pysilon | SolaraBootstrapper[.]exe

resource	yara_rule
static1/unpack001/source_prepared.pyc	pysilon

resource	yara_rule
sample	themida

resource
SolaraBootstrapper.exe

SolaraBootstrapper.exe

SHA256 675a635c4a4d1a5cb124600b4644f8126b3e5fbfc6e6a42488a664d14f9a6a2c
MD5 bdbf76228ee4c587b81885e011ce908d
SHA1 24219497fc9b0392558a433341c2220089318bb3
SHA512 637f6afc11062ccc0065f8db56fcb4a9c413b4338409f5042c41c4a74d478b5e9150bffcf201f12fa5687aeb271422f78c126cdc966a1949016be6b37516593b
SSDEEP 3145728:HZop8S6xjKcBaIc2qHO5iVY2nGQbRe0zJcBWos9U:HZtSWNaIsHCiH1XcBW1
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

6672472

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

Size

98KB

Virtual Size

164KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

39KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

106KB

Virtual Size

106KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.idata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

106KB

Virtual Size

106KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.themida

Size

Virtual Size

5.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

3.4MB

Virtual Size

3.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

discord_token_grabber.pyc

SHA256 b4a60b0e4f82707a8c5fb7f3fc0cc78576c7b45217617185ab34a90e2e052208
MD5 990bb1210323b8968b180576cf8114d6
SHA1 a4e11d7cdeb37fb32d768085263ff9fd4e51ac0b
SHA512 43d1e9db58d160b15d6daf5677f2f63ed8f3fa494a886bf07d229829ffc84af17f9c81f61bdbf23dfa54a1bebafa7e562f805848b64de08bc8cf83fe98a2188a
SSDEEP 384:YGC7RYmnXavkxzG7WltcrhntQ5saa2h12VA:YGCuvk8WltcrttQ5saaCsVA
MD5 SHA1 SHA512 SSDEEP

Themida packer

Detects Themida, an advanced Windows software protection system.

themida

get_cookies.pyc

SHA256 1078edad1660d103c2135793ea9707e4ef7877fb4be7b87c0e538ed84920212c
MD5 9bdb8627dc166823e7d60603575b689a
SHA1 de56b5f8b3e891ad07760544132bd357f1e62368
SHA512 789d21f744eff44456585fd27cd88a67e26b55ed1a043aa76a4b5e63f7dfad99013ca09b15fabecd041f8d35f8d22502c08efd0bb11d26ca083f02a64eae6d3a
SSDEEP 192:kNal3eiNis9QfUFoxJvm79F211G67+PtAhN:kJiB2lrj7jKlAhN
MD5 SHA1 SHA512 SSDEEP

Themida packer

Detects Themida, an advanced Windows software protection system.

themida

misc.pyc

SHA256 a8355eef70645468d11a410d1402e0cab31a194e87172b523b1ff3dea5dbb0c2
MD5 204ee497021e32209ddde0c015b4dc19
SHA1 6aa2c039e6b6fbfb3620d4fe42d115553702146b
SHA512 961b15c0efe0478fdf9287e7b3b709233bcd9524be708f426b75dc91eb07ddfc2a2ce4f347d52a3e7402f5307ab755af093d660662fd3c4c465fd41e8d138d12
SSDEEP 96:ySMlhlv6KPDweHPF8+VB7sHIZGhIW0vmyyZ1k93hub:LolvJ0evq+VBXZGh4vmV1kFhub
MD5 SHA1 SHA512 SSDEEP

Themida packer

Detects Themida, an advanced Windows software protection system.

themida

passwords_grabber.pyc

SHA256 8655f8885fa28c9633563e0264e65206eae277fb020f85a836be27f0fc3d7ec4
MD5 bbb6ab7b8230cca0ac46532a612143d0
SHA1 4bf5ebb19c5807cfb4b48191ec65b329d67763cd
SHA512 21353818de5a2e192bcdb38e0765b675258ae733eb634c1b01fbf53dc22946b0eee127c975be7a63d20a8db2b87521fe0ed85f2ec09dcc2f3adf5a7fea0b180e
SSDEEP 192:h114qWLfhuUIxzOK2cxDJb+XUhetovxEPz:V4qWLfMtzVxDAEW7
MD5 SHA1 SHA512 SSDEEP

Themida packer

Detects Themida, an advanced Windows software protection system.

themida

source_prepared.pyc

SHA256 ade74a798cc5d31097dcced94db6d10b30d05aecf60416f1e30dad1421b06b57
MD5 b7d7824a42fb4b0a2f136c491de2be1e
SHA1 8524561cc737b78e00d9e6d8488d5db3de00196d
SHA512 de9c2db5fa4e9d1bade4a18294921794bba872704dc7ed4fd108ddc6f18ca2bee67e8c7e3602ebb311b47e6f93d1511b4f181cf13886e950c59674db33818030
SSDEEP 3072:pfyaOO9tBlR5FSGIQo3PZTWZx5JDGUOIvdXzpysTW9:hyaOO9tBMQoIVVGUcsU
MD5 SHA1 SHA512 SSDEEP

Detect Pysilon
Themida packer

Detects Themida, an advanced Windows software protection system.

themida

Sharing

General

Malware Config

Signatures

File Explorer

SolaraBootstrapper.exe

generic

discord_token_grabber.pyc

get_cookies.pyc

misc.pyc

passwords_grabber.pyc

source_prepared.pyc