pysilon | ebb211ffc3d40f2cda98f558c47e1ee787b1663a887c5ade229be1af2952237b

General

Target

DanielsSelfBot.exe
Size

100.6MB
Sample

241122-nhp8cswjbn
MD5

6469ba274c4df6faa7c5eb5b9f773053
SHA1

85cc142c6c46ae5201258042e88c17fd0aee01d5
SHA256

ebb211ffc3d40f2cda98f558c47e1ee787b1663a887c5ade229be1af2952237b
SHA512

fc444fa3b76378d8c329a28f09d6d8881dcd93bb815c2590dcda94d1c89b80a7b37eaa96f703bbf76b9192608e0163d113a7f3a6514655319a0c7a79bcb6516a
SSDEEP

3145728:InGRrS6xjKcBanL2qHO5iVAunGQbRe0zJcBmqZ2:XZSWNaBHCin1XcBs

Score

10^/10

Malware Config

Targets

- Target
  
  DanielsSelfBot.exe
- Size
  
  100.6MB
- MD5
  
  6469ba274c4df6faa7c5eb5b9f773053
- SHA1
  
  85cc142c6c46ae5201258042e88c17fd0aee01d5
- SHA256
  
  ebb211ffc3d40f2cda98f558c47e1ee787b1663a887c5ade229be1af2952237b
- SHA512
  
  fc444fa3b76378d8c329a28f09d6d8881dcd93bb815c2590dcda94d1c89b80a7b37eaa96f703bbf76b9192608e0163d113a7f3a6514655319a0c7a79bcb6516a
- SSDEEP
  
  3145728:InGRrS6xjKcBanL2qHO5iVAunGQbRe0zJcBmqZ2:XZSWNaBHCin1XcBs
Score

9^/10

evasion execution persistence
- Enumerates VirtualBox DLL files
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
behavioral1
- Target
  
  discord_token_grabber.pyc
- Size
  
  15KB
- MD5
  
  aaaeca514d98795f954c1f2eebb18881
- SHA1
  
  6331352aada5256452c43545bb6593958602a20c
- SHA256
  
  a808291bd70bbd15bedd818ef25a1dbcfbf548330fd9ddf5244143ec3eb66cc6
- SHA512
  
  ec9c019d0061103e1e1b3db7feb346136e5e4f447804f9586aacdd7da3c9b877bda1221735b08fc44586cd443b8909664a22bb90ce3a4230402357d35fe80883
- SSDEEP
  
  384:nGC7RYmnXavkLPJrltcshntQ5Maa2holHVg:nGCuvkL9ltcsttQ5MaaCgHVg
Score

3^/10
behavioral2
- Target
  
  get_cookies.pyc
- Size
  
  9KB
- MD5
  
  b97f0689742bd69af8900cd3731c5294
- SHA1
  
  28ccff4aa6009fc86d4561e5bc37ea2fb175a689
- SHA256
  
  b080857887222e4c048bba2d7bb3ebc25cc26f31bb26f645fafc01de4e46a03c
- SHA512
  
  9b2c471688fee5cb3d1112ec0d594f5c16371dbb6a1dd30668f64746f2073cea377ca6797928e67bfc933e03c52d819ec676f00a115ef3afa4eeb240daf71883
- SSDEEP
  
  96:nlNatjbBMMKiNW8Zxh9ybA6HUWc4/xIgBZFLjH2K8BXFxUBvF/A7qx3MlMFztwX3:lNahBeiNR9QfUF2x3NC79F21aGaqDAht
Score

3^/10
behavioral3
- Target
  
  misc.pyc
- Size
  
  4KB
- MD5
  
  3eb4ff2a9be2d13ecb7343cf82865294
- SHA1
  
  6f9d52b590a15de10dd4589ced7320734371b844
- SHA256
  
  5697249c80354c3adbbb6ae7f2068bd5e0ab44ce08def7b1ef168508fb1fb2c4
- SHA512
  
  776bc0e43593579b7a82bdf0ed77ba89803111b5651cf222c82a7245cd9a297560e3400dc9fcefbed56a91cde4f786f2d745e931102c4ac8750044f2f5072f63
- SSDEEP
  
  96:XSMlhlvSzMPDweHPF8+VB7sHIZGQSWfvmyyZ1k9zBub:iolvSzM0evq+VBXZGQlvmV1k5Bub
Score

3^/10
behavioral4
- Target
  
  passwords_grabber.pyc
- Size
  
  7KB
- MD5
  
  e51a6ecd8527b9e758afb60513356e19
- SHA1
  
  89feb7e8f793bef5dc22556196bb9b03387476fe
- SHA256
  
  3c2a8cf8d20d10c27c1c389064abbcce9aab9d6afe5cac26a376ebedf551bece
- SHA512
  
  acc505cea3eff572570b05418931b9be9339c0dd91922ce5ef470810bf861f2395535ccab883f470910bb4e0c9dae309382044568ae0a3aba2b9323ada1f784d
- SSDEEP
  
  192:A114qWLlhuUIxDPK2cMHJb+XUhitovgEuT:64qWLlMFyVMHAE/Y
Score

3^/10
behavioral5
- Target
  
  source_prepared.pyc
- Size
  
  166KB
- MD5
  
  745edd004c312f6ed0547c19869a1e16
- SHA1
  
  e8bcf6bbead47f47791bc0822ad962609dde5e8a
- SHA256
  
  2b9a97d63bead82385a0377b1ad4b5e52ebb648d0a783cb5b505c838bfbb0166
- SHA512
  
  1d68641359c6efefccd3db0d1b0e0725aa7ad6919ee7a8e3b3ddc18e76bb2e8da79c14a518f3e265702cd24c8b6c1d21859f400f1aad0028dddaf642ea8e3c8f
- SSDEEP
  
  3072:AXWa6aOOAXClBPOe4boZPZTjG5J2TvvIvdXzmQsTxo:AXN6aOOAXCIboD+oz0s+
Score

3^/10
behavioral6