3816c836b3af21fcc7f05a71ad13b17aaa110be1ecee68aa18c22bf9729bca48.rar
- SHA256 3816c836b3af21fcc7f05a71ad13b17aaa110be1ecee68aa18c22bf9729bca48
Overview
overview
10Static
static
10Phxnt0m-ma...nux.sh
ubuntu-18.04-amd64
1Phxnt0m-ma...nux.sh
debian-9-armhf
1Phxnt0m-ma...nux.sh
debian-9-mips
1Phxnt0m-ma...nux.sh
debian-9-mipsel
1Phxnt0m-ma...0m.bat
windows7-x64
1Phxnt0m-ma...0m.bat
windows10-2004-x64
1Phxnt0m-ma...der.py
windows7-x64
3Phxnt0m-ma...der.py
windows10-2004-x64
3Phxnt0m-ma...ler.py
windows7-x64
3Phxnt0m-ma...ler.py
windows10-2004-x64
3Phxnt0m-ma...11.pyc
windows7-x64
3Phxnt0m-ma...11.pyc
windows10-2004-x64
3Phxnt0m-ma...11.pyc
windows7-x64
3Phxnt0m-ma...11.pyc
windows10-2004-x64
3Phxnt0m-ma...ber.py
windows7-x64
3Phxnt0m-ma...ber.py
windows10-2004-x64
3Phxnt0m-ma...ies.py
windows7-x64
3Phxnt0m-ma...ies.py
windows10-2004-x64
3Phxnt0m-ma...64.dll
windows7-x64
1Phxnt0m-ma...64.dll
windows10-2004-x64
1Phxnt0m-ma...isc.py
windows7-x64
3Phxnt0m-ma...isc.py
windows10-2004-x64
3Phxnt0m-ma...ber.py
windows7-x64
3Phxnt0m-ma...ber.py
windows10-2004-x64
3Phxnt0m-ma...ons.py
windows7-x64
3Phxnt0m-ma...ons.py
windows10-2004-x64
3Phxnt0m-ma...rol.py
windows7-x64
3Phxnt0m-ma...rol.py
windows10-2004-x64
3Phxnt0m-ma...put.py
windows7-x64
3Phxnt0m-ma...put.py
windows10-2004-x64
3Phxnt0m-ma...sod.py
windows7-x64
3Phxnt0m-ma...sod.py
windows10-2004-x64
3Behavioral task
behavioral1
Sample
Phxnt0m-malware-main/Phxnt0mware RAT - main/Phxnt0m-linux.sh
Resource
ubuntu1804-amd64-20240611-en
ubuntu-18.04-amd64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Phxnt0m-malware-main/Phxnt0mware RAT - main/Phxnt0m-linux.sh
Resource
debian9-armhf-20240729-en
debian-9-armhf
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Phxnt0m-malware-main/Phxnt0mware RAT - main/Phxnt0m-linux.sh
Resource
debian9-mipsbe-20240611-en
debian-9-mips
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
Phxnt0m-malware-main/Phxnt0mware RAT - main/Phxnt0m-linux.sh
Resource
debian9-mipsel-20240226-en
debian-9-mipsel
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
Phxnt0m-malware-main/Phxnt0mware RAT - main/Phxnt0m.bat
Resource
win7-20240708-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
Phxnt0m-malware-main/Phxnt0mware RAT - main/Phxnt0m.bat
Resource
win10v2004-20240709-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
Phxnt0m-malware-main/Phxnt0mware RAT - main/builder.py
Resource
win7-20240729-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral8
Sample
Phxnt0m-malware-main/Phxnt0mware RAT - main/builder.py
Resource
win10v2004-20240709-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
Phxnt0m-malware-main/Phxnt0mware RAT - main/compiler.py
Resource
win7-20240729-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral10
Sample
Phxnt0m-malware-main/Phxnt0mware RAT - main/compiler.py
Resource
win10v2004-20240709-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/__pycache__/discord_token_grabber.cpython-311.pyc
Resource
win7-20240704-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral12
Sample
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/__pycache__/discord_token_grabber.cpython-311.pyc
Resource
win10v2004-20240709-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral13
Sample
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/__pycache__/protections.cpython-311.pyc
Resource
win7-20240704-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral14
Sample
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/__pycache__/protections.cpython-311.pyc
Resource
win10v2004-20240709-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/discord_token_grabber.py
Resource
win7-20240729-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral16
Sample
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/discord_token_grabber.py
Resource
win10v2004-20240709-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral17
Sample
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/get_cookies.py
Resource
win7-20240708-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral18
Sample
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/get_cookies.py
Resource
win10v2004-20240709-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral19
Sample
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/libopus-0.x64.dll
Resource
win7-20240708-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/libopus-0.x64.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/misc.py
Resource
win7-20240708-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral22
Sample
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/misc.py
Resource
win10v2004-20240709-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral23
Sample
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/passwords_grabber.py
Resource
win7-20240729-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral24
Sample
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/passwords_grabber.py
Resource
win10v2004-20240709-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral25
Sample
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/protections.py
Resource
win7-20240729-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral26
Sample
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/protections.py
Resource
win10v2004-20240709-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral27
Sample
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/source_code/audio_control.py
Resource
win7-20240704-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral28
Sample
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/source_code/audio_control.py
Resource
win10v2004-20240704-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral29
Sample
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/source_code/block_input.py
Resource
win7-20240704-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral30
Sample
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/source_code/block_input.py
Resource
win10v2004-20240729-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral31
Sample
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/source_code/bsod.py
Resource
win7-20240708-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral32
Sample
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/source_code/bsod.py
Resource
win10v2004-20240709-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target 3816c836b3af21fcc7f05a71ad13b17aaa110be1ecee68aa18c22bf9729bca48.rar
- Size 80.5MB
- Sample240730-btql2s1bmp
- SHA256 3816c836b3af21fcc7f05a71ad13b17aaa110be1ecee68aa18c22bf9729bca48
