pysilon | 90a304e19ad39cd162f6350b83b58a72be636b49b358cbbd4d000a4b2b0c11e7 | Triage

Submit
Reports

Overview

overview

Static

static

malware.exe

windows7-x64

7

malware.exe

windows10-2004-x64

9

Resubmissions

02-01-2025 14:41

250102-r2pmqavqf1 10

02-01-2025 14:36

250102-ryvdssyjam 10

Sharing

General

Target

malware.exe
Size

74.7MB
Sample

250102-ryvdssyjam
MD5

7d60377131a89d5a04bb4e7d9ea1d34c
SHA1

447403e3a5e282549268a1aab274a692f093c8c9
SHA256

90a304e19ad39cd162f6350b83b58a72be636b49b358cbbd4d000a4b2b0c11e7
SHA512

31471afa22d063b238d1f17c680d5c86e406a8f0f48375ab161e5225a56f8ca41b7d4d7d51fd0b605a906eeea47240b0eb2e7f5c7408ef2b96c397a3af1ac8d8
SSDEEP

1572864:rVjlaWaDuSk8IpG7V+VPhqYdflJDgxolhBiYweyJulZUdg2rUWeEaqZ9UW:BAZuSkB05awcflhgxoLGpuSrZ9U

Score

10^/10

pysilon discovery evasion execution persistence pyinstaller upx

Static task

static1

pyinstaller pysilon

4 signatures

Behavioral task

behavioral1

Sample

malware.exe

Resource

win7-20240903-en

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral2

Sample

malware.exe

Resource

win10v2004-20241007-en

discovery evasion execution persistence upx

windows10-2004-x64

21 signatures

150 seconds

Malware Config

Targets

- Target
  
  malware.exe
- Size
  
  74.7MB
- MD5
  
  7d60377131a89d5a04bb4e7d9ea1d34c
- SHA1
  
  447403e3a5e282549268a1aab274a692f093c8c9
- SHA256
  
  90a304e19ad39cd162f6350b83b58a72be636b49b358cbbd4d000a4b2b0c11e7
- SHA512
  
  31471afa22d063b238d1f17c680d5c86e406a8f0f48375ab161e5225a56f8ca41b7d4d7d51fd0b605a906eeea47240b0eb2e7f5c7408ef2b96c397a3af1ac8d8
- SSDEEP
  
  1572864:rVjlaWaDuSk8IpG7V+VPhqYdflJDgxolhBiYweyJulZUdg2rUWeEaqZ9UW:BAZuSkB05awcflhgxoLGpuSrZ9U
Score

9^/10

upx discovery evasion execution persistence
- Enumerates VirtualBox DLL files
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Browser Information Discovery

File and Directory Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

pyinstallerpysilon

behavioral1

behavioral2

discoveryevasionexecutionpersistenceupx

© 2018-2025

Terms | Privacy