pysilon | 38587dc99bddedb45a1c528091ec1ba801628a849156d434860ba204af578042

General

Target

source_prepared.exe
Size

77.5MB
Sample

241212-bdzvsavlft
MD5

b9e0a24dc0704e1a5b9e9dc7d2e16b6d
SHA1

26ba9a19f0e7ffaccc7b179b3dddfadde3c3d48d
SHA256

38587dc99bddedb45a1c528091ec1ba801628a849156d434860ba204af578042
SHA512

852368bb2b7b73c0f4f1fa6e7c6ee1da25e816925994064e8a36fe5ddbe786883e8ddef6c71493d1693bace9a6123f1dd6d62b528a0d8d4c410faba9f8ca574b
SSDEEP

1572864:Z1lVWAGmUSk8IpG7V+VPhqFxE76lhpBB8iYweyJulZUdgP78yFs61zwvJZH1O3:Z1bnGmUSkB05awFJLpnNpur78y+6Furc

Score

10^/10

Malware Config

Targets

- Target
  
  source_prepared.exe
- Size
  
  77.5MB
- MD5
  
  b9e0a24dc0704e1a5b9e9dc7d2e16b6d
- SHA1
  
  26ba9a19f0e7ffaccc7b179b3dddfadde3c3d48d
- SHA256
  
  38587dc99bddedb45a1c528091ec1ba801628a849156d434860ba204af578042
- SHA512
  
  852368bb2b7b73c0f4f1fa6e7c6ee1da25e816925994064e8a36fe5ddbe786883e8ddef6c71493d1693bace9a6123f1dd6d62b528a0d8d4c410faba9f8ca574b
- SSDEEP
  
  1572864:Z1lVWAGmUSk8IpG7V+VPhqFxE76lhpBB8iYweyJulZUdgP78yFs61zwvJZH1O3:Z1bnGmUSkB05awFJLpnNpur78y+6Furc
Score

9^/10

evasion execution persistence upx
- Enumerates VirtualBox DLL files
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1
- Target
  
  discord_token_grabber.pyc
- Size
  
  15KB
- MD5
  
  143e1ca54a6631128428c6bf7515cfd2
- SHA1
  
  b560459179c580bb22f5adc24f4b3b5851c4f1ad
- SHA256
  
  25cb908eb359f31428c9932d4f98df7f2ee647d3339ea9a7c86ad281b03d8c4f
- SHA512
  
  bc94451702fbe45339999569a1b5935ff2f1daebce10188305995364e047bc19582ba7077d4ab6ceb3cf1c5f21438c3b76416a2b45a0284fbd679c029bc51d35
- SSDEEP
  
  384:nGC7RYmnXavkLPJrltcshntQ5saa2holHVA:nGCuvkL9ltcsttQ5saaCgHVA
Score

3^/10
behavioral2
- Target
  
  get_cookies.pyc
- Size
  
  9KB
- MD5
  
  32bb8ed84a18f665d03dd5afbc7b65b0
- SHA1
  
  a2129ec6568e20c620429d884a13cd4671504a2b
- SHA256
  
  7d9fff7c91679c94728b83eeabc34f54201fc9ee6fa6806665b25007ce5b88a6
- SHA512
  
  399198dfac2fd7bdea480d93d836c2f194ae9c93d7ee7855537cac44bf7c6e463a8104f7f7380b9f075fdd67bb12027909ce2d3407b5423d2837a96c3c835bc2
- SSDEEP
  
  192:lNaBBeiNR9QfUF2x3NC79F21aG67+DAhN:lPiT2XtFcjKDAhN
Score

3^/10
behavioral3
- Target
  
  misc.pyc
- Size
  
  4KB
- MD5
  
  c42e089e863f6e8137098c45fceab40e
- SHA1
  
  6518578e7b5f2480492334238b84ad3be5b1380c
- SHA256
  
  62c5f58bfd4b9cee38e6b973ed8000eda063488096380acf6ab7264f8c1df76c
- SHA512
  
  9e8ccd4383728166faf22c3f10fd471388ef8084c5e000e9fe58241c6ef4b9abd23a29de032a69a332ff41c852fcf786941ccf4ddfac1b4cb28b6251ab4942f5
- SSDEEP
  
  96:XSMlhlvyznDweHPF8+VB7sHIZGQSWfvmyyZ1k9zhub:iolvyz8evq+VBXZGQlvmV1k5hub
Score

3^/10
behavioral4
- Target
  
  passwords_grabber.pyc
- Size
  
  7KB
- MD5
  
  d23a91aebc53fb0d013c182fc10a569e
- SHA1
  
  2fe4680de0ddafad84c4cf69d5427674ee2f49d9
- SHA256
  
  5fd25ed5ea1de4064160ee4559dfba63fe1e4b86fd631c388581ddebfc975b7d
- SHA512
  
  97c4aeb2d64469d6d469066bfa24135ad9351f79cbafe5f97ccdbc4e8d759684789f10efe08f50db0d33b8a923b0d9bb6c4ad6d49aadc938472781fd37ca0024
- SSDEEP
  
  192:A114qWLlhuUIxDPK2cMHJb+XUhitovgEuz:64qWLlMFyVMHAE/4
Score

3^/10
behavioral5
- Target
  
  source_prepared.pyc
- Size
  
  172KB
- MD5
  
  1f9e9d5ca3be1071910a6be60d07f114
- SHA1
  
  d63effdd47f045afae75d78f56703ee079568a1a
- SHA256
  
  fdb2fbfea4d0affb07b32098a4c4ec162b16361553c99fd05694469914bb32f8
- SHA512
  
  679c7d9c48ac025449799881196b74be3d9decd792fd58663a7e4f38feaf04630acbf64fde13bdef5269fda3b78ab0b0f775b4ab25b898ee872db34558123364
- SSDEEP
  
  3072:jr5gC0aOO2rG1VST/ovPZTerUScdQQV+C/iIvdXzpOsTxw:jr2C0aOO2rGa/o0j8SCMse
Score

3^/10
behavioral6