- MD5 aa1230d889daca352561f898d83aa329
- SHA1 35bc6b912cfcdef424aa2835d9421f0ba5d6d302
- SHA512 ecd08913e085f0332dd3a8b084384874d50940f6aada756ac6b72c65dffaccc65cb702f7887bca2874d97680bf611322599455e635c3795b57b081ee2fe36946
- SSDEEP 1572864:OVIyO5+l3RqxPbpxqz/uyyQFUBLVLIhzLowtp/sADMhNUw2A5e9:fd5+lhqh/07LowPDWle9
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detect Pysilon 1 IoCs
resource yara_rule static1/unpack003/source_prepared.pyc pysilon - Pysilon family
- Patched UPX-packed file 1 IoCs
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
resource yara_rule static1/unpack002/out.upx patched_upx -
resource yara_rule static1/unpack001/Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/upx.exe upx - Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/Phxnt0m-malware-main/Phxnt0mware RAT - main/tools/drawling_studio/Runtime.exe pyinstaller - Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/libopus-0.x64.dll unpack001/Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/upx.exe unpack002/out.upx unpack001/Phxnt0m-malware-main/Phxnt0mware RAT - main/tools/drawling_studio/Runtime.exe
File Explorer
-
3816c836b3af21fcc7f05a71ad13b17aaa110be1ecee68aa18c22bf9729bca48.rar.rar 80.5MB
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/.github/ISSUE_TEMPLATE/bug_report.md663B
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/.github/ISSUE_TEMPLATE/feature_request.md458B
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/.github/ISSUE_TEMPLATE/if-you-are-unsure-pick-bug-report.md616B
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/.gitignore288B
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/CODE_OF_CONDUCT.md5KB
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/CONTRIBUTING.md165B
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/LICENSE1KB
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/Phxnt0m-linux.sh.sh 5KB
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/Phxnt0m.bat1KB
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/Phxnt0m.key1024KB
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/builder.py30KB
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/compiler.py4KB
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/requirements.txt384B
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/__pycache__/discord_token_grabber.cpython-311.pyc17KB
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/__pycache__/protections.cpython-311.pyc1KB
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/crypto_clipper.json155B
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/custom_imports.ini1KB
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/discord_token_grabber.py12KB
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/get_cookies.py5KB
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/icons/discord/messagebox-exclamation.png.png 576B
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/icons/discord/messagebox-info.png.png 791B
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/icons/discord/messagebox-question.png.png 1KB
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/icons/discord/messagebox-stop.png.png 921B
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/icons/embed_icon.png.png 1.1MB
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/icons/icon.ico195KB
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/libopus-0.x64.dll.dll 431KB
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/misc.py2KB
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/passwords_grabber.py4KB
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/protections.py1KB
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/source_code/audio_control.py3KB
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/source_code/block_input.py2KB
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/source_code/bsod.py766B
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/source_code/crypto_clipper.py.py .js 4KB
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/source_code/file_downloading.py4KB
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/source_code/file_encryption.py4KB
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/source_code/file_explorer.py9KB
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/source_code/file_removal.py3KB
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/source_code/file_uploading.py6KB
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/source_code/fork_bomb.py827B
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/source_code/grabber.py6KB
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/source_code/jumpscare.py1KB
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/source_code/keylogger.py2KB
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/source_code/keystrokes.py1KB
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/source_code/live_microphone.py1KB
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/source_code/messager.py6KB
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/source_code/microphone_recording.py2KB
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/source_code/monitor_control.py1KB
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/source_code/process.py18KB
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/source_code/registry.py2KB
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/source_code/reverse_shell.py4KB
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/source_code/screen_manipulation.py9KB
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/source_code/screenrec.py1KB
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/source_code/screenshot.py891B
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/source_code/texttospeech.py1KB
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/source_code/webcam.py2KB
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/source_code/website_blocker.py3KB
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/uac_bypass.py1KB
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/upx.exe.exe 550KB
-
out.upx.exe 2.0MB
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/source.py.py .ps1 33KB
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/to_uninstall.txt969B
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/tools/drawling_studio/DrawlingStudio.bat1KB
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/tools/drawling_studio/Runtime.exe.exe 80.3MB
-
discord_token_grabber.pyc17KB
-
get_cookies.pyc10KB
-
misc.pyc5KB
-
