2b09df10cd1957e399a2669a87686070fe5a3668b8251d958
- SSDEEP 1572864:5viEZjFcSk8IpG7V+VPhqYdfME7mjx/PRQvbXhQaE/zspC0WVdj8VjTb8g:5vZZ2SkB05awcfQt/2bXhQL0c5X
- MD5 SHA1 SHA512 SSDEEP
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
45600
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
GetWindowThreadProcessId
ShowWindow
kernel32
GetModuleFileNameW
SetDllDirectoryW
CreateSymbolicLinkW
GetProcAddress
CreateDirectoryW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
CloseHandle
FormatMessageW
Sleep
GetCurrentProcess
GetCurrentProcessId
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
FreeLibrary
LoadLibraryExW
LocalFree
SetConsoleCtrlHandler
GetConsoleWindow
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
HeapReAlloc
GetLastError
WriteConsoleW
SetEndOfFile
WaitForSingleObject
LeaveCriticalSection
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
RtlUnwindEx
SetLastError
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
GetCommandLineA
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
GetCurrentDirectoryW
FlushFileBuffers
SetEnvironmentVariableW
GetFileAttributesExW
GetStringTypeW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
advapi32
ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
Name
.text
Size
168KB
Virtual Size
168KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
73KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=259, version=30795,
count=183, id=261, version=30795,
count=10, id=260, version=30795,
count=3, id=253, version=33731,
count=9, id=259, version=33731,
count=17, id=260, version=33731,
count=40, id=261, version=33731,
count=7, id=257, version=30795,
count=122, id=1, productName=Unmarked objects,
count=25, id=260, version=33811,
count=1, id=258, version=33811,
discord_token_grabber.pyc
- SHA256 b4a60b0e4f82707a8c5fb7f3fc0cc78576c7b45217617185ab34a90e2e052208
- MD5 990bb1210323b8968b180576cf8114d6
- SHA1 a4e11d7cdeb37fb32d768085263ff9fd4e51ac0b
- SHA512 43d1e9db58d160b15d6daf5677f2f63ed8f3fa494a886bf07d229829ffc84af17f9c81f61bdbf23dfa54a1bebafa7e562f805848b64de08bc8cf83fe98a2188a
- SSDEEP 384:YGC7RYmnXavkxzG7WltcrhntQ5saa2h12VA:YGCuvk8WltcrttQ5saaCsVA
- MD5 SHA1 SHA512 SSDEEP
get_cookies.pyc
- SHA256 1078edad1660d103c2135793ea9707e4ef7877fb4be7b87c0e538ed84920212c
- MD5 9bdb8627dc166823e7d60603575b689a
- SHA1 de56b5f8b3e891ad07760544132bd357f1e62368
- SHA512 789d21f744eff44456585fd27cd88a67e26b55ed1a043aa76a4b5e63f7dfad99013ca09b15fabecd041f8d35f8d22502c08efd0bb11d26ca083f02a64eae6d3a
- SSDEEP 192:kNal3eiNis9QfUFoxJvm79F211G67+PtAhN:kJiB2lrj7jKlAhN
- MD5 SHA1 SHA512 SSDEEP
misc.pyc
- SHA256 a8355eef70645468d11a410d1402e0cab31a194e87172b523b1ff3dea5dbb0c2
- MD5 204ee497021e32209ddde0c015b4dc19
- SHA1 6aa2c039e6b6fbfb3620d4fe42d115553702146b
- SHA512 961b15c0efe0478fdf9287e7b3b709233bcd9524be708f426b75dc91eb07ddfc2a2ce4f347d52a3e7402f5307ab755af093d660662fd3c4c465fd41e8d138d12
- SSDEEP 96:ySMlhlv6KPDweHPF8+VB7sHIZGhIW0vmyyZ1k93hub:LolvJ0evq+VBXZGh4vmV1kFhub
- MD5 SHA1 SHA512 SSDEEP
passwords_grabber.pyc
- SHA256 8655f8885fa28c9633563e0264e65206eae277fb020f85a836be27f0fc3d7ec4
- MD5 bbb6ab7b8230cca0ac46532a612143d0
- SHA1 4bf5ebb19c5807cfb4b48191ec65b329d67763cd
- SHA512 21353818de5a2e192bcdb38e0765b675258ae733eb634c1b01fbf53dc22946b0eee127c975be7a63d20a8db2b87521fe0ed85f2ec09dcc2f3adf5a7fea0b180e
- SSDEEP 192:h114qWLfhuUIxzOK2cxDJb+XUhetovxEPz:V4qWLfMtzVxDAEW7
- MD5 SHA1 SHA512 SSDEEP
protections.pyc
- SHA256 48ea31ab1a14238c4aebb64375e18a22d8c7c16f426399bb7c7ab9ac6abef0d5
- MD5 464c095ee3a48c2da4c073ac55e3f6c1
- SHA1 4b2f50085f20c05765efe19e18b0c73c16acce0e
- SHA512 fd65f8bbf966a6968f7322a5ddb82d9d9a2eb229303183944d8b019ceddcdc82a603b35fd6bc8febbcdef43c5fbc795370bb22b22d24822b474484d9d27ca8f1
- MD5 SHA1 SHA512
source_prepared.pyc
- SHA256 f19c17244067e24e380069f82f94c019d3909e3f1f13b680a343d7dede3541f6
- MD5 73cf7901f8a5dda1df3dada4d667708e
- SHA1 50927e6f25a4e140c446cea25e79abee0586bec4
- SHA512 7e06f445c2768a4acd08e89272fa4b53e2aa466e05a9e7a665250c9448563b00aa044a496a9ea76012809317c256095bbf67d8ba287352f2485dc84f109c1b70
- SSDEEP 3072:X9mYiNJ6YxXdpk9dFEeou8qzXYP/UxpQq1pJqscV8IvdXzSs6Fs:X97iNJ699weoOYP/K60EVQsV
- MD5 SHA1 SHA512 SSDEEP
-
Detect Pysilon
Dema Beta/Thanks For Using Dema/logs/executed_at_2024-06-11_20-19-19.log
- SHA256 102ad4f648399ebb1b396a98fdf20f8874758b1936c16700c8619d01346d7a93
- MD5 f1cae73bc4e0a5e7aaf4dbacef88e559
- SHA1 ffcc5ceb9fa9406983a35d977cf352681d63144c
- SHA512 ce4ae3c60364c95eb3fc2b2fd2a4abfbbfe8f2000878d26405d1de50fe5f6af2730cf5f0767fc23ad9f5d36d7d0afc2d6e4761f6d78c21fef3fc343ae2ed55ac
- MD5 SHA1 SHA512