pysilon | f1e72b5329dc4d9f7c459aea493d8c59bd0521d82129d168bf7d155924b768c6 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

Bootstrapper.exe

windows10-2004-x64

9

Sharing

General

Target

Bootstrapper.exe
Size

81.0MB
Sample

241202-2wb5jsxkey
MD5

8e4459028b7b17ef356a8be2ad50c8ed
SHA1

084c9494f68755bc64e0fceb97834af2ccfec5d6
SHA256

f1e72b5329dc4d9f7c459aea493d8c59bd0521d82129d168bf7d155924b768c6
SHA512

fc60a89d0516d38fa75bfbd45cc3edd483d8d879e20b7c885bbba1b839caa9e6aaa121b14b164e02dc4f3f189f58980eb0952b85f22c433237e42457a224d0ad
SSDEEP

1572864:AGKlEWvsmwSk8IpG7V+VPhqYdfmE7FliwiYgj+h58sMwGybhiDENjwJq:5KeysmwSkB05awcfNwy5SybGW

Score

10^/10

pysilon discovery evasion execution persistence pyinstaller upx

Static task

static1

pyinstaller pysilon

4 signatures

Behavioral task

behavioral1

Sample

Bootstrapper.exe

Resource

win10v2004-20241007-en

discovery evasion execution persistence upx

windows10-2004-x64

21 signatures

150 seconds

Malware Config

Targets

- Target
  
  Bootstrapper.exe
- Size
  
  81.0MB
- MD5
  
  8e4459028b7b17ef356a8be2ad50c8ed
- SHA1
  
  084c9494f68755bc64e0fceb97834af2ccfec5d6
- SHA256
  
  f1e72b5329dc4d9f7c459aea493d8c59bd0521d82129d168bf7d155924b768c6
- SHA512
  
  fc60a89d0516d38fa75bfbd45cc3edd483d8d879e20b7c885bbba1b839caa9e6aaa121b14b164e02dc4f3f189f58980eb0952b85f22c433237e42457a224d0ad
- SSDEEP
  
  1572864:AGKlEWvsmwSk8IpG7V+VPhqYdfmE7FliwiYgj+h58sMwGybhiDENjwJq:5KeysmwSkB05awcfNwy5SybGW
Score

9^/10

discovery evasion execution persistence upx
- Enumerates VirtualBox DLL files
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Browser Information Discovery

File and Directory Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

pyinstallerpysilon

behavioral1

discoveryevasionexecutionpersistenceupx

© 2018-2025

Terms | Privacy

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.