passwords_grabber.pyc8KB
-
source_prepared.pyc180KB
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/tools/drawling_studio/assets/create_new.png.png 1KB
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/tools/drawling_studio/assets/icon.ico186KB
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/tools/drawling_studio/main.py7KB
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/tools/drawling_studio/requirements.txt14B
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/tools/drawling_studio/saves/previews/skull.png.png 2KB
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/tools/drawling_studio/saves/skull.drawdata27KB
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/tools/drawling_studio/studio.py10KB
-
Phxnt0m-malware-main/Phxnt0mware RAT - main/tools/splitter.py817B
Phxnt0m-malware-main/Phxnt0mware RAT - main/.github/ISSUE_TEMPLATE/bug_report.md
- SHA256 a3fcb9ae407af1d5e184a596ddf5f0dd33496270e4c3e6c6afd2a01bdf04635d
- MD5 96f71782377a9410effbe9494a6d4219
- SHA1 0da1fbb996774912df324a5f3f6b23d9edc8234b
- SHA512 7d2dbd60fe33a2f1189f272f0f1bb3349c362988a2d097548bdc36f432cca468280d2bae627bddbdd47ac7fceaa08a8f03d538beb478e3725e3521c82db569e8
- MD5 SHA1 SHA512
Phxnt0m-malware-main/Phxnt0mware RAT - main/.github/ISSUE_TEMPLATE/feature_request.md
- SHA256 2af8493da3d1efbdaa84cc027e8612c8d9cf50b248baf4d9431605eae2bc08e6
- MD5 98e2f1fa0f8345256a1fe8ac4c4c1034
- SHA1 0fe644265463ad4ae31d51c05661479f31ea6b66
- SHA512 583f27da9fe06b5074d224de85249127d6e4f19a406e05810330e501b102c2c9a25dcf00ba24417fd32b49611d6a1c22c3613d5d704babf7bfe69a68eb67f1b4
- MD5 SHA1 SHA512
Phxnt0m-malware-main/Phxnt0mware RAT - main/.github/ISSUE_TEMPLATE/if-you-are-unsure-pick-bug-report.md
- SHA256 64a2ef3bde1fb3ba96d864a08cd013c70f89b580aa88cc8776cc29d0f3522196
- MD5 ffcbed7dc068db814d35171aedf0954a
- SHA1 4fa5fa245d94f8a3b791f22a96f50eb734005d6e
- SHA512 ceb2a922ed5f08ec97140cb9320436f12e755bf848ee4b47af1c014054ef0424298b0de51a8b62d57eab2c868ead0135926cbf61090481ba697705cb316f8581
- MD5 SHA1 SHA512
Phxnt0m-malware-main/Phxnt0mware RAT - main/.gitignore
- SHA256 df8ac303f25593185dece7621e2dc1b637d54c564218bcbcafb03c059c68aaab
- MD5 39b24fbab6a19186c4ef2d013caf0f18
- SHA1 c9cce4b1e43150d07f71a4a837ea2d4b3a4f815b
- SHA512 503485b01c55a3e534829f140467f9c0e393e9cd17735f3353c56b8cd9255c3adb57dcb31f230b077d273af8c627c13f3aa39eb096afe3ba1ceb7332e142e1b5
- MD5 SHA1 SHA512
Phxnt0m-malware-main/Phxnt0mware RAT - main/CODE_OF_CONDUCT.md
- SHA256 88504558eb3470566208af69870487d373e6687575e8c9b9863f517f16309d81
- MD5 6d7c9a9ca1d12ab5b70d16119a32fd5f
- SHA1 5af9310f2682fc8adb74b019b8a5256c60a93f38
- SHA512 17653bc94d98025ea387063e8f218e76cfe088ff3dc8eb7e7f8395a3bc7ad27d0061f6b7bb528a72b14359012874addfc91f562fa9be5b7c68f7bfd4ec9de95c
- SSDEEP 96:b1kS+vFNKWIdGPWFR0sIvBw15XVwqTsS7rOKIjFwoqHoPFTORFq/FQLw5cVGqbfy:iS+vFNKW+kWbGmX7wNjFwToPFTUFq/Fv
- MD5 SHA1 SHA512 SSDEEP
Phxnt0m-malware-main/Phxnt0mware RAT - main/CONTRIBUTING.md
- SHA256 e771d7f57d38fed778027d4d3f384badc7e05f8748203d4f9d7d8e2835c243ff
- MD5 8ab1e28d114995ce24812a0ad4a1f656
- SHA1 c1ecff0257fd4b9c1dbcc75afc20f2e0b9ac9bba
- SHA512 60d44f85948eada52da0c10fbdbb0862167e2176b2351c67fce2683c404bc00b9c58977a3c3b67e678b41c777e4f593be34bfcb99dbfbbff0e9e3e13f8d01f29
- MD5 SHA1 SHA512
Phxnt0m-malware-main/Phxnt0mware RAT - main/LICENSE
- SHA256 58045177698a758937ef7413cfab4a8cc899a7f5bc928aad664f1f60fd7bfec3
- MD5 4cc14eb9bf594abc89273738d175fffc
- SHA1 2dd77b6ab730ce7aedaf3404a8b3f7ccd5f5aab0
- SHA512 bcd7175ae6c9a68dff6942b6fe504b1df0b44a1b0e0c4878f4974135da1beb6c07d0c6ad70c64ef0f0de36d74902e3e1ec3a1b9388095caff210ed95e3a0d809
- MD5 SHA1 SHA512
Phxnt0m-malware-main/Phxnt0mware RAT - main/Phxnt0m-linux.sh
- SHA256 c0eca671a36668a9f53b221ba1c96f28d879d0c36931d3d01df75f6b40f753ff
- MD5 371121f4ce94ddaddc31bc515acc3711
- SHA1 5f0f63683a1c7c2163410213c0f5b4b10aba5cb3
- SHA512 809b242431ab3235c5c2f787ddfdf7e7bbec140f6bcb14bd2ab168c74a06e7d3137767f1410dc670f794fd058063fe002dd6f297165d5c10883ff9503b10cc93
- SSDEEP 96:dRnU5upT22O4adoJKHKL0kKEcipK9pmDEKvaoGBlooYsvz5m/iRfA:dDTs4UoN0ODRaoGBlooYIz5m/itA
- MD5 SHA1 SHA512 SSDEEP
Phxnt0m-malware-main/Phxnt0mware RAT - main/Phxnt0m.bat
- SHA256 8471cf270c69ff4732b3f46198e1bdf45749f65e776668748d1d6b5d6bce7366
- MD5 e98a74889cdd6ab7fa93408baaea820c
- SHA1 61f61cbd04ee18fe62baa0120a786b90f967c4ee
- SHA512 12a75cf9e332c7bb311a65c363d19774142973b23a682ceb36615be2fe4644fcc7605ba0ce80fc0e12f944ebcac1221fd3fb6402b41f2d2d698ffa620e94be1c
- MD5 SHA1 SHA512
Phxnt0m-malware-main/Phxnt0mware RAT - main/Phxnt0m.key
- SHA256 eb39dfc09ef634502d7994e6ed2ea0f604ac769db068338958289ec4aaebd78e
- MD5 c22afc4d23c630bc2fd0771e98ca3388
- SHA1 be043799dbc604194fa0d277481223acff180ddd
- SHA512 a3ea9e3421b9bc2d7e3b4d054a27fd0ef28f203399a1bd8f34ca68db2dcdde115e1657a54ed716e46fa2aa7d30f3b0a51b8f12926a4a4335a1e17e6ab3bf9ff2
- SSDEEP 24576:Hure/4xAGjuxbYDjHyczDdK/6ZEfOewTbAPo0pMs:HAARYHyczDddZE2kl
- MD5 SHA1 SHA512 SSDEEP
Phxnt0m-malware-main/Phxnt0mware RAT - main/builder.py
- SHA256 40b61be6c4a3b1db0ff9e15c5f2b4fc4b3d73f2cb1ff8d72fa3911675d77a70c
- MD5 83842bb08cd7cd8f058dc5f6b498b08d
- SHA1 c51b61a539edbb04a52f726891bf0ab8ddb8e87e
- SHA512 109b3b37040a2dc167d2955fb8128302c84e127ad3fcfb755f4a153b4d84a3fb491cbdb76389d1a02743f7062ee4b07229a379ffefd04d1447dd0a4f241695a2
- SSDEEP 768:d2PufIVSZvFWL6sQhHqxFgYP0kqhvqeju:d22QEZvMLdSHqxFgYP0kqhvqei
- MD5 SHA1 SHA512 SSDEEP
Phxnt0m-malware-main/Phxnt0mware RAT - main/compiler.py
- SHA256 c150810979028bc9125f1a4044f727c064d24cad65fb1e57a9e06b0569cef203
- MD5 1f88d64859332188cde37d171a89f68c
- SHA1 0d90f3fd264cdaf0e79b08b9e23e768556538382
- SHA512 b885df0e8e9eae7a6252e56448c9900c799ebdcf71e3498ea7a19229c3be4083c76a02716913b77cad9806f8edf2c9ba6e6b542aa088f4855691b038a7086d6d
- SSDEEP 96:ODwmTAYUtPvMjoDpz0I9dwsKgwS8n151QqYrAFUetud18ZCrGOc+L6v:O6YUtPvMMDIul+tQT0qe0w+L6v
- MD5 SHA1 SHA512 SSDEEP
Phxnt0m-malware-main/Phxnt0mware RAT - main/requirements.txt
- SHA256 d63b7fffa964334fba1e583407f19f21a3e79f535f94616606c7984bb8407aae
- MD5 99cb7c25939b22087ce054f8b2cee7e5
- SHA1 a9d1076f5db1c44b15fbb6cac3ef378964bddeb7
- SHA512 80620c05da85e4e52029f82ecef7a457cb94d4c13f42b4c2db565f60c4bf60946a559f8c21b6b789d41bdb3e69bfa5c1cbe06bc79e4c9ff8b4cd0681e73ecc10
- MD5 SHA1 SHA512
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/__pycache__/discord_token_grabber.cpython-311.pyc
- SHA256 b692ef85a75468a8a22b6972028b2e59ada33f69c7c91c68fa176793e31ac7ed
- MD5 6f3eceb15c82bec23053daf172029efa
- SHA1 85c9d84e4fbd99d19ade72a41055489a3dc1c038
