pysilon | 8f98b9295b615636382d42add12e1fee1bb951c4d40f59c42d50f65e7f7ecf38

General

Target

Legends Forever - Game.exe
Size

103.6MB
Sample

241109-m35ywatapk
MD5

5365793f1d0480f951074892e81cd92a
SHA1

8bf692d90306e5f8ef734596384e7d2289b803f6
SHA256

8f98b9295b615636382d42add12e1fee1bb951c4d40f59c42d50f65e7f7ecf38
SHA512

c12febabf3eba6661475c2d173782f9681cda6d73ce633080ca0e506991246f2176301ad12769d92e5cd1467774cb7da82681245ea6eacd77570a1486bdc7293
SSDEEP

3145728:gnGir7rS6xjKcBanL2qHO5iVAunGQbRe0zJcBx7Z2:P0nSWNaBHCin1XcBu

Score

10^/10

Malware Config

Targets

- Target
  
  Legends Forever - Game.exe
- Size
  
  103.6MB
- MD5
  
  5365793f1d0480f951074892e81cd92a
- SHA1
  
  8bf692d90306e5f8ef734596384e7d2289b803f6
- SHA256
  
  8f98b9295b615636382d42add12e1fee1bb951c4d40f59c42d50f65e7f7ecf38
- SHA512
  
  c12febabf3eba6661475c2d173782f9681cda6d73ce633080ca0e506991246f2176301ad12769d92e5cd1467774cb7da82681245ea6eacd77570a1486bdc7293
- SSDEEP
  
  3145728:gnGir7rS6xjKcBanL2qHO5iVAunGQbRe0zJcBx7Z2:P0nSWNaBHCin1XcBu
Score

9^/10

evasion execution persistence
- Enumerates VirtualBox DLL files
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
behavioral1
- Target
  
  discord_token_grabber.pyc
- Size
  
  15KB
- MD5
  
  aaaeca514d98795f954c1f2eebb18881
- SHA1
  
  6331352aada5256452c43545bb6593958602a20c
- SHA256
  
  a808291bd70bbd15bedd818ef25a1dbcfbf548330fd9ddf5244143ec3eb66cc6
- SHA512
  
  ec9c019d0061103e1e1b3db7feb346136e5e4f447804f9586aacdd7da3c9b877bda1221735b08fc44586cd443b8909664a22bb90ce3a4230402357d35fe80883
- SSDEEP
  
  384:nGC7RYmnXavkLPJrltcshntQ5Maa2holHVg:nGCuvkL9ltcsttQ5MaaCgHVg
Score

3^/10
behavioral2
- Target
  
  get_cookies.pyc
- Size
  
  9KB
- MD5
  
  b97f0689742bd69af8900cd3731c5294
- SHA1
  
  28ccff4aa6009fc86d4561e5bc37ea2fb175a689
- SHA256
  
  b080857887222e4c048bba2d7bb3ebc25cc26f31bb26f645fafc01de4e46a03c
- SHA512
  
  9b2c471688fee5cb3d1112ec0d594f5c16371dbb6a1dd30668f64746f2073cea377ca6797928e67bfc933e03c52d819ec676f00a115ef3afa4eeb240daf71883
- SSDEEP
  
  96:nlNatjbBMMKiNW8Zxh9ybA6HUWc4/xIgBZFLjH2K8BXFxUBvF/A7qx3MlMFztwX3:lNahBeiNR9QfUF2x3NC79F21aGaqDAht
Score

3^/10
behavioral3
- Target
  
  misc.pyc
- Size
  
  4KB
- MD5
  
  3eb4ff2a9be2d13ecb7343cf82865294
- SHA1
  
  6f9d52b590a15de10dd4589ced7320734371b844
- SHA256
  
  5697249c80354c3adbbb6ae7f2068bd5e0ab44ce08def7b1ef168508fb1fb2c4
- SHA512
  
  776bc0e43593579b7a82bdf0ed77ba89803111b5651cf222c82a7245cd9a297560e3400dc9fcefbed56a91cde4f786f2d745e931102c4ac8750044f2f5072f63
- SSDEEP
  
  96:XSMlhlvSzMPDweHPF8+VB7sHIZGQSWfvmyyZ1k9zBub:iolvSzM0evq+VBXZGQlvmV1k5Bub
Score

3^/10
behavioral4
- Target
  
  passwords_grabber.pyc
- Size
  
  7KB
- MD5
  
  e51a6ecd8527b9e758afb60513356e19
- SHA1
  
  89feb7e8f793bef5dc22556196bb9b03387476fe
- SHA256
  
  3c2a8cf8d20d10c27c1c389064abbcce9aab9d6afe5cac26a376ebedf551bece
- SHA512
  
  acc505cea3eff572570b05418931b9be9339c0dd91922ce5ef470810bf861f2395535ccab883f470910bb4e0c9dae309382044568ae0a3aba2b9323ada1f784d
- SSDEEP
  
  192:A114qWLlhuUIxDPK2cMHJb+XUhitovgEuT:64qWLlMFyVMHAE/Y
Score

3^/10
behavioral5
- Target
  
  source_prepared.pyc
- Size
  
  172KB
- MD5
  
  e8fdebe1109a6fd99c3590af2dd79e4a
- SHA1
  
  963f9c5c3e4979e692d85e7c51d80eb071d8db7e
- SHA256
  
  1f5ef7b5075b590d6d187f3093a26f0e15df8726cd69a86fb94354b1cdb99b6e
- SHA512
  
  3c968e735845bbd89724a0d184f0902fb94edcd22551b236c26c1c726291c7a4f779c336c933f02156992d2c6d801dbe8fc526486180a4141557132ad8a54c2e
- SSDEEP
  
  3072:nFfBHWC0aOO/WA1wD7roxPZTerUScdQQV+yXIvdXzbXsTxw:nWC0aOO/WAoroSj8Symse
Score

3^/10
behavioral6