pysilon | loaddriver[.]exe

resource	yara_rule
static1/unpack001/source_prepared.pyc	pysilon

resource	yara_rule
sample	pyinstaller

resource
loaddriver.exe

loaddriver.exe

IMPHASH 72c4e339b7af8ab1ed2eb3821c98713a
SHA256 6841134bf32383767734fe353db51c64b745291e7838b68075377a36cc8ca2ef
MD5 361b055635cfba8f84a4fa35b8110e83
SHA1 8575b1b98de1501217b4ccb15bf5c98ec23fb8e6
SHA512 d96468b2e1ee350e5db7efd3348f2b383fb64ecd9bbc39e834626bad64b03e09ad6ac6cf7b80411c09ce24f4b779b22568d6fe86618e9389e6a1cf9530e708e4
SSDEEP 1572864:h0vlAmWRSk8IpG7V+VPhq+lkE7x7wlPEIq6KiY4MHHLeqPNLtDoNeTTHDMjh6:h0v9cSkB05awWD7w5EIq6xMHVLtUuTHS
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Detects Pyinstaller

pyinstaller
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

52656

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

CreateWindowExW ShutdownBlockReasonCreate MsgWaitForMultipleObjects ShowWindow DestroyWindow RegisterClassW DefWindowProcW PeekMessageW DispatchMessageW TranslateMessage PostMessageW GetMessageW MessageBoxW MessageBoxA SystemParametersInfoW DestroyIcon SetWindowLongPtrW GetWindowLongPtrW GetClientRect InvalidateRect ReleaseDC GetDC DrawTextW GetDialogBaseUnits EndDialog DialogBoxIndirectParamW MoveWindow SendMessageW

comctl32

ord380

kernel32

GetACP IsValidCodePage GetStringTypeW GetFileAttributesExW SetEnvironmentVariableW FlushFileBuffers GetCurrentDirectoryW LCMapStringW CompareStringW FlsFree GetOEMCP GetCPInfo GetModuleHandleW MulDiv FormatMessageW GetLastError GetModuleFileNameW LoadLibraryExW SetDllDirectoryW CreateSymbolicLinkW GetProcAddress GetEnvironmentStringsW GetCommandLineW GetEnvironmentVariableW ExpandEnvironmentStringsW DeleteFileW FindClose FindFirstFileW FindNextFileW GetDriveTypeW RemoveDirectoryW GetTempPathW CloseHandle QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObject Sleep GetCurrentProcess TerminateProcess GetExitCodeProcess CreateProcessW GetStartupInfoW FreeLibrary LocalFree SetConsoleCtrlHandler K32EnumProcessModules K32GetModuleFileNameExW CreateFileW FindFirstFileExW GetFinalPathNameByHandleW MultiByteToWideChar WideCharToMultiByte FlsSetValue FreeEnvironmentStringsW GetProcessHeap GetTimeZoneInformation HeapSize HeapReAlloc WriteConsoleW SetEndOfFile CreateDirectoryW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent RtlUnwindEx SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer RaiseException RtlPcToFileHeader GetCommandLineA GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ReadFile GetFullPathNameW SetStdHandle GetStdHandle WriteFile ExitProcess GetModuleHandleExW HeapFree GetConsoleMode ReadConsoleW SetFilePointerEx GetConsoleOutputCP GetFileSizeEx HeapAlloc FlsAlloc FlsGetValue

advapi32

OpenProcessToken GetTokenInformation ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertSidToStringSidW

gdi32

SelectObject DeleteObject CreateFontIndirectW

discord_token_grabber.pyc

SHA256 6a0e23b48e772d2d0426bc978441f8bb537ae791f238748311e8fc1993b6a5a7
MD5 d7b4f8b9ed21117e34fa5b59d0eac3d1
SHA1 9560c652087bfd162fc6cbaf369dd918b25e3eef
SHA512 02526a6ef886dcfa1a480e967c17238cf12bd0857c4095e1770098ae7a1d13a20160bd41e62b393f053a8ab473eae5b3d9b9ea73b1259d555d2f599e6c1614c0
SSDEEP 192:ESB7osP1MJaugwXaafNqaclHJLOqFJFDWboRjJ5Jv:TP1iavwTqacyqVDbFPv
MD5 SHA1 SHA512 SSDEEP

Detects Pyinstaller

pyinstaller

get_cookies.pyc

SHA256 f7e8a57b54489b5b3de66a1d21534ced3d2a2fb1ce8d03c69d4672e62aa00dca
MD5 2754e3152f668e31fccca7b6f275716b
SHA1 e9ed74d679a96372c4457e72bc6639a4d96a2378
SHA512 a8331f1c179ed97e6f3821cd41953a5ef8a0b63b6d39022cd3f7980494eff8f00b4367301509014e83c410ed4a6db8e4441f8f3547b682aca250bc4fa29f0f47
SSDEEP 96:STUBj1Mvk80VDdybA6HUicwKD7dxWeBJKZLpMglcTK94:wsSl0fQfUpwKfhijMgGW94
MD5 SHA1 SHA512 SSDEEP

Detects Pyinstaller

pyinstaller

misc.pyc

SHA256 572b18ccb1838f23714fae1c8cbb399a08796b1eb846960d5463d40ee784fe5a
MD5 bcb404423ac51f798753e8d11e401071
SHA1 9080018dae3aa157e3a97904c86af06d4a0a6873
SHA512 25a2997cff19308956086ae4e464f5039e53149043f094f2a65dae4dfa78b6410650a3c4d1514511f23c6bf77228772fa7b8a3cf5119e4ed46edb65ac40ff800
MD5 SHA1 SHA512

Detects Pyinstaller

pyinstaller

passwords_grabber.pyc

SHA256 589d438226abfec8f71ab7724c68011303f82febb6786fd0c57571b0769764f3
MD5 8b9cbd29c3dfec519a4313b1b7a0069b
SHA1 5efb073593bc8908a7514dad78673c9d65344a6f
SHA512 c0099bcf2d23dd405b2e02e1fd1b946195015eabb1cbd2ce4896f1ab7e5bbc1fbe6600fa529087b5dc295c13219fb6bc1a6ac97efa4c0fc74901f70278c09bfd
SSDEEP 96:2APDnTWeYwDTgWxiX79GzTOjYUyWkUUNPIslLClDWJpR6Yn:TzCUDxiLATmeEUNP/lL3JpsYn
MD5 SHA1 SHA512 SSDEEP

Detects Pyinstaller

pyinstaller

source_prepared.pyc

SHA256 68f03e520ad499d865a681129ee3f34fc94b653bd62ec7b7899b1c03b4ef73d1
MD5 70e4f59d7b5daeab89118da2c586660f
SHA1 de8d338e70c13c39c2d8015b7346f2534e5a562e
SHA512 9d53409999849911f79993cf9e57b3427a5412fcb90fd61b9d12afe39b54d262ae4351a0571b25979696a5e23c6dbc70fb33203966f8f3e3f714ca5184876cce
SSDEEP 768:cEiewmAuikgVgV568R9t4YSJjEUTFcYnt+eISD8lLIPFIRI9F2bzngoORUb3RI6V:cEZRgVgb9t4fXTFHtS4Fd4goV3SGl
MD5 SHA1 SHA512 SSDEEP

Detect Pysilon
Detects Pyinstaller

pyinstaller

Sharing

General

Malware Config

Signatures

File Explorer