- SHA512 e6178706eaa78fff9ec9e077b79ba5c8cc1ce78ec3dd79fe5525e5d0b266e6155993ef1f544cb5fcee8fdd3336d2de8b696059d2ea400b45736ebcc32ed81f03
- SSDEEP 384:bGOlyAavwR9F0Rn8wyTPQviowoYbJNcWWIc05S:bvlytv49iRn8JQ6owoY1NDd5S
- MD5 SHA1 SHA512 SSDEEP
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/__pycache__/protections.cpython-311.pyc
- SHA256 481b96d5f13eb905b0f8ca9c958bfc20058d2951c84c48977b10db9a80c0aa6c
- MD5 7c27b5bd86b7bc8bb9994f8a6a544882
- SHA1 865efcafcdb3c747a1b03908656f94ccb3767759
- SHA512 3023c662148a70ec5588bbfbf6361d186f70f64f202b3c81963ca6f82073742fe196651f85c9d1f9d5e92e8f537a0e0f0f44aca3a17b646499a4d4ffd78bb72d
- MD5 SHA1 SHA512
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/crypto_clipper.json
- SHA256 3f7446866f42bcbeb8426324d3ea58f386f3171abe94279ea7ec773a4adde7d7
- MD5 8bff94a9573315a9d1820d9bb710d97f
- SHA1 e69a43d343794524b771d0a07fd4cb263e5464d5
- SHA512 d5ece1ea9630488245c578cb22d6d9d902839e53b4550c6232b4fb9389ef6c5d5392426ea4a9e3c461979d6d6aa94ddf3b2755f48e9988864788b530cdfcf80f
- MD5 SHA1 SHA512
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/custom_imports.ini
- SHA256 d71e64cf2c7e567a25dd5930d7eb7c189ce507aecb5365d5bd9e56b644a77c52
- MD5 25a7e616c94f4bef3782ccc1b1f30a28
- SHA1 3141c3a5ae4641c9e072fee9a401b9d2985ac36c
- SHA512 3385a75f3a375118103c0f4f5e455db07e56a9dfd7edeadef2f7b4a44380cfe9a9edd5f8af1a3b0a2a30d4670e9b565ec557de8707f7b0dbb9d904a7b0ebf37c
- MD5 SHA1 SHA512
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/discord_token_grabber.py
- SHA256 09b16591c62127f39c138f3d36537d5577042ee9349bd9bca075a0c5bb13c823
- MD5 32c812c4d73d3e3e2fb9ae35e6262dbe
- SHA1 37525639cc07d60bf39ae7c50be248b7ae7832e3
- SHA512 a1f8f0e08bcfd36b6fce4c3d7e9322692e57034f918de3ff42bbc6d30fe6a59e01c52c4276235a23000e3b1f230b44224ebfc34ef466d6c410081c28bea8a139
- SSDEEP 384:xP2g/IOwWb1IdsvxtMwv3tMwvQk6fi3sY5Gl4:1IHaZt7vt7YVfi3s7l4
- MD5 SHA1 SHA512 SSDEEP
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/get_cookies.py
- SHA256 50659c02385bd90d268e5c9cb39710d99dd84dc9637b1cf1eeb0413fb624f763
- MD5 9fbfdf3363bef58201cb58f8c47a5c90
- SHA1 c932298a07c455b468bcae7b3fa4868aef5fda02
- SHA512 98d62d0403377dc0a40a9d400bea0d394e972659be0d12360cc398681fc8f1ee3de7aefa7ab68c2fa17081e7261466e233d9760012f1c27b8f309ead964743ca
- SSDEEP 96:kXFbaDLJC/3LPAsTyjHJ2uCE/Mz5ClOla+lfe:kVbsVMEakDCE/MFCsc4m
- MD5 SHA1 SHA512 SSDEEP
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/icons/discord/messagebox-exclamation.png
- SHA256 b125684daba9ba96b9fefa9fedcb6b38605865900d2a3b93428837f4f877dd77
- MD5 4a185bfb51de436b62b0464701e90e09
- SHA1 5a7ac91bd071ff3bef781372cd4fffbc874e099d
- SHA512 0c2b4eeb5154fcf469df5dabbffed9e865b20207b8324c731ba0560c42ea8a1b3d2cbeef8949b50d44625752589666d6c4a0a0f370cf55f0d7909242947f508c
- MD5 SHA1 SHA512
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/icons/discord/messagebox-info.png
- SHA256 fbd7489f6a400857dccbda670a5d9e000be67f85fd5c03cac2a84e7243ccdd53
- MD5 cfc54f93b2f07f950517251d4665745b
- SHA1 73febe0d844a0e3116a2c8df03f198543d46df0c
- SHA512 8c86844e4e2b9f6ed51c631730e72f563c5a219c56c0296934bcab8d2c5b8756f04c826b2c1acd2af998795672d41dd04625e76fab4d273ebe65f550ce94a381
- MD5 SHA1 SHA512
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/icons/discord/messagebox-question.png
- SHA256 00554f4ca35bf4c5e05b6fbd58491127c0e293c321ada7c0e540d6d9cc3daff7
- MD5 d5739502b65a61c1eb661329efbc87e3
- SHA1 49721d2f2b62c8109402d3f4117af56cce5cb965
- SHA512 25a8e0ab7e0ec257e55c5758c2cc819d8ad1faa0a23a279294da968b13d7f60ef9eb314c98a960d21d800396d61f9312f9dc3e0f6678b2e9e62705cbe28ff791
- MD5 SHA1 SHA512
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/icons/discord/messagebox-stop.png
- SHA256 c53ce4b3d55f07a0b4e9a54376c86da0866ac46020b0604b1eddd79afe1ba5fb
- MD5 3d9b339c0ce2077a6b7a0d8114157f3a
- SHA1 74abf4ce2a50a15b13f9638788e99ca5c6727e22
- SHA512 84f39d2d0347c44cd5055c4fa30ae10e9ef71080e26b6f691f3fd231fa6f6e528521a08d8c809caf052e703cc2ab0c6f251c070f6241d7044f7b05a902e23d46
- MD5 SHA1 SHA512
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/icons/embed_icon.png
- SHA256 17ad5fe654f447f730b97be8f95e3807351229ea9ec9d01ef1005ab7067fbd66
- MD5 c5bfe851c61b792b3540c9e80b75bbce
- SHA1 be11792f8e5ad051225f031847762be0bfcad607
- SHA512 76f8ae89b93a4859fcea2300fd220e18acf7e27851ea7c3e000f3d277b84aab2d50c6f809e265054cdc605f1c14f71b12186c3191b03e42bcecac7d2f3dc112a
- SSDEEP 24576:wsorGRfFnLZbsY1h5NnY4oDJLcRG0hdpixLGqNQ4FQiG79h:wsnfFndhHOg9hdpRMQiy9h
- MD5 SHA1 SHA512 SSDEEP
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/icons/icon.ico
- SHA256 69b227eec2e2d1cc39359df152e5f4317fd0377559945b08ccf3a0645fbee25e
- MD5 63deed17ae81e709e0c9433a501603ab
- SHA1 8baa4914cb03c07a7edf5526965e067aff8c7ed0
- SHA512 3ead28fe7a9ab1905220a42f3ecefa96d08a1592d9651f2cbd519fbad335d50606671cf5fdce084569b21ba6f7cc762fd58be1d69ef963f501d9ee8326be5f33
- SSDEEP 3072:+DCqtiuO6VNdM82/vU0uo6EP3QsGgOOxKRWBrrFzpWPUJuZpNrWxhXUJRcBw/X3g:AhRjMVUpECCKRGpWsJerkUVXFC
- MD5 SHA1 SHA512 SSDEEP
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/libopus-0.x64.dll
- IMPHASH a16037b80461374dbaac126287be81b9
- SHA256 c84da836e8d92421ac305842cfe5a724898ed09d340d46b129e210bdc9448131
- MD5 0e078e75ab375a38f99245b3fefa384a
- SHA1 b4c2fda3d4d72c3e3294beb8aa164887637ca22a
- SHA512 fa838dab0a8a07ee7c370dd617073a5f795838c3518a6f79ee17d5ebc48b78cebd680e9c8cbe54f912ceb0ae6112147fb40182bcfdcc194b73aa6bab21427bfd
- SSDEEP 6144:QzvQP4JEH+xiPuym+Sl1AhOtw6qIUZtvJd3dbK2lbO2miHWQAD03N3hg9/To88jC:Q6Ho+8p0IU3BW2s2miwmOLozjJ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
275832
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
InterlockedFlushSList
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapAlloc
HeapFree
LCMapStringW
GetStdHandle
GetFileType
CloseHandle
GetConsoleMode
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
FlushFileBuffers
WriteFile
GetConsoleCP
SetStdHandle
CreateFileW
SetFilePointerEx
GetStringTypeW
HeapSize
WriteConsoleW
opus_decode
opus_decode_float
opus_decoder_create
opus_decoder_ctl
opus_decoder_destroy
opus_decoder_get_nb_samples
opus_decoder_get_size
opus_decoder_init
opus_encode
opus_encode_float
opus_encoder_create
opus_encoder_ctl
opus_encoder_destroy
opus_encoder_get_size
opus_encoder_init
opus_get_version_string
opus_multistream_decode
opus_multistream_decode_float
opus_multistream_decoder_create
opus_multistream_decoder_ctl
opus_multistream_decoder_destroy
opus_multistream_decoder_get_size
opus_multistream_decoder_init
opus_multistream_encode
opus_multistream_encode_float
