pysilon | ca0752a8d9e6a63a9e69181ae08ac994bee38e06c6efd389a877b3e69eecea39 | Triage

Submit
Reports

Overview

overview

Static

static

source_prepared.exe

windows7-x64

7

source_prepared.exe

windows10-2004-x64

9

Sharing

General

Target

source_prepared.exe
Size

76.8MB
Sample

241010-ppe7eawbmf
MD5

1fc07c1595ab851ac7a3b2d85d9d3df8
SHA1

5d00a821f1ad2ce2776e25f69c24fd1fc26e7973
SHA256

ca0752a8d9e6a63a9e69181ae08ac994bee38e06c6efd389a877b3e69eecea39
SHA512

dd5ebb20cf7881c6f8a053ac7cff47e2a9dff5ad413594c3e71fa852090cf6cf4b955d27c5c71c2d4657e07d24b4beb17ff6dad30bb5867df96f4644276c3074
SSDEEP

1572864:MnlAWbWSk8IpG7V+VPhqIUE7WALlKP3liY4MHHLeqPNLtD9qG1ZoXQ:0G+WSkB05awIAALMP6MHVLtBqG14

Score

10^/10

pysilon evasion execution persistence pyinstaller upx

Static task

static1

pyinstaller pysilon

4 signatures

Behavioral task

behavioral1

Sample

source_prepared.exe

Resource

win7-20240729-en

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral2

Sample

source_prepared.exe

Resource

win10v2004-20241007-en

evasion execution persistence upx

windows10-2004-x64

11 signatures

150 seconds

Malware Config

Targets

- Target
  
  source_prepared.exe
- Size
  
  76.8MB
- MD5
  
  1fc07c1595ab851ac7a3b2d85d9d3df8
- SHA1
  
  5d00a821f1ad2ce2776e25f69c24fd1fc26e7973
- SHA256
  
  ca0752a8d9e6a63a9e69181ae08ac994bee38e06c6efd389a877b3e69eecea39
- SHA512
  
  dd5ebb20cf7881c6f8a053ac7cff47e2a9dff5ad413594c3e71fa852090cf6cf4b955d27c5c71c2d4657e07d24b4beb17ff6dad30bb5867df96f4644276c3074
- SSDEEP
  
  1572864:MnlAWbWSk8IpG7V+VPhqIUE7WALlKP3liY4MHHLeqPNLtD9qG1ZoXQ:0G+WSkB05awIAALMP6MHVLtBqG14
Score

9^/10

upx evasion execution persistence
- Enumerates VirtualBox DLL files
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  evasion
- Loads dropped DLL
- Adds Run key to start application
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

File and Directory Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

pyinstallerpysilon

behavioral1

behavioral2

evasionexecutionpersistenceupx

© 2018-2025

Terms | Privacy

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.