pysilon | cd04012af960734823668b2ed9e7d5df[.]bin

resource	yara_rule
static1/unpack001/source_prepared.pyc	pysilon

resource	yara_rule
sample	pyinstaller

resource
cd04012af960734823668b2ed9e7d5df.bin

cd04012af960734823668b2ed9e7d5df.bin

IMPHASH 2ac23c52e7647c5bbea38e98bb68c652
SHA256 403ba6f0a162a231f17f3f9b056c78a6b00d70cf39b8f1b618168b3362420870
MD5 cd04012af960734823668b2ed9e7d5df
SHA1 5c18fd575f10023ef8f7d8f78975a8fb439da7e7
SHA512 1c8fa5cc2511f697ec24e804988ac8950a273cf66d24e511119894fc5b0b832511db4450fe85345efeabfdee4627187dc5cfa0f945ce0f7334b5080e9b05c1c1
SSDEEP 1572864:ZYvNBYQglewBySk8IpG7V+VPhqAFtgWUUtgW7lgvtpPRQvljSvOul/JGZGHkVsW5:uvNBYxkaySkB05awAkWUhW7e1p2wOuNv
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

Detects Pyinstaller

pyinstaller
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

48672

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

CreateWindowExW PostMessageW GetMessageW MessageBoxW MessageBoxA SystemParametersInfoW DestroyIcon SetWindowLongPtrW GetWindowLongPtrW GetClientRect InvalidateRect ReleaseDC GetDC DrawTextW GetDialogBaseUnits EndDialog DialogBoxIndirectParamW MoveWindow SendMessageW

comctl32

ord380

kernel32

GetACP IsValidCodePage GetStringTypeW GetFileAttributesExW SetEnvironmentVariableW FlushFileBuffers GetCurrentDirectoryW GetOEMCP GetCPInfo GetModuleHandleW MulDiv GetLastError FormatMessageW GetModuleFileNameW SetDllDirectoryW CreateSymbolicLinkW GetProcAddress CreateDirectoryW GetCommandLineW GetEnvironmentVariableW GetEnvironmentStringsW DeleteFileW FindClose FindFirstFileW FindNextFileW GetDriveTypeW RemoveDirectoryW GetTempPathW CloseHandle WaitForSingleObject Sleep GetCurrentProcess GetExitCodeProcess CreateProcessW GetStartupInfoW FreeLibrary LoadLibraryExW LocalFree SetConsoleCtrlHandler CreateFileW FindFirstFileExW GetFinalPathNameByHandleW MultiByteToWideChar WideCharToMultiByte FreeEnvironmentStringsW GetProcessHeap GetTimeZoneInformation HeapSize HeapReAlloc WriteConsoleW SetEndOfFile ExpandEnvironmentStringsW QueryPerformanceCounter RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent RtlUnwindEx SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer RaiseException RtlPcToFileHeader GetCommandLineA GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ReadFile GetFullPathNameW SetStdHandle GetStdHandle WriteFile ExitProcess GetModuleHandleExW HeapFree GetConsoleMode ReadConsoleW SetFilePointerEx GetConsoleOutputCP GetFileSizeEx HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW

advapi32

OpenProcessToken GetTokenInformation ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertSidToStringSidW

gdi32

SelectObject DeleteObject CreateFontIndirectW

discord_token_grabber.pyc

SHA256 8ae6baddc552f9a47c488760a3d3b04f217f7c999dbffc1a548bb09532e6bf77
MD5 e523026b612006e580e96bd9e2a8882c
SHA1 03b9938701f7eff11a0c3632ed805e8188598c88
SHA512 a0f15f5edecbab4894aa3b85092fc2bde34b76f6048b198ce387d59a56d6c74969201cc43d19cd27a9ff0a6ab72268884a90ef206f0be34a5707a7f6ea24a853
SSDEEP 384:cGllyAavwS9F0RW807PPQviowoYbCj+Mo8WWIc02a8:cIlytvX9iRW8inQ6owoYOyM0d2a8
MD5 SHA1 SHA512 SSDEEP

Detects Pyinstaller

pyinstaller

get_cookies.pyc

SHA256 85a7c34afad2c270ca690a5b4c30cc8bf16967e623fc77f4de4497901030a93b
MD5 b38f506528b3d6d5dbd851426c347b95
SHA1 e91bf4ef42128267934e21be0176e552480f5977
SHA512 ab110dc92eba564fd0ec6c6a75e779f588518dc1aa461f072ab02b96bc11fbe25e09faa6a556dc6a127c3e8826382697b72037a0cefbdaf32fd70a723e746295
SSDEEP 192:TzOCIeinQfUF9LdwOEVOFc1mNe47+o+zEzzzzz1zz+HoowAE:TzOUiQccEe4KoOIAE
MD5 SHA1 SHA512 SSDEEP

Detects Pyinstaller

pyinstaller

misc.pyc

SHA256 b522284f1a7e518c269c0414160407ec7834a4397f85ef389433b49367b5df9c
MD5 31aa260c6cdeaa9d942cd0dcfcadd16a
SHA1 a6818f3acf5c2ab9d65b41a81cb92b36b85cc932
SHA512 0dd277ef948315a3554bd8c5110e27afa9b2eac88defc1211771c050cdd27b3668484dec35ec5c5010bff00b62c2cebd9e7286c0b114ad28437719b42bd0fc2c
SSDEEP 96:DSajAihmJG4n3B4SmSSSSlSSSShDwegPbbVxlj0nIAEDS5ejmw01k9Bddpq:eYAfn3ySmSSSSlSSSSeeOPVxx0nIAZeQ
MD5 SHA1 SHA512 SSDEEP

Detects Pyinstaller

pyinstaller

passwords_grabber.pyc

SHA256 1fd284f1e27263bd2a16050c6989933a382c7d196f4c9f247187cc3b3f6ba3ac
MD5 704dced7f7530b19a34a5f7a71c26b10
SHA1 608d9647488cfa2b5f84a891028168a973bfcfa9
SHA512 e4a6710abef2c45d631745c91d8135873be06e5b240a61362e341d05ecc1dedf885487a554b648c328a3c5cc17fcf74e6d066b2e3f51379358ba28c2a0f2f39f
SSDEEP 192:+CE34EAL/GFf/PomdPO23NsDmqFUhkxNivLI9dRvL:Y4EAL/AfRBO8NsxuOxNn
MD5 SHA1 SHA512 SSDEEP

Detects Pyinstaller

pyinstaller

source_prepared.pyc

SHA256 ccb41c3b728e994cc306d31ebfcca5bfb0e9de5fa5a6831e354fe52886cff2a4
MD5 06f4ce926f1dec8621675f9cec2c3d97
SHA1 4f849456d65547e9b5a79c26a62ddbe292e0eca2
SHA512 a2f1f48beb0dcc6993a89623af967c32c41efe76adf245c3e2a5ffdca8c34a0e42b947d334231566c756d819a7d04b1ef7f6eddb51acb184a8bc27cc236f098e
SSDEEP 3072:ctaLa+/4A9M/2CYolPEtelZN+tVZaftogjHBhCkn0:cEW+/ZuYol8cN+7ZaftogjHPCh
MD5 SHA1 SHA512 SSDEEP

Detect Pysilon
Detects Pyinstaller

pyinstaller

Sharing

General

Malware Config

Signatures

File Explorer