pysilon | DupeInjecterV2[.]exe

resource	yara_rule
static1/unpack001/source_prepared.pyc	pysilon

resource	yara_rule
sample	pyinstaller

resource
DupeInjecterV2.exe

DupeInjecterV2.exe

IMPHASH 72c4e339b7af8ab1ed2eb3821c98713a
SHA256 d766576e5daa460d10ed77a7b07bb61abaced6f2b24b12bc8f72488cc3327313
MD5 3bd3c372a75caca801b47f1aaa359dbd
SHA1 272ca4cf9cf71ff480b1257f412194f4afef9077
SHA512 b6ba45443ca18e05794d065271fe1b599e2d026b44a3c3f3b0d8c27b4fbd40d27c57a9a2abba9e3fe553b9450d9268833e596a91f3268d57653d877ff5f88ecc
SSDEEP 393216:CTKjS/sj1IZRiK1piXLGVEL4tLjXns9yYnZVo:CTmbcDiXHMtLz4Vo
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Detects Pyinstaller

pyinstaller
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

52656

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

CreateWindowExW ShutdownBlockReasonCreate MsgWaitForMultipleObjects ShowWindow DestroyWindow RegisterClassW DefWindowProcW PeekMessageW DispatchMessageW TranslateMessage PostMessageW GetMessageW MessageBoxW MessageBoxA SystemParametersInfoW DestroyIcon SetWindowLongPtrW GetWindowLongPtrW GetClientRect InvalidateRect ReleaseDC GetDC DrawTextW GetDialogBaseUnits EndDialog DialogBoxIndirectParamW MoveWindow SendMessageW

comctl32

ord380

kernel32

GetACP IsValidCodePage GetStringTypeW GetFileAttributesExW SetEnvironmentVariableW FlushFileBuffers GetCurrentDirectoryW LCMapStringW CompareStringW FlsFree GetOEMCP GetCPInfo GetModuleHandleW MulDiv FormatMessageW GetLastError GetModuleFileNameW LoadLibraryExW SetDllDirectoryW CreateSymbolicLinkW GetProcAddress GetEnvironmentStringsW GetCommandLineW GetEnvironmentVariableW ExpandEnvironmentStringsW DeleteFileW FindClose FindFirstFileW FindNextFileW GetDriveTypeW RemoveDirectoryW GetTempPathW CloseHandle QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObject Sleep GetCurrentProcess TerminateProcess GetExitCodeProcess CreateProcessW GetStartupInfoW FreeLibrary LocalFree SetConsoleCtrlHandler K32EnumProcessModules K32GetModuleFileNameExW CreateFileW FindFirstFileExW GetFinalPathNameByHandleW MultiByteToWideChar WideCharToMultiByte FlsSetValue FreeEnvironmentStringsW GetProcessHeap GetTimeZoneInformation HeapSize HeapReAlloc WriteConsoleW SetEndOfFile CreateDirectoryW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent RtlUnwindEx SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer RaiseException RtlPcToFileHeader GetCommandLineA GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ReadFile GetFullPathNameW SetStdHandle GetStdHandle WriteFile ExitProcess GetModuleHandleExW HeapFree GetConsoleMode ReadConsoleW SetFilePointerEx GetConsoleOutputCP GetFileSizeEx HeapAlloc FlsAlloc FlsGetValue

advapi32

OpenProcessToken GetTokenInformation ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertSidToStringSidW

gdi32

SelectObject DeleteObject CreateFontIndirectW

discord_token_grabber.pyc

SHA256 d5ed971b0e74fd0b811af76948a5f7d173c00ff97f6e7313f1089d91749ad6be
MD5 9d27825766e1dd5e01da0ea3a74e3b81
SHA1 29a6769330ea63b41961a009336790e44e1bdfe7
SHA512 eaea42559e5b95b1e8dc24e73518ec0b1844a08c1426dce2dd829191882ef7a2179500a97ee79af828bab3d27acd1492f50562a5e7939fa3bca3da2cfeadf385
SSDEEP 192:bOqqAm47Kauge+M6Df8fri+JDcNQshU8En5W4NXOYd/G7XW:wHavP578fbDWRm5FOUG7XW
MD5 SHA1 SHA512 SSDEEP

Detects Pyinstaller

pyinstaller

get_cookies.pyc

SHA256 41f37e31c9866dfa920c3c01c014b221d9e35c73d56a32775c75ca36c79b1dc2
MD5 3232629e868b431a139933fd54246752
SHA1 15f777548080933cb87c9baadaab880d1e9f9dda
SHA512 65ff8f292cf72c5e201e749855edef8f2aaa32632cf55a986045d1c892dc7bedeecac0c864e69008bb0779dabaddc035b1c533166e53fdfc21b6042150d8a7c8
SSDEEP 192:srNe41QfUE0xZVbFAI6dokUpjYnuHN3gQ:i0BifedokqYnuHN3gQ
MD5 SHA1 SHA512 SSDEEP

Detects Pyinstaller

pyinstaller

misc.pyc

SHA256 8ebd34d6a4a41a2107ab7000da651fed3996ae0e13291fe6970971b5bc0e5087
MD5 36ed907d6c57862deacc25f4da2bde11
SHA1 0e21743b8eff2688e13055bfe26467cd3af43559
SHA512 89dca2a052a77c829423d0cc1389e83b645ae97d063ccef2f47188c3b83dfeef6632d116cac714df01c908b148767d59e46006bded668f046fc78a564c52fdd4
SSDEEP 96:vDh/7Y8hYPUywfLDwfPsULKliOCpmrSTUpjdaJuo1kUZsX3g:vVR5ywfwXsULPJmDpjwN1kIo3g
MD5 SHA1 SHA512 SSDEEP

Detects Pyinstaller

pyinstaller

passwords_grabber.pyc

SHA256 6a67c8b0591fef85f8436d152361796d4bf1fb3ddf46a5af873743cc16ece1fe
MD5 cc180daa11732953527c69ac7bbea3b1
SHA1 24ea916374f1fe5981219c1c330ba8f851571e9e
SHA512 5e4e259999b3155ca5d9f55de691ced7c918acdab8b7c3ef7bca69903d6057a6c102a997b4b2af4a655026b3dd3ea8aed855306633392ab6a9171e70a34dbfbb
SSDEEP 192:0tkwY6bLQ3hT8+NE102sGMleDkUhMbvEh:dwY6bLQ3RzHOMER
MD5 SHA1 SHA512 SSDEEP

Detects Pyinstaller

pyinstaller

source_prepared.pyc

SHA256 5697a3107e3b8db26174d6a23e98841dbb2e536d0148629bdfc93548abe0177e
MD5 feeaa76fb9f150a68f5041242034a306
SHA1 9ab6b321850b9f1aa973fa6a0ac4cb71f0736949
SHA512 162840e4cef9b87e96c5fe9f5e125e4989dd6f034998a0353623d3dfac3125f26520679a85d2c84232056ca39b4bc0b1e33985b86730c7522a4af2e0cb1c837a
SSDEEP 3072:6+UawF4wRkUS8BVfEUOBo87iD6GxjhQpnt5fhxvsilkZ:C6ykOBWBo1j6xt3psNZ
MD5 SHA1 SHA512 SSDEEP

Detect Pysilon
Detects Pyinstaller

pyinstaller

Sharing

General

Malware Config

Signatures

File Explorer