pysilon | e503ecf3527bfc5b2d734b5ac58fd1d740726e554d5b3fa1a5fb53fe27e1ffaa

General

Target

source_prepared.exe
Size

102.9MB
Sample

241019-dj3vqstbqe
MD5

55b3f067577169e8f69c40ed6169af7c
SHA1

d39e828b4eecdaafbcc331eb5f82829f85e902c6
SHA256

e503ecf3527bfc5b2d734b5ac58fd1d740726e554d5b3fa1a5fb53fe27e1ffaa
SHA512

989678d8076c3beb138286dd921066ee845372f21eb57259f5f0aee7c33ced17b7954d8b1d4f04f37293e437e828b0921fc36c3478eae8d018090f99998e3b20
SSDEEP

3145728:jnG9r78S6xjKcBanL2qHO5iVAunGQbRe0zJcBC6Z2:i1ASWNaBHCin1XcBu

Score

10^/10

Malware Config

Targets

- Target
  
  source_prepared.exe
- Size
  
  102.9MB
- MD5
  
  55b3f067577169e8f69c40ed6169af7c
- SHA1
  
  d39e828b4eecdaafbcc331eb5f82829f85e902c6
- SHA256
  
  e503ecf3527bfc5b2d734b5ac58fd1d740726e554d5b3fa1a5fb53fe27e1ffaa
- SHA512
  
  989678d8076c3beb138286dd921066ee845372f21eb57259f5f0aee7c33ced17b7954d8b1d4f04f37293e437e828b0921fc36c3478eae8d018090f99998e3b20
- SSDEEP
  
  3145728:jnG9r78S6xjKcBanL2qHO5iVAunGQbRe0zJcBC6Z2:i1ASWNaBHCin1XcBu
Score

9^/10

evasion execution persistence
- Enumerates VirtualBox DLL files
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
behavioral1
- Target
  
  discord_token_grabber.pyc
- Size
  
  15KB
- MD5
  
  aaaeca514d98795f954c1f2eebb18881
- SHA1
  
  6331352aada5256452c43545bb6593958602a20c
- SHA256
  
  a808291bd70bbd15bedd818ef25a1dbcfbf548330fd9ddf5244143ec3eb66cc6
- SHA512
  
  ec9c019d0061103e1e1b3db7feb346136e5e4f447804f9586aacdd7da3c9b877bda1221735b08fc44586cd443b8909664a22bb90ce3a4230402357d35fe80883
- SSDEEP
  
  384:nGC7RYmnXavkLPJrltcshntQ5Maa2holHVg:nGCuvkL9ltcsttQ5MaaCgHVg
Score

3^/10
behavioral2
- Target
  
  get_cookies.pyc
- Size
  
  9KB
- MD5
  
  b97f0689742bd69af8900cd3731c5294
- SHA1
  
  28ccff4aa6009fc86d4561e5bc37ea2fb175a689
- SHA256
  
  b080857887222e4c048bba2d7bb3ebc25cc26f31bb26f645fafc01de4e46a03c
- SHA512
  
  9b2c471688fee5cb3d1112ec0d594f5c16371dbb6a1dd30668f64746f2073cea377ca6797928e67bfc933e03c52d819ec676f00a115ef3afa4eeb240daf71883
- SSDEEP
  
  96:nlNatjbBMMKiNW8Zxh9ybA6HUWc4/xIgBZFLjH2K8BXFxUBvF/A7qx3MlMFztwX3:lNahBeiNR9QfUF2x3NC79F21aGaqDAht
Score

3^/10
behavioral3
- Target
  
  misc.pyc
- Size
  
  4KB
- MD5
  
  3eb4ff2a9be2d13ecb7343cf82865294
- SHA1
  
  6f9d52b590a15de10dd4589ced7320734371b844
- SHA256
  
  5697249c80354c3adbbb6ae7f2068bd5e0ab44ce08def7b1ef168508fb1fb2c4
- SHA512
  
  776bc0e43593579b7a82bdf0ed77ba89803111b5651cf222c82a7245cd9a297560e3400dc9fcefbed56a91cde4f786f2d745e931102c4ac8750044f2f5072f63
- SSDEEP
  
  96:XSMlhlvSzMPDweHPF8+VB7sHIZGQSWfvmyyZ1k9zBub:iolvSzM0evq+VBXZGQlvmV1k5Bub
Score

3^/10
behavioral4
- Target
  
  passwords_grabber.pyc
- Size
  
  7KB
- MD5
  
  e51a6ecd8527b9e758afb60513356e19
- SHA1
  
  89feb7e8f793bef5dc22556196bb9b03387476fe
- SHA256
  
  3c2a8cf8d20d10c27c1c389064abbcce9aab9d6afe5cac26a376ebedf551bece
- SHA512
  
  acc505cea3eff572570b05418931b9be9339c0dd91922ce5ef470810bf861f2395535ccab883f470910bb4e0c9dae309382044568ae0a3aba2b9323ada1f784d
- SSDEEP
  
  192:A114qWLlhuUIxDPK2cMHJb+XUhitovgEuT:64qWLlMFyVMHAE/Y
Score

3^/10
behavioral5
- Target
  
  source_prepared.pyc
- Size
  
  172KB
- MD5
  
  4a53e7a5b936268ec5c4cccae062bbbe
- SHA1
  
  f2aa486454ce9990c94301bd07a9094f049ea9c0
- SHA256
  
  25074dbe03e956b2575a90072f2e6b8a46daf42b74aa12a57b68075b2eaa22ac
- SHA512
  
  775a9d316c288efa019bfd5c0d8a7f2b4fe231f853e53f9a078097601c55c25e4a738edf6e8dafffb351acb655e1271a5849e31abc1a194ed0cc6100cb83b23b
- SSDEEP
  
  3072:DFffHWC0aOO/WA1wD7roxPZTerUScdQQV+yXIvdXzbksTxs:DcC0aOO/WAoroSj8SyFse
Score

3^/10
behavioral6