pysilon | c43ba4674688b696d37be0123102595ead8335af525477bbbedfce9ee55a9475

General

Target

source_prepared.zip
Size

81.2MB
Sample

240913-xl5a5asgjk
MD5

10ecec64ec39e030b9c8dca17c589e16
SHA1

620317eccba3ec20ea5ad134930c331aec6f9527
SHA256

c43ba4674688b696d37be0123102595ead8335af525477bbbedfce9ee55a9475
SHA512

82469457af35e58db68cde28852053359e8731a2a8272a240b909982b43cca2131776c0f502a7b790c05ab54f0d83e75e26566b167b3f6823225229cd21bae95
SSDEEP

1572864:GXZh49YdDAn6ObGWZglOhpArAXb9tjG/bgBIRH8scNrYNjjapxe1/atD47YrRWU:G3oYJS6VWGLrAXb9Zx7MNuc1UyURWU

Score

10^/10

Malware Config

Targets

- Target
  
  source_prepared.zip
- Size
  
  81.2MB
- MD5
  
  10ecec64ec39e030b9c8dca17c589e16
- SHA1
  
  620317eccba3ec20ea5ad134930c331aec6f9527
- SHA256
  
  c43ba4674688b696d37be0123102595ead8335af525477bbbedfce9ee55a9475
- SHA512
  
  82469457af35e58db68cde28852053359e8731a2a8272a240b909982b43cca2131776c0f502a7b790c05ab54f0d83e75e26566b167b3f6823225229cd21bae95
- SSDEEP
  
  1572864:GXZh49YdDAn6ObGWZglOhpArAXb9tjG/bgBIRH8scNrYNjjapxe1/atD47YrRWU:G3oYJS6VWGLrAXb9Zx7MNuc1UyURWU
Score

1^/10
behavioral1
- Target
  
  source_prepared.exe
- Size
  
  81.6MB
- MD5
  
  2d50c1e5ee7eb5a888c4f68f00abc07e
- SHA1
  
  8980eb85bf3501d5890e518cb2cb6d1c83f884ad
- SHA256
  
  eda5eddfb47860b05356bbf716833d6f436293784f8f2bdd5d369f5b6ea89f43
- SHA512
  
  e3a17ed04c1c527ec881bcd1e0e885ea82b5779c8a740d6e233ba2d64897a4ca1bef7efb35545b7d123b388cf4d93bf5568cadf193d0494af8ba2d34fe20f95f
- SSDEEP
  
  1572864:jvxZQglXedWFZSk8IpG7V+VPhqb+T9E7Ulg8iYgj+h58sMw5ID93AVqDNX:jvxZxRQyZSkB05awb+TJe25Fu93L
Score

9^/10

evasion execution persistence upx
- Enumerates VirtualBox DLL files
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  evasion
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
behavioral2
- Target
  
  get_cookies.pyc
- Size
  
  10KB
- MD5
  
  d157cf31f7829c5c9c88e656409840c6
- SHA1
  
  1d53ed755119f80284b52f2e17198e2943452b92
- SHA256
  
  a68afbac4d16fa89db22d81f6010f520868fafd50c1b2c8d868a662d210301ff
- SHA512
  
  ccbdfc5c9db196f0a10195c6f52e6fccf073020a6715f2407da23800b12ef9bb6d7e7ffe08cbe448bea7fb7b5ef8772c931e2e129d3ec73151dafcbf7c610793
- SSDEEP
  
  192:TzOCIeinQfUF9LdwOEVOFc1mNe4qo+zEzzzzz1zz+HoowAE:TzOUiQccEe4qoOIAE
Score

3^/10
behavioral3
- Target
  
  misc.pyc
- Size
  
  5KB
- MD5
  
  31aa260c6cdeaa9d942cd0dcfcadd16a
- SHA1
  
  a6818f3acf5c2ab9d65b41a81cb92b36b85cc932
- SHA256
  
  b522284f1a7e518c269c0414160407ec7834a4397f85ef389433b49367b5df9c
- SHA512
  
  0dd277ef948315a3554bd8c5110e27afa9b2eac88defc1211771c050cdd27b3668484dec35ec5c5010bff00b62c2cebd9e7286c0b114ad28437719b42bd0fc2c
- SSDEEP
  
  96:DSajAihmJG4n3B4SmSSSSlSSSShDwegPbbVxlj0nIAEDS5ejmw01k9Bddpq:eYAfn3ySmSSSSlSSSSeeOPVxx0nIAZeQ
Score

3^/10
behavioral4
- Target
  
  passwords_grabber.pyc
- Size
  
  8KB
- MD5
  
  704dced7f7530b19a34a5f7a71c26b10
- SHA1
  
  608d9647488cfa2b5f84a891028168a973bfcfa9
- SHA256
  
  1fd284f1e27263bd2a16050c6989933a382c7d196f4c9f247187cc3b3f6ba3ac
- SHA512
  
  e4a6710abef2c45d631745c91d8135873be06e5b240a61362e341d05ecc1dedf885487a554b648c328a3c5cc17fcf74e6d066b2e3f51379358ba28c2a0f2f39f
- SSDEEP
  
  192:+CE34EAL/GFf/PomdPO23NsDmqFUhkxNivLI9dRvL:Y4EAL/AfRBO8NsxuOxNn
Score

3^/10
behavioral5
- Target
  
  source_prepared.pyc
- Size
  
  185KB
- MD5
  
  bf84eabd843ecff28757c31e7b6aa9df
- SHA1
  
  5c518e7c161086e3a83799e1c313cdd551e36324
- SHA256
  
  f573e539d4da7d47f0db5981c708c21b75ed77534cc4345efb45928be8457f47
- SHA512
  
  e362c7b33a9eab4984e31f9e7135898cb8b3cef61969984e296fcc49a419e5860d563cf1940c7810956cc3c76bb86a55ac1ad4be147101c9ee09e66859a87f91
- SSDEEP
  
  3072:cRHyLai9sA9MpcgSobPEtelZN+tVZa3Bcgh90vCkn0:cYWi9lUSob8cN+7Za3Bcgh9uCh
Score

3^/10
behavioral6