Resubmissions
15-08-2024 21:32
240815-1dktaszfkn 10Behavioral task
behavioral1
Sample
AnyDesk.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
AnyDesk.exe
Resource
win10v2004-20240802-en
General
-
Target
AnyDesk.exe
-
Size
103.5MB
-
MD5
9e857f915a409090f09143ce302bbc3b
-
SHA1
86af96f5aab9fa8aed4dce26da8af2bea36ecaee
-
SHA256
acdf571ce148a70121edc7b8a2bac60cbbea31a4dbc99d95d6cc334159c026ab
-
SHA512
b059c25aca64f292d9e5a38c063eb61f9075089c1418465703e09a24cbcf8c95c40db867b0d080c93044e4d663b5bf42f5a806e2a5cecd196f87931b2a6d0240
-
SSDEEP
3145728:SCOb8S6xjKcBaIc2qHO5iVIinGQbRe0zJcBqW7jr5to:QgSWNaIsHCip1XcBqW7j
Malware Config
Signatures
-
Detect Pysilon 1 IoCs
resource yara_rule static1/unpack001/source_prepared.pyc pysilon -
Pysilon family
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource AnyDesk.exe
Files
-
AnyDesk.exe.exe windows:6 windows x64 arch:x64
Password: 1234
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
UPX0 Size: - Virtual size: 440KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 126KB - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 266KB - Virtual size: 268KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
discord_token_grabber.pyc
-
get_cookies.pyc
-
misc.pyc
-
passwords_grabber.pyc
-
source_prepared.pyc