opus_multistream_encoder_create
opus_multistream_encoder_ctl
opus_multistream_encoder_destroy
opus_multistream_encoder_get_size
opus_multistream_encoder_init
opus_multistream_packet_pad
opus_multistream_packet_unpad
opus_multistream_surround_encoder_create
opus_multistream_surround_encoder_get_size
opus_multistream_surround_encoder_init
opus_packet_get_bandwidth
opus_packet_get_nb_channels
opus_packet_get_nb_frames
opus_packet_get_nb_samples
opus_packet_get_samples_per_frame
opus_packet_pad
opus_packet_parse
opus_packet_unpad
opus_pcm_soft_clip
opus_projection_ambisonics_encoder_create
opus_projection_ambisonics_encoder_get_size
opus_projection_ambisonics_encoder_init
opus_projection_decode
opus_projection_decode_float
opus_projection_decoder_create
opus_projection_decoder_ctl
opus_projection_decoder_destroy
opus_projection_decoder_get_size
opus_projection_decoder_init
opus_projection_encode
opus_projection_encode_float
opus_projection_encoder_ctl
opus_projection_encoder_destroy
opus_repacketizer_cat
opus_repacketizer_create
opus_repacketizer_destroy
opus_repacketizer_get_nb_frames
opus_repacketizer_get_size
opus_repacketizer_init
opus_repacketizer_out
opus_repacketizer_out_range
opus_strerror
Name
.text
Size
319KB
Virtual Size
319KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
94KB
Virtual Size
94KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
148B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=260, version=26715,
count=15, id=259, version=26715,
count=143, id=261, version=26715,
count=30, id=261, version=28427,
count=14, id=260, version=28427,
count=8, id=259, version=28427,
count=3, id=257, version=26715,
count=85, id=1, productName=Unmarked objects,
count=147, id=260, productName=VS2019 v16.5.1 build 28611, version=28611,
count=1, id=256, productName=VS2019 v16.5.1 build 28611, version=28611,
count=1, id=255, productName=VS2019 v16.5.1 build 28611, version=28611,
count=1, id=258, productName=VS2019 v16.5.1 build 28611, version=28611,
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/misc.py
- SHA256 98c3c9e981f91b6eb10db0217a16da8c7ba0891e6ad392061d1332fe4af96742
- MD5 d6a7a397e1626ba1e7346f890f31866c
- SHA1 a8d2e69bb24c287232a22055e0333c6da746853f
- SHA512 dfd6f95aee07e1845e0a475b8473f92d73d03927e3835facb3c9ebebacbd4d34725dd26d63419d0b6e06a999d71c22c99e2697db585e19f397d15ba747425b6e
- MD5 SHA1 SHA512
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/passwords_grabber.py
- SHA256 6bae31f78fa66e73da3a5d7e7e489c4c79d36da8811fa94d5bbf052eb3d28f86
- MD5 d501b318f5df2e0c18cef8a64161326b
- SHA1 8d3d44fce5a9df6fa728f6f090e0a6c239c90736
- SHA512 683f2d34a12712a65a293d7b7ede3028a52ed0f5aebb6a9c18cbeafcfe769c20b07e7db2af31edb60f4ac870c2aa16a16a625270242ca6b9dbb30f740b1f6340
- SSDEEP 96:D9b569f3ItMS2tdNWkOHKy0BZfnMJ6dHZdgoLHZtU5jNEYDmbVjp5t:Dl569f3wM5N/OdcZvMJ6dH/bZtUjFDGV
- MD5 SHA1 SHA512 SSDEEP
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/protections.py
- SHA256 8370294651cf9164b5183033e0adaeb3fea820359f9652f06713c135cf549b59
- MD5 f5f7860862ff9026ae5ef626ccbf7c59
- SHA1 f0b9827394cc388ed07b9cbdb44b8aafc3b44820
- SHA512 24553294f40b295af656ccd39efedd905d6fe9d68fb78e0b4311f22907dd1b6faf2f9f37bd41b0a163a9e85d5c6a88dbb7c54226822199c9f85efaeac68fb0e1
- MD5 SHA1 SHA512
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/source_code/audio_control.py
- SHA256 8e0215b86d28004669b753cfb74cfff423cecbfcf096cceb505c14fee8218846
- MD5 b6c9921f89e0a1303540bd69b720b70b
- SHA1 0f56471b662eed145ccff20f52671971131d06f0
- SHA512 463e21d25bc0d7beb700c2147a4ba610fec9755d3b1932e572a6c61e33bc47653bdbc6c4619bd6313c712f2c1b1a9776f21661a437fd58df4c0d4616aa98675b
- MD5 SHA1 SHA512
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/source_code/block_input.py
- SHA256 509b26dcd0ad875488bcbebb4d0a9bb8e54d1d05f3cd8b068022b85ab4a1728e
- MD5 5f2bdcfdb6d04d162edbd0be7322ad95
- SHA1 7284ac9b666a14210a4c9257c0fea1e9e2feaf27
- SHA512 2d08d4bfc2baa40b9c1a4d9d429f3330965ed4ecc4a6819f9601e898767adb45b9c03cce1c10cb6f1656b5fd6dc4bb37f4a989db5a44ec2f1d4916cc220c0311
- MD5 SHA1 SHA512
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/source_code/bsod.py
- SHA256 86e238d4f2dfadf749771d4ce074e7ee5b230b7a5a25da7079e513e9f3e13672
- MD5 de3387113c8294dca0fe4073ee3a5034
- SHA1 f5451d1cb8a0741427bd1962101661f8b6fcd218
- SHA512 e9f84b5a9f63fb3418e98b6e4eefadcc9171188ec0558a4dad89baa32753295b72f29397296af54b25d7c642a960126c8e89f78c88ebc13b2200ff63605ba539
- MD5 SHA1 SHA512
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/source_code/crypto_clipper.py
- SHA256 fd78ba2e7c4005967db1098108105fbe0fea61a6e2b1643f5ce62727c4394d24
- MD5 4cc54ef515902dc1253fed286c2ad680
- SHA1 000614cd1d751ccf27a19ade34bfaf91523937c2
- SHA512 9f22c50bbb9597ce6d42a7f0325e7e38a71c0f33a7ca9fcdccb17ef3d9fd6b8c9a071f3a0887887e2aeeca13d7f63c03862c42d92e93046861b0d2c0c1c4142c
- SSDEEP 96:a1LoVOBa5ASQtCd45yO5HvgyKo/WzmLTwM/vBSLUrPlb/WZ//tXM//0:xOBa5ASQtCd4IO5Pv+tMJTZ+h/pM0
- MD5 SHA1 SHA512 SSDEEP
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/source_code/file_downloading.py
- SHA256 1d89ebfa0b1c844dc8b0b2beda119d3e20e41f4acb041a24321d6288842b1dce
- MD5 852567ae61dba1c96068219b7eee550e
- SHA1 5fbc4c2f31a727240c042835a5915a2948d9091e
- SHA512 4fa944632e9912dd826806b0f52831971dd27ae1ca39258cf83045eb62ceda3a852e6d352607e16c5113520241709bc829d9412fa0aba999738a8ee35224dfcf
- SSDEEP 48:eYQn45DIAQYhvOiFjjn80sUpSN4G58mVQk6uo/ifQ4hvrYqy5Q4hvj:eD4lphJjz8M0CG58ma61h8Jh7
- MD5 SHA1 SHA512 SSDEEP
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/source_code/file_encryption.py
- SHA256 ea8ad992b500560cb126c2c3f48c0da8634a5a997e69b76e3a21004a83f6c043
- MD5 7960f98bb360b54894b0c99df58937d8
- SHA1 d5f43b1d210f3c1705603435e3eaea002b71f313
- SHA512 b602699562c7de76c20b0df8226c7a5bbf62c82ec233d25bb79133e9df7f56c3cc91c1dd27c7dd4bf2075a6d646fbe8c5b51deca68558eb776ec898858015d4c
- SSDEEP 96:9Vdbhfp0wt8S0lZvHim+lzvH2/hUndrhtvH2Do6vHiNES9+2sh3:9TbL07S0lZaVhoidrTIo6a20sd
- MD5 SHA1 SHA512 SSDEEP
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/source_code/file_explorer.py
- SHA256 f4ed8bc78e3ac19f896167b6a18a69c6e20229acdb4065e1b5fb7480042b8704
- MD5 6489665089eeadcd8ad114894372918a
- SHA1 4fb393ac43159fe146a1c0999e7469f33735c1c6
- SHA512 ba7371c5e69d2fbe54fd76faceae6fbc1e044ca93fa19f2632083917ecf1478273f17490b4defdba9c7a436368012d83561dd2121e54cc6ba2882b04f4f706c4
- SSDEEP 192:p614B6PihNpd3xTSALNBP4N0NtKBkm1pEBZuldQByQ8B4:pu4QP0Nt14jum1pEBZulCs36
- MD5 SHA1 SHA512 SSDEEP
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/source_code/file_removal.py
