Overview
overview
8Static
static
8PySilon-ma...2).zip
windows7-x64
1PySilon-ma...2).zip
windows10-2004-x64
1PySilon-ma...nux.sh
ubuntu-18.04-amd64
1PySilon-ma...nux.sh
debian-9-armhf
1PySilon-ma...nux.sh
debian-9-mips
1PySilon-ma...nux.sh
debian-9-mipsel
1PySilon-ma...on.bat
windows7-x64
1PySilon-ma...on.bat
windows10-2004-x64
1PySilon-ma...der.py
windows7-x64
3PySilon-ma...der.py
windows10-2004-x64
3PySilon-ma...ler.py
windows7-x64
3PySilon-ma...ler.py
windows10-2004-x64
3PySilon-ma...64.exe
windows7-x64
4PySilon-ma...64.exe
windows10-2004-x64
4PySilon-ma...ber.py
windows7-x64
3PySilon-ma...ber.py
windows10-2004-x64
3PySilon-ma...ies.py
windows7-x64
3PySilon-ma...ies.py
windows10-2004-x64
3PySilon-ma...64.dll
windows7-x64
1PySilon-ma...64.dll
windows10-2004-x64
1PySilon-ma...isc.py
windows7-x64
3PySilon-ma...isc.py
windows10-2004-x64
3PySilon-ma...ber.py
windows7-x64
3PySilon-ma...ber.py
windows10-2004-x64
3PySilon-ma...ons.py
windows7-x64
3PySilon-ma...ons.py
windows10-2004-x64
3PySilon-ma...rol.py
windows7-x64
3PySilon-ma...rol.py
windows10-2004-x64
3PySilon-ma...put.py
windows7-x64
3PySilon-ma...put.py
windows10-2004-x64
3PySilon-ma...sod.py
windows7-x64
3PySilon-ma...sod.py
windows10-2004-x64
3Analysis
-
max time kernel
93s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06-08-2024 23:11
Behavioral task
behavioral1
Sample
PySilon-malware-3.7.5 (2).zip
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
PySilon-malware-3.7.5 (2).zip
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
PySilon-malware-3.7.5/PySilon-linux.sh
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral4
Sample
PySilon-malware-3.7.5/PySilon-linux.sh
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral5
Sample
PySilon-malware-3.7.5/PySilon-linux.sh
Resource
debian9-mipsbe-20240729-en
Behavioral task
behavioral6
Sample
PySilon-malware-3.7.5/PySilon-linux.sh
Resource
debian9-mipsel-20240418-en
Behavioral task
behavioral7
Sample
PySilon-malware-3.7.5/PySilon.bat
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
PySilon-malware-3.7.5/PySilon.bat
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
PySilon-malware-3.7.5/builder.py
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
PySilon-malware-3.7.5/builder.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
PySilon-malware-3.7.5/compiler.py
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
PySilon-malware-3.7.5/compiler.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
PySilon-malware-3.7.5/python-3.12.4-amd64.exe
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
PySilon-malware-3.7.5/python-3.12.4-amd64.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
PySilon-malware-3.7.5/resources/discord_token_grabber.py
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
PySilon-malware-3.7.5/resources/discord_token_grabber.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
PySilon-malware-3.7.5/resources/get_cookies.py
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
PySilon-malware-3.7.5/resources/get_cookies.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
PySilon-malware-3.7.5/resources/libopus-0.x64.dll
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
PySilon-malware-3.7.5/resources/libopus-0.x64.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
PySilon-malware-3.7.5/resources/misc.py
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
PySilon-malware-3.7.5/resources/misc.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
PySilon-malware-3.7.5/resources/passwords_grabber.py
Resource
win7-20240704-en
Behavioral task
behavioral24
Sample
PySilon-malware-3.7.5/resources/passwords_grabber.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
PySilon-malware-3.7.5/resources/protections.py
Resource
win7-20240729-en
Behavioral task
behavioral26
Sample
PySilon-malware-3.7.5/resources/protections.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
PySilon-malware-3.7.5/resources/source_code/audio_control.py
Resource
win7-20240704-en
Behavioral task
behavioral28
Sample
PySilon-malware-3.7.5/resources/source_code/audio_control.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
PySilon-malware-3.7.5/resources/source_code/block_input.py
Resource
win7-20240705-en
Behavioral task
behavioral30
Sample
PySilon-malware-3.7.5/resources/source_code/block_input.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
PySilon-malware-3.7.5/resources/source_code/bsod.py
Resource
win7-20240708-en
Behavioral task
behavioral32
Sample
PySilon-malware-3.7.5/resources/source_code/bsod.py
Resource
win10v2004-20240802-en
General
-
Target
PySilon-malware-3.7.5/resources/source_code/block_input.py
-
Size
2KB
-
MD5
b70feedd80d5267aadc24132ecda5633
-
SHA1
1f4995eee52226ca1c2d6c54ea98900120093c88
-
SHA256
346216866f911ddd4a4f80ac15dcf25d3fc6a49a9024f19facc599561afc1072
-
SHA512
0471eb21e3ff9f99f4afb3fb174f453a9b7c7096576791fb8e23a47eba78706ccd53de6011ed3f91eccd23f187b80a56980ef2360c95285fc69d94779cac73c6
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
Processes:
cmd.exeOpenWith.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OpenWith.exepid process 1228 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\PySilon-malware-3.7.5\resources\source_code\block_input.py1⤵
- Modifies registry class
PID:4068
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1228