pysilon | d86a8563804e2bbc440b8666452963c4cf097d9b513f19f83196026aa240d960

General

Target

Eulen Crack.zip
Size

103.1MB
Sample

250105-3lf67ayphz
MD5

7774980c78b1377b80bb477dc7b11604
SHA1

ced28df93050336ef72ea495ac5d895485e93a92
SHA256

d86a8563804e2bbc440b8666452963c4cf097d9b513f19f83196026aa240d960
SHA512

667b64a8a6fb01f5c52215a1ba4735200401a38cbafd8289b3d0bb836d3531fa0128760180c752bf7ee2ec3e2da59f1a852e4af54f6651d5d28d9b7b89cdcc2a
SSDEEP

3145728:g5SBBXXY/wqKlgLcANxfSvjQVplqTOe9r8U3I8GK:xBBnYoYC4liBfcK

Score

10^/10

Malware Config

Targets

- Target
  
  Eulen Crack/Eulen.exe
- Size
  
  103.7MB
- MD5
  
  6845787c6f9187daad6cf31ec39151d1
- SHA1
  
  c1bdf96983744a97a06c06cdb24dfdf17ed40288
- SHA256
  
  d3ff4130a88a1a42732322ef16a69629ffdc9f5da4b9b3e5f3e139d4d0d0c2d4
- SHA512
  
  245d127edf951aed41c4125ac3f151fad8184813339ee6e4e963b11f71533c7314f347d33266060e1208e0c7b34a47ab788993b9da73f4e72fef5e6351f768b4
- SSDEEP
  
  3145728:NASCRrS6xjKcBanL2qHO5iVXfnGQbRe0zJcBSOZ2:aNZSWNaBHCid1XcBQ
Score

9^/10

evasion execution persistence
- Enumerates VirtualBox DLL files
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1
- Target
  
  discord_token_grabber.pyc
- Size
  
  15KB
- MD5
  
  aaaeca514d98795f954c1f2eebb18881
- SHA1
  
  6331352aada5256452c43545bb6593958602a20c
- SHA256
  
  a808291bd70bbd15bedd818ef25a1dbcfbf548330fd9ddf5244143ec3eb66cc6
- SHA512
  
  ec9c019d0061103e1e1b3db7feb346136e5e4f447804f9586aacdd7da3c9b877bda1221735b08fc44586cd443b8909664a22bb90ce3a4230402357d35fe80883
- SSDEEP
  
  384:nGC7RYmnXavkLPJrltcshntQ5Maa2holHVg:nGCuvkL9ltcsttQ5MaaCgHVg
Score

3^/10
behavioral2
- Target
  
  get_cookies.pyc
- Size
  
  9KB
- MD5
  
  b97f0689742bd69af8900cd3731c5294
- SHA1
  
  28ccff4aa6009fc86d4561e5bc37ea2fb175a689
- SHA256
  
  b080857887222e4c048bba2d7bb3ebc25cc26f31bb26f645fafc01de4e46a03c
- SHA512
  
  9b2c471688fee5cb3d1112ec0d594f5c16371dbb6a1dd30668f64746f2073cea377ca6797928e67bfc933e03c52d819ec676f00a115ef3afa4eeb240daf71883
- SSDEEP
  
  96:nlNatjbBMMKiNW8Zxh9ybA6HUWc4/xIgBZFLjH2K8BXFxUBvF/A7qx3MlMFztwX3:lNahBeiNR9QfUF2x3NC79F21aGaqDAht
Score

3^/10
behavioral3
- Target
  
  misc.pyc
- Size
  
  4KB
- MD5
  
  3eb4ff2a9be2d13ecb7343cf82865294
- SHA1
  
  6f9d52b590a15de10dd4589ced7320734371b844
- SHA256
  
  5697249c80354c3adbbb6ae7f2068bd5e0ab44ce08def7b1ef168508fb1fb2c4
- SHA512
  
  776bc0e43593579b7a82bdf0ed77ba89803111b5651cf222c82a7245cd9a297560e3400dc9fcefbed56a91cde4f786f2d745e931102c4ac8750044f2f5072f63
- SSDEEP
  
  96:XSMlhlvSzMPDweHPF8+VB7sHIZGQSWfvmyyZ1k9zBub:iolvSzM0evq+VBXZGQlvmV1k5Bub
Score

3^/10
behavioral4
- Target
  
  passwords_grabber.pyc
- Size
  
  7KB
- MD5
  
  e51a6ecd8527b9e758afb60513356e19
- SHA1
  
  89feb7e8f793bef5dc22556196bb9b03387476fe
- SHA256
  
  3c2a8cf8d20d10c27c1c389064abbcce9aab9d6afe5cac26a376ebedf551bece
- SHA512
  
  acc505cea3eff572570b05418931b9be9339c0dd91922ce5ef470810bf861f2395535ccab883f470910bb4e0c9dae309382044568ae0a3aba2b9323ada1f784d
- SSDEEP
  
  192:A114qWLlhuUIxDPK2cMHJb+XUhitovgEuT:64qWLlMFyVMHAE/Y
Score

3^/10
behavioral5
- Target
  
  source_prepared.pyc
- Size
  
  172KB
- MD5
  
  c6c42f8a4434eeac1fe78c89d1170eec
- SHA1
  
  b5cbcb8501255880c7b7305f5bf1d422f62f8b6b
- SHA256
  
  8fd93c67b3b70115a609a08fe0a335343f078db86320a057c61d52dc6e19ca7c
- SHA512
  
  5e9dedfab6b9caee28f4b2d5bb418f8bd31e03a5d0896250f9b4d2009cc5df20618c65bc4b708aa037efd7466340d622e6c5416b98c9885178c063f8570ba1e3
- SSDEEP
  
  3072:nFfJAC0aOO2LG1VUT/ovPZTerUScdQQV+C/iIvdXzp7sTxw:nwC0aOO2LGM/o0j8SCxse
Score

3^/10
behavioral6