Overview

overview

10

Static

static

10

photos.exe

windows7-x64

7

photos.exe

windows10-2004-x64

9

photos.exe

android-9-x86

photos.exe

android-10-x64

photos.exe

android-11-x64

photos.exe

macos-10.15-amd64

photos.exe

ubuntu-18.04-amd64

photos.exe

debian-9-armhf

photos.exe

debian-9-mips

photos.exe

debian-9-mipsel

discord_to...er.pyc

windows7-x64

discord_to...er.pyc

windows10-2004-x64

discord_to...er.pyc

android-9-x86

discord_to...er.pyc

android-10-x64

discord_to...er.pyc

android-11-x64

discord_to...er.pyc

macos-10.15-amd64

discord_to...er.pyc

ubuntu-18.04-amd64

discord_to...er.pyc

debian-9-armhf

discord_to...er.pyc

debian-9-mips

discord_to...er.pyc

debian-9-mipsel

get_cookies.pyc

windows7-x64

get_cookies.pyc

windows10-2004-x64

get_cookies.pyc

android-9-x86

get_cookies.pyc

android-10-x64

get_cookies.pyc

android-11-x64

get_cookies.pyc

macos-10.15-amd64

get_cookies.pyc

ubuntu-18.04-amd64

get_cookies.pyc

debian-9-armhf

get_cookies.pyc

debian-9-mips

get_cookies.pyc

debian-9-mipsel

misc.pyc

windows7-x64

misc.pyc

windows10-2004-x64

Resubmissions

12-01-2025 14:23

250112-rqj8vswjds 10

12-01-2025 09:23

250112-lcla4syndr 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    photos.exe

  • Size

    78.5MB

  • Sample

    250112-rqj8vswjds

  • MD5

    a4c9a785c0e51be1eba029f03947d108

  • SHA1

    9141272123df990f6b0462a13d4b2d2a8a133c17

  • SHA256

    122c37ee120e2429eb8e348ab8b30124ed0f9ca295ffd9aec8423932a251702e

  • SHA512

    390b8422a81d758d021eb19457bb08e70f34722b8179d29104528b54665a416ecbd3de5a1623253d6cfeccbe9194e048a87f48b706209b6e52eb0bee355197d0

  • SSDEEP

    1572864:OHl4WLxMsmwSk8IpG7V+VPhq9AE7eliPiYgj+h58sMwSe37z1cJLRK:OHO6MsmwSkB05aw98wx5Oe37YR

Score
10/10
pysilonandroidevasionexecutionlinuxmacospersistencepyinstallerupx

Malware Config

Targets

    • Target

      photos.exe

    • Size

      78.5MB

    • MD5

      a4c9a785c0e51be1eba029f03947d108

    • SHA1

      9141272123df990f6b0462a13d4b2d2a8a133c17

    • SHA256

      122c37ee120e2429eb8e348ab8b30124ed0f9ca295ffd9aec8423932a251702e

    • SHA512

      390b8422a81d758d021eb19457bb08e70f34722b8179d29104528b54665a416ecbd3de5a1623253d6cfeccbe9194e048a87f48b706209b6e52eb0bee355197d0

    • SSDEEP

      1572864:OHl4WLxMsmwSk8IpG7V+VPhq9AE7eliPiYgj+h58sMwSe37z1cJLRK:OHO6MsmwSkB05aw98wx5Oe37YR

    Score
    9/10
    upxevasionexecutionpersistence

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral10behavioral2behavioral3behavioral4behavioral5behavioral6behavioral7behavioral8behavioral9

    • Target

      discord_token_grabber.pyc

    • Size

      17KB

    • MD5

      e523026b612006e580e96bd9e2a8882c

    • SHA1

      03b9938701f7eff11a0c3632ed805e8188598c88

    • SHA256

      8ae6baddc552f9a47c488760a3d3b04f217f7c999dbffc1a548bb09532e6bf77

    • SHA512

      a0f15f5edecbab4894aa3b85092fc2bde34b76f6048b198ce387d59a56d6c74969201cc43d19cd27a9ff0a6ab72268884a90ef206f0be34a5707a7f6ea24a853

    • SSDEEP

      384:cGllyAavwS9F0RW807PPQviowoYbCj+Mo8WWIc02a8:cIlytvX9iRW8inQ6owoYOyM0d2a8

    Score
    1/10
    behavioral11behavioral12behavioral13behavioral14behavioral15behavioral16behavioral17behavioral18behavioral19behavioral20

    • Target

      get_cookies.pyc

    • Size

      10KB

    • MD5

      b38f506528b3d6d5dbd851426c347b95

    • SHA1

      e91bf4ef42128267934e21be0176e552480f5977

    • SHA256

      85a7c34afad2c270ca690a5b4c30cc8bf16967e623fc77f4de4497901030a93b

    • SHA512

      ab110dc92eba564fd0ec6c6a75e779f588518dc1aa461f072ab02b96bc11fbe25e09faa6a556dc6a127c3e8826382697b72037a0cefbdaf32fd70a723e746295

    • SSDEEP

      192:TzOCIeinQfUF9LdwOEVOFc1mNe47+o+zEzzzzz1zz+HoowAE:TzOUiQccEe4KoOIAE

    Score
    1/10
    behavioral21behavioral22behavioral23behavioral24behavioral25behavioral26behavioral27behavioral28behavioral29behavioral30

    • Target

      misc.pyc

    • Size

      5KB

    • MD5

      31aa260c6cdeaa9d942cd0dcfcadd16a

    • SHA1

      a6818f3acf5c2ab9d65b41a81cb92b36b85cc932

    • SHA256

      b522284f1a7e518c269c0414160407ec7834a4397f85ef389433b49367b5df9c

    • SHA512

      0dd277ef948315a3554bd8c5110e27afa9b2eac88defc1211771c050cdd27b3668484dec35ec5c5010bff00b62c2cebd9e7286c0b114ad28437719b42bd0fc2c

    • SSDEEP

      96:DSajAihmJG4n3B4SmSSSSlSSSShDwegPbbVxlj0nIAEDS5ejmw01k9Bddpq:eYAfn3ySmSSSSlSSSSeeOPVxx0nIAZeQ

    Score
    1/10
    behavioral31behavioral32

MITRE ATT&CK Enterprise v15

Tasks

static1

pyinstallerpysilon
Score
10/10

behavioral1

upx
Score
7/10

behavioral2

evasionexecutionpersistenceupx
Score
9/10

behavioral3

Score
1/10

behavioral4

Score
1/10

behavioral5

Score
1/10

behavioral6

Score
1/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

Score
1/10

behavioral10

Score
1/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

Score
1/10

behavioral14

Score
1/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

Score
1/10

behavioral32

Score
1/10