Overview
overview
8Static
static
8PySilon-ma...2).zip
windows7-x64
1PySilon-ma...2).zip
windows10-2004-x64
1PySilon-ma...nux.sh
ubuntu-18.04-amd64
1PySilon-ma...nux.sh
debian-9-armhf
1PySilon-ma...nux.sh
debian-9-mips
1PySilon-ma...nux.sh
debian-9-mipsel
1PySilon-ma...on.bat
windows7-x64
1PySilon-ma...on.bat
windows10-2004-x64
1PySilon-ma...der.py
windows7-x64
3PySilon-ma...der.py
windows10-2004-x64
3PySilon-ma...ler.py
windows7-x64
3PySilon-ma...ler.py
windows10-2004-x64
3PySilon-ma...64.exe
windows7-x64
4PySilon-ma...64.exe
windows10-2004-x64
4PySilon-ma...ber.py
windows7-x64
3PySilon-ma...ber.py
windows10-2004-x64
3PySilon-ma...ies.py
windows7-x64
3PySilon-ma...ies.py
windows10-2004-x64
3PySilon-ma...64.dll
windows7-x64
1PySilon-ma...64.dll
windows10-2004-x64
1PySilon-ma...isc.py
windows7-x64
3PySilon-ma...isc.py
windows10-2004-x64
3PySilon-ma...ber.py
windows7-x64
3PySilon-ma...ber.py
windows10-2004-x64
3PySilon-ma...ons.py
windows7-x64
3PySilon-ma...ons.py
windows10-2004-x64
3PySilon-ma...rol.py
windows7-x64
3PySilon-ma...rol.py
windows10-2004-x64
3PySilon-ma...put.py
windows7-x64
3PySilon-ma...put.py
windows10-2004-x64
3PySilon-ma...sod.py
windows7-x64
3PySilon-ma...sod.py
windows10-2004-x64
3Analysis
-
max time kernel
91s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06-08-2024 23:11
Behavioral task
behavioral1
Sample
PySilon-malware-3.7.5 (2).zip
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
PySilon-malware-3.7.5 (2).zip
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
PySilon-malware-3.7.5/PySilon-linux.sh
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral4
Sample
PySilon-malware-3.7.5/PySilon-linux.sh
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral5
Sample
PySilon-malware-3.7.5/PySilon-linux.sh
Resource
debian9-mipsbe-20240729-en
Behavioral task
behavioral6
Sample
PySilon-malware-3.7.5/PySilon-linux.sh
Resource
debian9-mipsel-20240418-en
Behavioral task
behavioral7
Sample
PySilon-malware-3.7.5/PySilon.bat
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
PySilon-malware-3.7.5/PySilon.bat
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
PySilon-malware-3.7.5/builder.py
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
PySilon-malware-3.7.5/builder.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
PySilon-malware-3.7.5/compiler.py
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
PySilon-malware-3.7.5/compiler.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
PySilon-malware-3.7.5/python-3.12.4-amd64.exe
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
PySilon-malware-3.7.5/python-3.12.4-amd64.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
PySilon-malware-3.7.5/resources/discord_token_grabber.py
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
PySilon-malware-3.7.5/resources/discord_token_grabber.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
PySilon-malware-3.7.5/resources/get_cookies.py
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
PySilon-malware-3.7.5/resources/get_cookies.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
PySilon-malware-3.7.5/resources/libopus-0.x64.dll
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
PySilon-malware-3.7.5/resources/libopus-0.x64.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
PySilon-malware-3.7.5/resources/misc.py
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
PySilon-malware-3.7.5/resources/misc.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
PySilon-malware-3.7.5/resources/passwords_grabber.py
Resource
win7-20240704-en
Behavioral task
behavioral24
Sample
PySilon-malware-3.7.5/resources/passwords_grabber.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
PySilon-malware-3.7.5/resources/protections.py
Resource
win7-20240729-en
Behavioral task
behavioral26
Sample
PySilon-malware-3.7.5/resources/protections.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
PySilon-malware-3.7.5/resources/source_code/audio_control.py
Resource
win7-20240704-en
Behavioral task
behavioral28
Sample
PySilon-malware-3.7.5/resources/source_code/audio_control.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
PySilon-malware-3.7.5/resources/source_code/block_input.py
Resource
win7-20240705-en
Behavioral task
behavioral30
Sample
PySilon-malware-3.7.5/resources/source_code/block_input.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
PySilon-malware-3.7.5/resources/source_code/bsod.py
Resource
win7-20240708-en
Behavioral task
behavioral32
Sample
PySilon-malware-3.7.5/resources/source_code/bsod.py
Resource
win10v2004-20240802-en
General
-
Target
PySilon-malware-3.7.5/resources/discord_token_grabber.py
-
Size
12KB
-
MD5
32c812c4d73d3e3e2fb9ae35e6262dbe
-
SHA1
37525639cc07d60bf39ae7c50be248b7ae7832e3
-
SHA256
09b16591c62127f39c138f3d36537d5577042ee9349bd9bca075a0c5bb13c823
-
SHA512
a1f8f0e08bcfd36b6fce4c3d7e9322692e57034f918de3ff42bbc6d30fe6a59e01c52c4276235a23000e3b1f230b44224ebfc34ef466d6c410081c28bea8a139
-
SSDEEP
384:xP2g/IOwWb1IdsvxtMwv3tMwvQk6fi3sY5Gl4:1IHaZt7vt7YVfi3s7l4
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
Processes:
OpenWith.execmd.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings cmd.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OpenWith.exepid process 4260 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\PySilon-malware-3.7.5\resources\discord_token_grabber.py1⤵
- Modifies registry class
PID:3904
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4260