Overview
overview
8Static
static
8PySilon-ma...2).zip
windows7-x64
1PySilon-ma...2).zip
windows10-2004-x64
1PySilon-ma...nux.sh
ubuntu-18.04-amd64
1PySilon-ma...nux.sh
debian-9-armhf
1PySilon-ma...nux.sh
debian-9-mips
1PySilon-ma...nux.sh
debian-9-mipsel
1PySilon-ma...on.bat
windows7-x64
1PySilon-ma...on.bat
windows10-2004-x64
1PySilon-ma...der.py
windows7-x64
3PySilon-ma...der.py
windows10-2004-x64
3PySilon-ma...ler.py
windows7-x64
3PySilon-ma...ler.py
windows10-2004-x64
3PySilon-ma...64.exe
windows7-x64
4PySilon-ma...64.exe
windows10-2004-x64
4PySilon-ma...ber.py
windows7-x64
3PySilon-ma...ber.py
windows10-2004-x64
3PySilon-ma...ies.py
windows7-x64
3PySilon-ma...ies.py
windows10-2004-x64
3PySilon-ma...64.dll
windows7-x64
1PySilon-ma...64.dll
windows10-2004-x64
1PySilon-ma...isc.py
windows7-x64
3PySilon-ma...isc.py
windows10-2004-x64
3PySilon-ma...ber.py
windows7-x64
3PySilon-ma...ber.py
windows10-2004-x64
3PySilon-ma...ons.py
windows7-x64
3PySilon-ma...ons.py
windows10-2004-x64
3PySilon-ma...rol.py
windows7-x64
3PySilon-ma...rol.py
windows10-2004-x64
3PySilon-ma...put.py
windows7-x64
3PySilon-ma...put.py
windows10-2004-x64
3PySilon-ma...sod.py
windows7-x64
3PySilon-ma...sod.py
windows10-2004-x64
3Analysis
-
max time kernel
93s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06-08-2024 23:11
Behavioral task
behavioral1
Sample
PySilon-malware-3.7.5 (2).zip
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
PySilon-malware-3.7.5 (2).zip
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
PySilon-malware-3.7.5/PySilon-linux.sh
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral4
Sample
PySilon-malware-3.7.5/PySilon-linux.sh
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral5
Sample
PySilon-malware-3.7.5/PySilon-linux.sh
Resource
debian9-mipsbe-20240729-en
Behavioral task
behavioral6
Sample
PySilon-malware-3.7.5/PySilon-linux.sh
Resource
debian9-mipsel-20240418-en
Behavioral task
behavioral7
Sample
PySilon-malware-3.7.5/PySilon.bat
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
PySilon-malware-3.7.5/PySilon.bat
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
PySilon-malware-3.7.5/builder.py
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
PySilon-malware-3.7.5/builder.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
PySilon-malware-3.7.5/compiler.py
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
PySilon-malware-3.7.5/compiler.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
PySilon-malware-3.7.5/python-3.12.4-amd64.exe
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
PySilon-malware-3.7.5/python-3.12.4-amd64.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
PySilon-malware-3.7.5/resources/discord_token_grabber.py
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
PySilon-malware-3.7.5/resources/discord_token_grabber.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
PySilon-malware-3.7.5/resources/get_cookies.py
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
PySilon-malware-3.7.5/resources/get_cookies.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
PySilon-malware-3.7.5/resources/libopus-0.x64.dll
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
PySilon-malware-3.7.5/resources/libopus-0.x64.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
PySilon-malware-3.7.5/resources/misc.py
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
PySilon-malware-3.7.5/resources/misc.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
PySilon-malware-3.7.5/resources/passwords_grabber.py
Resource
win7-20240704-en
Behavioral task
behavioral24
Sample
PySilon-malware-3.7.5/resources/passwords_grabber.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
PySilon-malware-3.7.5/resources/protections.py
Resource
win7-20240729-en
Behavioral task
behavioral26
Sample
PySilon-malware-3.7.5/resources/protections.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
PySilon-malware-3.7.5/resources/source_code/audio_control.py
Resource
win7-20240704-en
Behavioral task
behavioral28
Sample
PySilon-malware-3.7.5/resources/source_code/audio_control.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
PySilon-malware-3.7.5/resources/source_code/block_input.py
Resource
win7-20240705-en
Behavioral task
behavioral30
Sample
PySilon-malware-3.7.5/resources/source_code/block_input.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
PySilon-malware-3.7.5/resources/source_code/bsod.py
Resource
win7-20240708-en
Behavioral task
behavioral32
Sample
PySilon-malware-3.7.5/resources/source_code/bsod.py
Resource
win10v2004-20240802-en
General
-
Target
PySilon-malware-3.7.5/builder.py
-
Size
30KB
-
MD5
f011ab09f5e640bbf339d9edd93e2739
-
SHA1
cfe055600b42ed2eb3b77c3f9632301cd4c3e6dd
-
SHA256
443bd85e3bf8d6a5880400025047933bf58e7cccdb9f1c7585fc6932113f2fdb
-
SHA512
bdae087b6fa1a781805fa8a1a2b248e23226261bb4be179dcf1b762f0a1241f7d697797434f23e0820ab39b4c6156c9b4674383cdfb251ce346351132b6ee3b3
-
SSDEEP
768:d2PufIVSZvFWL2sthHqxFgYP0kqhvqeju:d22QEZvMLp/HqxFgYP0kqhvqei
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
Processes:
cmd.exeOpenWith.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OpenWith.exepid process 2888 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\PySilon-malware-3.7.5\builder.py1⤵
- Modifies registry class
PID:2116
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2888