- SHA256 cefa3628aa86e325a5e6c5593d8de8a3e29b15443c835f66861efde6996093fe
- MD5 225a4b122295b891eebfa1b587063fca
- SHA1 368d0b6ea5c3e0aa8b9fafbe79ee2f99d8c85c99
- SHA512 1f22823f6c9877eb8666224069d2eed45896c3314f9fb2d6cd36aab9dad1a49569c0047604822c4f174399666793538c630fca69f16541bfd03a3fcb78301efe
- MD5 SHA1 SHA512
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/source_code/file_uploading.py
- SHA256 b5f48d20fd03e01c30bba0be34f77d5097d394649718608c55eff55a3de624a5
- MD5 c39b1345d3e78ed3742f7a25ae6915e8
- SHA1 671236856b36a8cf0713a39bbffc7eaed87e9ae9
- SHA512 8aed090a15d9f42d3bf37fbdca47da52b220684c1cada4a9a78c166139a68c8c82c7233059b343482fd3b46d2defb0d9a45b697e300bf39b1d55e301acdab8af
- SSDEEP 96:J7leTgjgsVTuc7ZWgy8LOF15Ql4Z0u8mzJPBuaVaabhsXg:JMctVyc4J8LOF1+4ZamdPBXUabv
- MD5 SHA1 SHA512 SSDEEP
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/source_code/fork_bomb.py
- SHA256 e31e071a5d81e780cca157d0c01f44be6ffa3090e84efaba8cedd3dad38003a0
- MD5 9ce5d1c6d2d808788fecc96f1bc1ae7e
- SHA1 4cb06cd5da1fb76b6890385f525842da5e8fa3ac
- SHA512 7293cd659aed9dc8e4884f20a7f5c5a9ce14a6128a56fcd35f6cee5acf0de920b229e88a07fad75daba4e0563da06432d78cd6f9d5b686c4aee52466a6f16bbc
- MD5 SHA1 SHA512
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/source_code/grabber.py
- SHA256 5365e09895bc90cc6a9290faacb9f50c96503c36d55a0d0d1c389ea6871a8e2b
- MD5 739285967afdab5c47778d822f4bbdec
- SHA1 182fad8031b711aef97bd61b1fe9946f08b80136
- SHA512 a3712021cda79642c26d46a8bd08ae6aaf5d49d025b272968354a6e020a0c933d9a8212602070e634d570f484b42bfa99bd6c6016d7937fd3fe9919c1b8bdd88
- SSDEEP 96:QHyVVfWBEGF2d92hlMgT5whHGWBM18o66liwYkCeAh7Y76dgj5QhyxMFN:e6JG692ff+IWBwiSAu+WuAxG
- MD5 SHA1 SHA512 SSDEEP
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/source_code/jumpscare.py
- SHA256 cfc4c572be88f64170db5208c8d2b649f211fecea556b26a8c5ad06e2591c844
- MD5 384725d5fb46366dda75ca62e06f6ae8
- SHA1 f2b4bb70418c4f5306d34e0e83a3ad6e530d0dd9
- SHA512 2fd1060f4cca56984edcc167fa7eeffc23ab6a14b102a53d71444df1ed1085ce91dfbf0773e6bea67fe1259f474b8f6a0c39b95e8ab884e9679cf9339a190c3b
- MD5 SHA1 SHA512
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/source_code/keylogger.py
- SHA256 22bdcfc14de5859bb365b030ce6908dc907bf937b1c23ac5bd9a990fbed8f7eb
- MD5 607c5ab6acfb5d0296b33cb8508235ff
- SHA1 278821eccd74ed40025373e5e1e76fc6fcf3c731
- SHA512 481bddf9ab2f81b77befd6bdb171e574a1ec0a90ee254cbc3302ae105b43b6f85f2ca850d8aff2cc95f3e4a5a7fac38c9082c7ffeb94e1a32f26c3c0621f1cd6
- MD5 SHA1 SHA512
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/source_code/keystrokes.py
- SHA256 b5ddb0a1d4b0f0f2d9648c205476c126163f4552c2ab4686a38586ca092d5edd
- MD5 b8027eebf8e456175339b6dc2b4ca14c
- SHA1 3ed48a6a02da6aaf33a0393d7165ee57d17c0265
- SHA512 f731ca79be4960c01daf69bfcb864796fcb36fb546b299c3c1de509f767ea3e9e01a0e389310fb43a4bd1abb2d5319946e5fb258acc0183c359a1f0bf1fbc192
- MD5 SHA1 SHA512
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/source_code/live_microphone.py
- SHA256 a68b5a0e6b1c6e46f80a5962841b70aec5223804fd7f410dbcab5bfc3f2f8458
- MD5 35e358e7c2961731d01cc43813be4fb3
- SHA1 416502fefb5447b717f5e9705ac551c9efe01c34
- SHA512 dff36b4dbdbf3692e5484dcad071df8082dfaaf904d1342ff67bb703f4664829cbc8ec96b6b00fe9d0b1adc468a277b46cbba9618d6ed5374084cda9ae40560b
- MD5 SHA1 SHA512
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/source_code/messager.py
- SHA256 295fda6d112f4d063869fc8e3f869755281ca77506a8b202708b5d42be434d5c
- MD5 2868ea74f9fc0774d2b6ff3f65830a03
- SHA1 bdb982a5702fe829c89e9a3464ff534ee6d99c9c
- SHA512 151963d11764da788aa93062128bf876c45d8dbe4000129c16b6981f9d84e3efde4ba2d5cd5f548b516a74c5b60d2e6377895a7d8d9aab544538c150c10d26e4
- SSDEEP 96:DrXQ4YHp1ZlHEXHij8W9hhwDDnH5eZlHEnHqoj6d/orHMO8/JlDQ+HzWUwy/khmO:PQlNV9MfZO1dMoNWCs1
- MD5 SHA1 SHA512 SSDEEP
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/source_code/microphone_recording.py
- SHA256 e26c391e308216b2a3edf0ccd00ca49fad1dfa23919b65283998e0b222ae658b
- MD5 f96ff48fc180f1ff9061bfbe24e18345
- SHA1 04ef61dc7835254ea290adf02ce6c53417d8fc65
- SHA512 310b945dbf6f5140c91d5e8ff4687ebf465ad1310bd2c83854f07d0ec55ef61572f1c81b87576328ab5400f5a4a2b609e7c26c2ef49f75ffaeb8667b9d0e0792
- MD5 SHA1 SHA512
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/source_code/monitor_control.py
- SHA256 38e772019c14562c410d34b0cd61575aea4732f0ddf049e41d199800ed3fc865
- MD5 8b6627f4da686385b1209c97975cfcab
- SHA1 adc20c87f81b3d6215fa115af0fcb18ae2c7b22e
- SHA512 962dcabd2da7ddf753d0549081a88ef3a26d9cac5b729180a8253bae528ec39ee73bc6a4843d14591f03f5798d1706dca7967433cd47e9a5ea310dad2fa2c654
- MD5 SHA1 SHA512
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/source_code/process.py
- SHA256 9b77de8a32127a812aa3086a4192162463ec150df128d3da4cff6c2484f560ac
- MD5 c14ce0cb99efc40c6fbc634919ab27ef
- SHA1 3b7b0e55a9f5cb9f8b2a5ed9d73f67884581f239
- SHA512 b0e19ed71c3cb05eed311af13b02aa3b5ccff287f9871cc1448490b54ffb32a07bfddbcd9c36689fed4e954b3c67ca2ca6939495a6578f068ffb3bc34ac80d55
- SSDEEP 192:qOeP15yK+nEXP0iq5f03ep0nqpxYDYl/TC/Y8EeepxYDYl/TCVYLJ0LeHe0F7Roj:bA1YEfXnC/TCp2/TCLUeF/TCO
- MD5 SHA1 SHA512 SSDEEP
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/source_code/registry.py
- SHA256 986f39763903c012a9098055673ee9125a745f4871c700b68ff82e8c723485ff
- MD5 bc95e20bb32be6d3f08d2735c0dd2e60
- SHA1 3a9ca9cd739cba37f9fae7c61c505094bd124c07
- SHA512 d7d4f804282df338d28e0c5714c1950e0bbb91188cae50dc57e9a0d94464100bb319016b57b17fbc566ed1612db04a7a1b842d17f8a60c589f73b2f806d494a5
- MD5 SHA1 SHA512
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/source_code/reverse_shell.py
- SHA256 bcfb51771358c11da952af0e8918c7fe20f3e72070f454a0103341e9b3dda95f
- MD5 c344127361f7656ff059a9f3a94d4902
- SHA1 77b1c7498f2de0a6f071da69ed9463ae0e98c2c7
- SHA512 c49f33f22ff91655b1cc28d2e7c81cc82bc757d365c89c7c7327b7fcee5a939060eb96b6391f0b34fb74619532a7423fb7ed41c4bfea36e0b74f78e096bf2fe0
- SSDEEP 96:max2utdEYlZw569nl4B698i2dW5O8aKuB4:oeEYlZwY9l4B69Gk08arB4
- MD5 SHA1 SHA512 SSDEEP
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/source_code/screen_manipulation.py
- SHA256 243c867eb7527ad0548bb003b48a1756424f4b1072ea9deb41596b47ed445e83
- MD5 f916a1ddaac6d6506787d977cb3575f8
- SHA1 83f6b3cbcdf36512d69124a4d228fea005490e59
- SHA512 d98b3e7818c2325cb588490f6ab2bcb8175ead6ee4ab2c670411d2269b4a93a62b4ad7dfe751600bab2aeea3592a267cc03c96d2cc4df31cdf661e3e1cb70863
- SSDEEP 192:Nl+FyowYns0Gz1VaWHBAntY4bGeJMyI9W8AJOdZhvz2mPB:NsFlwB1V3HBitY4bGeJMyI9W8AJOXhvb
- MD5 SHA1 SHA512 SSDEEP
