pysilon | 10d68e96b17fe89e1672bb3df965728067c38107ea3c988dbf0210248fc4d1e6

Resubmissions

12-01-2025 15:47

250112-s792aaykcy 10

12-01-2025 14:03

250112-rcpw7avncy 10

Sharing

Copy URL

Twitter E-mail

General

Target

DecompilerV.2.4.rar
Size

73.8MB
Sample

250112-rcpw7avncy
MD5

86961889e1eb75e6f5ec6f96df826862
SHA1

989727abc34182c44b5ba75e6b38fe11d7960896
SHA256

10d68e96b17fe89e1672bb3df965728067c38107ea3c988dbf0210248fc4d1e6
SHA512

ec42988d129a3d6775a75d7afe4b3c6b1430ccc375319ecd872e32d1299d6ba5dbeff0ebdb1f5e966d38d930f094f7de76bc55061a07fd12f3ad36de9b7db636
SSDEEP

1572864:IotHuxPhVvnYn9mikbh3FtuxRZwe74rE0mBS+vxy0DWVjivURo9V7A6:IoF0rvnYn9HY2Se1B1vhWV8

Score

10^/10

Malware Config

Targets

- Target
  
  Bugs.dll
- Size
  
  12KB
- MD5
  
  c559ad84688d4b3550b8efbaa58418a8
- SHA1
  
  1daa2ca0f301ee28c7e9c3d0c596592bad077701
- SHA256
  
  1e62746213938c3be93de2853c853db1b465a86f4f6756ed25a9330620c82a11
- SHA512
  
  1af2cf37326cb8571a07cac511b1b5fd0784741062fb4ea84211ec1e13fbd2a7f4154ee3071c9ec5cc043392e6eecb37f08ad20617f6668a36246bba82713a24
- SSDEEP
  
  48:G22222222222222222222222222222222222222222222222222222222222222n:2
Score

1^/10
behavioral1 behavioral2
- Target
  
  Decompiler V.2.4.exe
- Size
  
  75.4MB
- MD5
  
  7eaef81d5fa7765c87f64c9e8781957b
- SHA1
  
  e1e390048941688e1bc92c8c4e9dc8401da3405b
- SHA256
  
  55e26286c6d116b54651a895ecc736d8087ad9527547f61eec2d0ee3d95d9cb3
- SHA512
  
  fc698f58ff38c0d107c413e951429f111ad13221931c65580b2cbddcb883816640cf024e48e971bf34b150829a6432cd7e9be25b65a8cc89dfbb761da252c476
- SSDEEP
  
  1572864:HvhQ6l8xSk8IpG7V+VPhqIbE7WTylPj4iY4MHHLeqPNLtDaSWRvZv2BYK:Hvh1ixSkB05awIxTy5nMHVLteSYYBZ
Score

9^/10

upx evasion execution persistence
- Enumerates VirtualBox DLL files
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral3 behavioral4
- Target
  
  LoaderScripts.py
- Size
  
  2KB
- MD5
  
  8f65f38bca462f4841aeca7b9fae6078
- SHA1
  
  c6cfd3b8788a934a2830bf9dc561bffac072efab
- SHA256
  
  cc3e3f0a38dcede5641b5f79f6d34907d11035cd33c02ed85d88541b07267512
- SHA512
  
  2232a0442efb56bcf784a155ae46fc9b4f295985a307062efae1517cc13df59acf47669332a8d2f5d8057b8d0c73bad07b404125448a48bd5b821d18348c367b
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  
  Roblox HWD/Bugs.dll
- Size
  
  12KB
- MD5
  
  c559ad84688d4b3550b8efbaa58418a8
- SHA1
  
  1daa2ca0f301ee28c7e9c3d0c596592bad077701
- SHA256
  
  1e62746213938c3be93de2853c853db1b465a86f4f6756ed25a9330620c82a11
- SHA512
  
  1af2cf37326cb8571a07cac511b1b5fd0784741062fb4ea84211ec1e13fbd2a7f4154ee3071c9ec5cc043392e6eecb37f08ad20617f6668a36246bba82713a24
- SSDEEP
  
