pysilon | Inarticulation rat Package[.]exe

resource	yara_rule
static1/unpack001/source_prepared.pyc	pysilon

resource	yara_rule
sample	pyinstaller

resource
Inarticulation rat Package.exe

Inarticulation rat Package.exe

IMPHASH 456e8615ad4320c9f54e50319a19df9c
SHA256 ebed6741e0a4ab13898b552639cf76b61bab71d36406e68023135a4db5156551
MD5 b6498e22504134fdf7c0d4419de09861
SHA1 e203bad7fa5d79f397d85cb7becf6ba21db5dcc3
SHA512 be8894481c09c7af21d3a309649bd56ab67cc9cd20396266b5746558f9dbecf27e01c5762ac7b9bf78ef22efb0fd97983b35ec7edd5270fbd20e0ec63e18438f
SSDEEP 1572864:SvhQ6lNO7vDSk8IpG7V+VPhqWK8pE7WTDlPNiY4MHHLeqPNLtDSHWNZFbM:Svh1mPSkB05awWK8TTD5CMHVLtOifM
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Detects Pyinstaller

pyinstaller
Unsigned PE

Checks for missing Authenticode signature.

Password

e

Minor OS version

0

Major OS version

6

Entry point

49360

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

CreateWindowExW PostMessageW GetMessageW MessageBoxW MessageBoxA SystemParametersInfoW DestroyIcon SetWindowLongPtrW GetWindowLongPtrW GetClientRect InvalidateRect ReleaseDC GetDC DrawTextW GetDialogBaseUnits EndDialog DialogBoxIndirectParamW MoveWindow SendMessageW

comctl32

ord380

kernel32

GetACP IsValidCodePage GetStringTypeW GetFileAttributesExW SetEnvironmentVariableW FlushFileBuffers GetCurrentDirectoryW GetOEMCP GetCPInfo GetModuleHandleW MulDiv GetLastError FormatMessageW GetModuleFileNameW SetDllDirectoryW CreateSymbolicLinkW GetProcAddress CreateDirectoryW GetCommandLineW GetEnvironmentVariableW ExpandEnvironmentStringsW GetEnvironmentStringsW FindClose FindFirstFileW FindNextFileW GetDriveTypeW RemoveDirectoryW GetTempPathW CloseHandle WaitForSingleObject Sleep GetCurrentProcess GetExitCodeProcess CreateProcessW GetStartupInfoW FreeLibrary LoadLibraryExW LocalFree SetConsoleCtrlHandler K32EnumProcessModules K32GetModuleFileNameExW CreateFileW FindFirstFileExW GetFinalPathNameByHandleW MultiByteToWideChar WideCharToMultiByte FreeEnvironmentStringsW GetProcessHeap GetTimeZoneInformation HeapSize HeapReAlloc WriteConsoleW SetEndOfFile DeleteFileW IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent RtlUnwindEx SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer RaiseException RtlPcToFileHeader GetCommandLineA GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ReadFile GetFullPathNameW SetStdHandle GetStdHandle WriteFile ExitProcess GetModuleHandleExW HeapFree GetConsoleMode ReadConsoleW SetFilePointerEx GetConsoleOutputCP GetFileSizeEx HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW

advapi32

OpenProcessToken GetTokenInformation ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertSidToStringSidW

gdi32

SelectObject DeleteObject CreateFontIndirectW

discord_token_grabber.pyc

SHA256 f49ba791814001b3d4101685bfebb635cdaf3103407a08171bb5d6bbe3e79c77
MD5 6b2aaa23f9b67dca5fa0efd9d96e9060
SHA1 07293442aa33cbc0afc1b69af287b1fede2e9a70
SHA512 bcd7b41e7758b30954b0e24db5d53d3d904b6c4b9a5105bd33e5dddddb310614cc09a028d0cd8ccb6a272ce5eba0e9142a1cc36ec848b54fb99b695752b5e20d
SSDEEP 192:ESB7osP1MJaugwXaafNqaclHJLOq3ZJFD/b8xjJzdJv:TP1iavwTqacyq35D0Fnv
MD5 SHA1 SHA512 SSDEEP

Detects Pyinstaller

pyinstaller

get_cookies.pyc

SHA256 f7e8a57b54489b5b3de66a1d21534ced3d2a2fb1ce8d03c69d4672e62aa00dca
MD5 2754e3152f668e31fccca7b6f275716b
SHA1 e9ed74d679a96372c4457e72bc6639a4d96a2378
SHA512 a8331f1c179ed97e6f3821cd41953a5ef8a0b63b6d39022cd3f7980494eff8f00b4367301509014e83c410ed4a6db8e4441f8f3547b682aca250bc4fa29f0f47
SSDEEP 96:STUBj1Mvk80VDdybA6HUicwKD7dxWeBJKZLpMglcTK94:wsSl0fQfUpwKfhijMgGW94
MD5 SHA1 SHA512 SSDEEP

Detects Pyinstaller

pyinstaller

misc.pyc

SHA256 572b18ccb1838f23714fae1c8cbb399a08796b1eb846960d5463d40ee784fe5a
MD5 bcb404423ac51f798753e8d11e401071
SHA1 9080018dae3aa157e3a97904c86af06d4a0a6873
SHA512 25a2997cff19308956086ae4e464f5039e53149043f094f2a65dae4dfa78b6410650a3c4d1514511f23c6bf77228772fa7b8a3cf5119e4ed46edb65ac40ff800
MD5 SHA1 SHA512

Detects Pyinstaller

pyinstaller

passwords_grabber.pyc

SHA256 589d438226abfec8f71ab7724c68011303f82febb6786fd0c57571b0769764f3
MD5 8b9cbd29c3dfec519a4313b1b7a0069b
SHA1 5efb073593bc8908a7514dad78673c9d65344a6f
SHA512 c0099bcf2d23dd405b2e02e1fd1b946195015eabb1cbd2ce4896f1ab7e5bbc1fbe6600fa529087b5dc295c13219fb6bc1a6ac97efa4c0fc74901f70278c09bfd
SSDEEP 96:2APDnTWeYwDTgWxiX79GzTOjYUyWkUUNPIslLClDWJpR6Yn:TzCUDxiLATmeEUNP/lL3JpsYn
MD5 SHA1 SHA512 SSDEEP

Detects Pyinstaller

pyinstaller

source_prepared.pyc

SHA256 836b860e38502bd9c612361aadeecfcb1b7e28f5a2ddf2d88bb96203009929a9
MD5 0f5ad994ab4c6d9411928f41c3f71d0c
SHA1 324f03817d2cea2e35ed61e6a74ba615256c4284
SHA512 d4c10df260d8d20ef6b3f1f202e23ea451a31601c2ca7d25a99c788515d1c7208083d2b336b53c4b8420a8f101d308907a6afa937ae88279cff6dd2d22a99d18
SSDEEP 768:IaGFaKlgVgaA6RRaAZJjLwBjIgevrBYCFjUBJ29EW4VHjrlbedBDoeUgLiLmC/5q:IaCgVguasyBj1uYCFjUTH/IdBDoTLBxq
MD5 SHA1 SHA512 SSDEEP

Detect Pysilon
Detects Pyinstaller

pyinstaller

Sharing

General

Malware Config

Signatures

File Explorer