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/source_code/screenrec.py
- SHA256 f1981198750c1ce77daa6d578bc392e4bc7d6eda84d5958005e3921d269b1a03
- MD5 7640b0660a6fbab7b4dbec29348b265e
- SHA1 e8b3f10c02609a31258c2a3e50d1b762fb90e09c
- SHA512 1e7353444db588ad22584133e91dc934dfae3531131e103a1b589f64198d353fc2ecda53b42734988b6624ada8a693a577ea75f23317a578ad3f4d54ebc6b761
- MD5 SHA1 SHA512
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/source_code/screenshot.py
- SHA256 efe10d73cd0de804765331aaf0bbf35316dd492c0883d1fb943bb9c81a3424aa
- MD5 c28ae2501b0b43ab6b0d26e5b91ea1e1
- SHA1 caee21e9c05fc6470f38a8f50c1d0b3e2fd51823
- SHA512 218fe84f9f5ecd51e3fbe2ed687437d8fd1d55f1407ce6ebaec59dfb43ae5ccadd8b6a7128e98e895daae2a6e30155b7de632758f1e8d803e7d2322fed3dc0ad
- MD5 SHA1 SHA512
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/source_code/texttospeech.py
- SHA256 646aae0d27e33ffbcff71ebb6aa9699ee2a19f91093256589c197c37c3e3ed50
- MD5 fcdbea32d7fc0e631d1e1652994fc7b5
- SHA1 2d302d21dafe696a136ea3a5748b08a9cd23ee85
- SHA512 a69cdda97fe8e7f4b552355345edef95b74f64d6a1024b17021bd7c20ce15c791a81899da4dd5053c39722b093b79ce41b0db3f148d69a1ac4945b5e583f2032
- MD5 SHA1 SHA512
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/source_code/webcam.py
- SHA256 4270b8e31bd0d6764da74561d98790f209c1f8b707ef432498efc88a4d482f63
- MD5 a97ae4162ca683dcb634f68fdec40919
- SHA1 476bf16fc4e0469df4e1709ba4de35e7119a803e
- SHA512 506a6d3a7eff0b016bae94034993b0d51ebe80cee10119465cdbefb6e404eccc880c0a5b8ecbe2637c3341717e5c16d02da407ad8a9b7c09d1a4e4f6bcbf0200
- MD5 SHA1 SHA512
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/source_code/website_blocker.py
- SHA256 cbd3060fe8d2db48e18ac3c938e3f22c0be6c5d6ac281c0176d556ba3eebee29
- MD5 94ae9ce60c17b17a567405104f8e2af4
- SHA1 fd3028e1b107efe1d327449c747617467ad82ac1
- SHA512 0fbc78a64961191b9b776a9cbc5e9789be1be6c47ea32fd04205f5613968a33d37b04ce933326ffbddbfaca16de445d8f9f2509dfc8849037ab2b1ae3cbdffcc
- MD5 SHA1 SHA512
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/uac_bypass.py
- SHA256 dc254e30154243db553a067b29fc88278c92fe271abdabb51ea24d72bd73fa0a
- MD5 a69179260921f69272bead57ba60fabd
- SHA1 98314565f2a1cdbf21979f7da28fa67ff8c1a440
- SHA512 6ae4e57f6f6bfc50fd911bafcbc8f74d3bf2ec317ec25fa6fb72d3f214703d53bbb107bee82b88e2bd15942b8a23f6be0fa5291e4c8f447c5fd8e27da56a40ec
- MD5 SHA1 SHA512
Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/upx.exe
- SHA256 c6dd0a6cac2d2153e4666aacf43d487c1b6e2bc16cb7f956514ab02883ef2a42
- MD5 b3dd61fb7352cf96a99d0511c97e0c2a
- SHA1 d2f7a2b512cc19e699ec01ec5384adc1a3fd9221
- SHA512 de7ecd05532e8dfe085ccc09dac6a5e2bb8581e8c0c64b883d34809711900b2c7341e99fe55f6708417ee4fafb374d7f896c70179bb359d23a78c4e806bd5a75
- SSDEEP 12288:oLAkZzH8b5MxqvwAeP5XACx49pFl5ZmhR7GAWNjvGe:oLFdyMxqv1eP5QC49Z+eA+L
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2185600
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
Name
UPX0
Size
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
547KB
Virtual Size
548KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
out.upx
- SHA256 d338b06588612fd2e08f395fcb5a79ba3f8fb72de4269d50133532ba86f93620
- MD5 a9c00e7989eeba9d49fbf103420a5ae7
- SHA1 39578ec1016fdb21d6d6c7cd23584bc803ebe64a
- SHA512 32ed8784bd46ec29fe1d2babc11c2f06205f4d8943feb71ddff45c955b659ffa65a80d7c4c74838a2609056af43d9d230256422e5d36b9fefd7f65fe40e98d12
- SSDEEP 24576:gWTUaTR3F+VYOfoj5HrlXIFu7xkK9pk5+xiHqHtg6m9jY:tUwR3F+ALlYFu7vKjq4
- MD5 SHA1 SHA512 SSDEEP
-
Patched UPX-packed file
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5360
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
Name
.text
Size
896KB
Virtual Size
896KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
35KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
36KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
112B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
Phxnt0m-malware-main/Phxnt0mware RAT - main/source.py
- SHA256 97b079a0d6cd2644aeaa99e3289392aa6f1497752b3c1a6da4c05924ecfd3696
- MD5 029637eceb0b968bedf23b46e1cae157
- SHA1 98bf66e0df52a51779409cd50c27006798d677b3
- SHA512 5ca4d580564b1c67ce65dc6e6c9e4a79873b10b2b077ef7d16b2b87af393784c60934a3de3f354c482573588f80b278c861753abc6c6774a498b8238365641b9
- SSDEEP 768:NZnwsPgzswlEPPn3IcxNG+ylz7p6rXo4Ww9VtcllLlsyz:NZnwsPgzswlEEH76rQCI
- MD5 SHA1 SHA512 SSDEEP
Phxnt0m-malware-main/Phxnt0mware RAT - main/to_uninstall.txt
- SHA256 924e574352d94072341728b515401d671cef5cbabd1ca62c1baab4c046867b20
- MD5 cc512a5b214497f417f217db0bf6e0d0
- SHA1 ca415d374c5fec8cd598ad25628dc15f8f31d063
- SHA512 f1a83b7b4ff25506c16aa3ec14fd9455c272849893c160545b477d3b63133b59cf0335d92a7ea58bc6c3e098290afef02f086d2269fda5d471539681d3601eef
- MD5 SHA1 SHA512
Phxnt0m-malware-main/Phxnt0mware RAT - main/tools/drawling_studio/DrawlingStudio.bat
- SHA256 46c011abb3d16d70896c96f03882c302f3d3a0f31546ede5a0cc0eefbe14ecd0
- MD5 c23cad987de11d44272104ac5a22a573
- SHA1 906042a786ca5fbe299605239c28ed83557e53af
- SHA512 c3ac4b833ffe904e9a6eca59dd1b09b08fd5cc5c5dbe92b93a959afb1a3ca997da5f4a35c52c9146ed813feccdba71b424e4e93adc752fa8c7d414ee7b7e8db7
- MD5 SHA1 SHA512
Phxnt0m-malware-main/Phxnt0mware RAT - main/tools/drawling_studio/Runtime.exe
- IMPHASH 456e8615ad4320c9f54e50319a19df9c
- SHA256 e457a348375f22569358dc4e5b294e096bb85e3180d856a0484a4ca55b5db836
- MD5 a0e48668a88161a201b97390ce82fd45
- SHA1 e34a8a05e5dd3f02d4ed7c884b7ceac4096e6764
- SHA512 96b6f83980477ea6360e83569e2813642b2fc8bca5cdb5186c5640e64ad9cee4033bf27dfb5d1c7b558ecf23579b275b9460d46b1b4bcb0339f9f60fa88001ca
- SSDEEP 1572864:dvxZQglZb7vaSk8IpG7V+VPhq+EE7hlgDiYgj+h58sMwoW29lSFcJz7:dvxZx/eSkB05aw+veN58j9l17
- MD5 SHA1 SHA512 SSDEEP
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
49360
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
CreateWindowExW
PostMessageW
GetMessageW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW
comctl32
ord380
kernel32
GetACP
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
SetEnvironmentVariableW
FlushFileBuffers
GetCurrentDirectoryW
GetOEMCP
GetCPInfo
GetModuleHandleW
MulDiv
GetLastError
FormatMessageW
GetModuleFileNameW
SetDllDirectoryW
CreateSymbolicLinkW
GetProcAddress
CreateDirectoryW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
GetEnvironmentStringsW
FindClose
FindFirstFileW
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
CloseHandle
WaitForSingleObject
Sleep
GetCurrentProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
FreeLibrary
LoadLibraryExW
LocalFree
SetConsoleCtrlHandler
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