  48:G22222222222222222222222222222222222222222222222222222222222222n:2
Score

1^/10
behavioral7 behavioral8
- Target
  
  Roblox HWD/Scripts.py
- Size
  
  12KB
- MD5
  
  c559ad84688d4b3550b8efbaa58418a8
- SHA1
  
  1daa2ca0f301ee28c7e9c3d0c596592bad077701
- SHA256
  
  1e62746213938c3be93de2853c853db1b465a86f4f6756ed25a9330620c82a11
- SHA512
  
  1af2cf37326cb8571a07cac511b1b5fd0784741062fb4ea84211ec1e13fbd2a7f4154ee3071c9ec5cc043392e6eecb37f08ad20617f6668a36246bba82713a24
- SSDEEP
  
  48:G22222222222222222222222222222222222222222222222222222222222222n:2
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  
  Scripts/Scripts.py
- Size
  
  2KB
- MD5
  
  8f65f38bca462f4841aeca7b9fae6078
- SHA1
  
  c6cfd3b8788a934a2830bf9dc561bffac072efab
- SHA256
  
  cc3e3f0a38dcede5641b5f79f6d34907d11035cd33c02ed85d88541b07267512
- SHA512
  
  2232a0442efb56bcf784a155ae46fc9b4f295985a307062efae1517cc13df59acf47669332a8d2f5d8057b8d0c73bad07b404125448a48bd5b821d18348c367b
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  
  Scripts/ServerSide.py
- Size
  
  2KB
- MD5
  
  8f65f38bca462f4841aeca7b9fae6078
- SHA1
  
  c6cfd3b8788a934a2830bf9dc561bffac072efab
- SHA256
  
  cc3e3f0a38dcede5641b5f79f6d34907d11035cd33c02ed85d88541b07267512
- SHA512
  
  2232a0442efb56bcf784a155ae46fc9b4f295985a307062efae1517cc13df59acf47669332a8d2f5d8057b8d0c73bad07b404125448a48bd5b821d18348c367b
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  
  decompile.dll
- Size
  
  15KB
- MD5
  
  a428d30cb8d650090164dc14c1b2e39e
- SHA1
  
  40546e60121b492900074ceeff06c8ee2a84a644
- SHA256
  
  df08a79955798f533b109f06b5018d0b8c840ab1b1b3f8bb9e7c6750e003a2bb
- SHA512
  
  828fe3979c67ef75cbe4f149f0d69b09ea8c22ba70734943d55c45f56bc335cfd76aa78c2cadbcedd94ee9cfcfceb2255e1ddbc50a4aef805433dee9e26fceac
- SSDEEP
  
  96:LSTfSSqOquSSqUSSqUSSqUSSqUSSqUSSquSSqUSSqUSSqESSqGSSqUSSqG:sDthhhhhthh7NhJ
Score

1^/10
behavioral15 behavioral16
- Target
  
  krnlapi.dll
- Size
  
  12KB
- MD5
  
  c559ad84688d4b3550b8efbaa58418a8
- SHA1
  
  1daa2ca0f301ee28c7e9c3d0c596592bad077701
- SHA256
  
  1e62746213938c3be93de2853c853db1b465a86f4f6756ed25a9330620c82a11
- SHA512
  
  1af2cf37326cb8571a07cac511b1b5fd0784741062fb4ea84211ec1e13fbd2a7f4154ee3071c9ec5cc043392e6eecb37f08ad20617f6668a36246bba82713a24
- SSDEEP
  
  48:G22222222222222222222222222222222222222222222222222222222222222n:2
Score

1^/10
behavioral17 behavioral18
- Target
  
  saveinstance.dll
- Size
  
  1KB
- MD5
  
  bcc46643e08397e3ef187ef67ffccbc9
- SHA1
  
  9f0b5f566eb3365c11e41bf74f25d92c79338a55
- SHA256
  
  02a764b4d690bf47eef77371387e87acbd44d9c64360d3e89b8cf2aebeb2929c
- SHA512
  
  2e6dd0976af49f61eeba6d14b969572fac81ee20289c288822c3dbdf7d5b2a96cfb4c3649fc088406f04f2665ac7ee108043cc5eae17ac6bce476f106057efd7
Score

1^/10
behavioral19 behavioral20