HeapReAlloc
WriteConsoleW
SetEndOfFile
DeleteFileW
IsProcessorFeaturePresent
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
advapi32
OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
gdi32
SelectObject
DeleteObject
CreateFontIndirectW
Name
.text
Size
165KB
Virtual Size
164KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
74KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=259, version=30795,
count=180, id=261, version=30795,
count=10, id=260, version=30795,
count=3, id=253, version=33731,
count=9, id=259, version=33731,
count=17, id=260, version=33731,
count=40, id=261, version=33731,
count=11, id=257, version=30795,
count=145, id=1, productName=Unmarked objects,
count=25, id=260, version=33811,
count=1, id=258, version=33811,
discord_token_grabber.pyc
- SHA256 8ae6baddc552f9a47c488760a3d3b04f217f7c999dbffc1a548bb09532e6bf77
- MD5 e523026b612006e580e96bd9e2a8882c
- SHA1 03b9938701f7eff11a0c3632ed805e8188598c88
- SHA512 a0f15f5edecbab4894aa3b85092fc2bde34b76f6048b198ce387d59a56d6c74969201cc43d19cd27a9ff0a6ab72268884a90ef206f0be34a5707a7f6ea24a853
- SSDEEP 384:cGllyAavwS9F0RW807PPQviowoYbCj+Mo8WWIc02a8:cIlytvX9iRW8inQ6owoYOyM0d2a8
- MD5 SHA1 SHA512 SSDEEP
get_cookies.pyc
- SHA256 85a7c34afad2c270ca690a5b4c30cc8bf16967e623fc77f4de4497901030a93b
- MD5 b38f506528b3d6d5dbd851426c347b95
- SHA1 e91bf4ef42128267934e21be0176e552480f5977
- SHA512 ab110dc92eba564fd0ec6c6a75e779f588518dc1aa461f072ab02b96bc11fbe25e09faa6a556dc6a127c3e8826382697b72037a0cefbdaf32fd70a723e746295
- SSDEEP 192:TzOCIeinQfUF9LdwOEVOFc1mNe47+o+zEzzzzz1zz+HoowAE:TzOUiQccEe4KoOIAE
- MD5 SHA1 SHA512 SSDEEP
misc.pyc
- SHA256 b522284f1a7e518c269c0414160407ec7834a4397f85ef389433b49367b5df9c
- MD5 31aa260c6cdeaa9d942cd0dcfcadd16a
- SHA1 a6818f3acf5c2ab9d65b41a81cb92b36b85cc932
- SHA512 0dd277ef948315a3554bd8c5110e27afa9b2eac88defc1211771c050cdd27b3668484dec35ec5c5010bff00b62c2cebd9e7286c0b114ad28437719b42bd0fc2c
- SSDEEP 96:DSajAihmJG4n3B4SmSSSSlSSSShDwegPbbVxlj0nIAEDS5ejmw01k9Bddpq:eYAfn3ySmSSSSlSSSSeeOPVxx0nIAZeQ
- MD5 SHA1 SHA512 SSDEEP
passwords_grabber.pyc
- SHA256 1fd284f1e27263bd2a16050c6989933a382c7d196f4c9f247187cc3b3f6ba3ac
- MD5 704dced7f7530b19a34a5f7a71c26b10
- SHA1 608d9647488cfa2b5f84a891028168a973bfcfa9
- SHA512 e4a6710abef2c45d631745c91d8135873be06e5b240a61362e341d05ecc1dedf885487a554b648c328a3c5cc17fcf74e6d066b2e3f51379358ba28c2a0f2f39f
- SSDEEP 192:+CE34EAL/GFf/PomdPO23NsDmqFUhkxNivLI9dRvL:Y4EAL/AfRBO8NsxuOxNn
- MD5 SHA1 SHA512 SSDEEP
source_prepared.pyc
- SHA256 566952bb754be5584e9ffe32c83cd547a4ed345b71bb085987cb4c008e4b874a
- MD5 30f99a8189cdbd57c652fe3013233221
- SHA1 17db9da3db51bfb645f371d1816d136bcf4bb850
- SHA512 a8ad7f9af6636cd5e2a8abed4994a2e2483b2f9a7e6a82d5fb5a71890e17d3e70bfb849f5cce6075cbfa167d4e2285bef85ef522f007b6a48339a8935f6880af
- SSDEEP 3072:AbtLaKeAnr4ERZoITpte2Xj+S4ZO8cgqNFdCknj:AZWKJr7ZoIdLj+fZO8cgqNPCo
- MD5 SHA1 SHA512 SSDEEP
-
Detect Pysilon
Phxnt0m-malware-main/Phxnt0mware RAT - main/tools/drawling_studio/assets/create_new.png
- SHA256 7dd55ccc7ac73cbb5a1b99c9a40cd3ace3f05158070e495d419d1dcb1bd3b950
- MD5 105427683ffa6f7e88ab464c3913d9f7
- SHA1 996a16f6f6b9c20df75008d8e0d1baa8abaa5628
- SHA512 ba600b8668e5eed7bad053a612334bfb52ff57905f81b2f422a728c4950f963b2974020cc5e8d6a76b709c7dc7c132a3ad91e029b15aaf35fdbc7c9904b28ae6
- MD5 SHA1 SHA512
Phxnt0m-malware-main/Phxnt0mware RAT - main/tools/drawling_studio/assets/icon.ico
- SHA256 d26d433ef8993a7de3b47d8719077dc14a8be0c0cd7b8c923d89d7efa31a20b6
- MD5 925ebe8cd1157bd7cf40d709ea543968
- SHA1 237bd13578aae15efa82dddad52df74af6549f69
- SHA512 3d161549bd8a54b9aa6fde675b8200e021a36f576a8e5f88c34d0491179502161fabe822a11695d4523128cb4cd218112fdb3c05501e0e467af72a17b3934881
- SSDEEP 3072:9J2qw4mqMkrQWg73ktZiMv3Ig6CWF2pdplL3nkxPY8gqnLCIQkRNva7:T1w4mqMqQWskjIg65F2DkxPY8MHgN
- MD5 SHA1 SHA512 SSDEEP
Phxnt0m-malware-main/Phxnt0mware RAT - main/tools/drawling_studio/main.py
- SHA256 da48f620dd9002624bc48f7f92cd55ab54215eec55cdfb91669d9fa85c83de9c
- MD5 892995a5c6a55160d1dbdc02c57b67be
- SHA1 3096d356072471c069d0095fff31f5d3d904a0fc
- SHA512 3fc47fcb91dde5785eeeeb735ce6c5ac5cde0660831a2519f815118e3ac0a5a025be8d67d9408b361f22059e90605fce791e4a7b0b4a8b6875c0b60ef363f077
- SSDEEP 192:jDK3Fg+FV33eY9NtWDD04e5M5i3RxbL+la2G+fkmy/:4fyD04oM5i3XIj8m2
- MD5 SHA1 SHA512 SSDEEP
Phxnt0m-malware-main/Phxnt0mware RAT - main/tools/drawling_studio/requirements.txt
- SHA256 6269da41d5ef2aaf25a3d53d0a8ca0c5cb2252b8ee8f86bf5caabbf9cc04606d
- MD5 6c854d68c2a549ed1b3ceba5d2c2ab32
- SHA1 cd1a84abe1178350c53603630042181cb7321409
- SHA512 144f8f4bf892ae323ee23171f7f7e128694974b0cd99ac3576fc1d28b0f0233b9df4577956193e86bd598847086d26d4d7ee42d991dd55ff0b0aca4c4bdbc05d
- MD5 SHA1 SHA512
Phxnt0m-malware-main/Phxnt0mware RAT - main/tools/drawling_studio/saves/previews/skull.png
- SHA256 ee26126b61bf49e518c6668eb1cd71e125ddd85c6a9ebaeea5a55d81064400fd
- MD5 369c790a57f5248bd10e883acc5a54d3
- SHA1 172d67fda6a5aae545b947665ebcc69a6e71c758
- SHA512 a0ca40a761502d61d987939b8f596b84755072d4978ed0dfc71e9782a4f006c9da0d782bbeb835ef09b02e7783988e381262477ddbf507cd5c9862d64ff5b988
- MD5 SHA1 SHA512
Phxnt0m-malware-main/Phxnt0mware RAT - main/tools/drawling_studio/saves/skull.drawdata
- SHA256 a1d9c2f1ce88265853a55ae02530580a6d2365318007afa9b3cfaf75f12032e8
- MD5 3234ef560f0a62e70af4b93f08f1f36e
- SHA1 347344f0fe772500e3d36b29e07d31b42bebff68
- SHA512 87cb61400edc1b2e83ca8253e0e37b6d0ed91fc502df98a5aa0ab3fc8bc2850894ee6945177803bfc609c5d2dcb24af886292e0c42746fb78f7237637bb0bf2f
- SSDEEP 384:iwycYHUkm+merh/X4+xeV3qazlXxvsdq3Op7ObD3w4PSTmHnaIuLtgFkRTbRAo1k:iwfYHUk5ZneV37zNxvsliw4PjnaDASOZ
- MD5 SHA1 SHA512 SSDEEP
Phxnt0m-malware-main/Phxnt0mware RAT - main/tools/drawling_studio/studio.py
- SHA256 726f57a8c71ddcdb2217c88ac2c198624a3784b4ad94a68edb8c6c357d959d73
- MD5 a24896fbb917fd04864740c1cdabdcd5
- SHA1 667029049d6fe3ea3850c0ec52fb99ab107b2809
- SHA512 3432639374ee3422a9ed026485c5de49ab61ef42d0b3a2730e383f623de0792e5e7631780c39e4ca9a32ceb11bc60ecb87834eda5f0a8eed1e7eb9e2fb5dfbe7
- SSDEEP 192:1TZyX4iWGyKiCkfHQHZFHJS5CWf0nqeBZQXoNv7CiJX9CWv:1lE4iWGyKiCkfHQPJSHf0nq6ZQXozCil
- MD5 SHA1 SHA512 SSDEEP
Phxnt0m-malware-main/Phxnt0mware RAT - main/tools/splitter.py
- SHA256 0701d212d96005fb83bd3500b3ece8fb208eaa5fcb8e7117b9e2717ab65c7728
- MD5 b7b45124f8a8cc65c69128e54b4fd920
- SHA1 2940c55cb9df6772d8bd39c145afd241d9d5d08a
- SHA512 cc78dc0c9732519338da78fd62822fb1234760defcbf58576776bcb5be314f7c89a6f0adc48bf75b81c4aebeac78e65211bd9bb29b2d11d62fa76674f4189ee2
- MD5 SHA1 SHA512