pysilon | 0f8ddaa2bc8e8fbf2d12d88e76a80b8aa5b671c28c3e6c9271dbbe646fd3ff0e | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
SaladBootstrapper (1).zip
Size 68.7MB
Sample250116-cgymkawkhs
SHA256 0f8ddaa2bc8e8fbf2d12d88e76a80b8aa5b671c28c3e6c9271dbbe646fd3ff0e
MD5 8f0ce7846e7b4d560fad2c0dc164a648
SHA1 9de242408d37f54deda72501acaa750f0d14058e
SHA512 dff795447f06d1b922dd92e6c6b7b566909996f8e0134af1a2f2e2b252f7e4305208db771ae0625b17d9f4df71e0ed4122689e8a1610c2b6ed48535b40364a95
SSDEEP 786432:8VyJowM7W8788m1Nu6BYdBU+dSYCxeDLkVhXkT6fR:g7Wb8muaYdBR1Lknkm
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

pysilon discovery execution pyinstaller

Malware Config

Targets

- Target
  SaladBootstrapper/Salad.dll
- Size 942KB
- SHA256 37a39e08106ce45727eb3a45ce2519985ce86b198068697bd169e0326bee5627
- MD5 d5a3406447a03f4ae00197909c21ec16
- SHA1 f1416af46c2588a2ab3653e4996f557619d06c2f
- SHA512 25d8cc1588e24c934dc13a67786950eee0961682a27bcb89fac6ec4e4e301dc21ab0062f4c3b5ab09d86e1f992501048594f692caccbf51f7652b35f8ff28813
- SSDEEP 12288:8KuHqB3ueaLOh1HwIao596UC8yZKJ5EWnfYoyCIrr2KgXc11:8dWeOh15v596UC8ydWgdjr2Kg
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral1 behavioral2
- Target
  SaladBootstrapper/bin/Monaco.html
- Size 70KB
- SHA256 99c6272931dab083bf7bed7766c8b2f482b90ce91640881fc3c25e628b99de48
- MD5 0c89c5f7d91bab9c7061c348010e5060
- SHA1 1c62133f565001f9bbb1278aaf7476450585a47d
- SHA512 07bbe66911cd03feaf7942e0815d6bd340b6413985c5de3a9d9883932cf1031d116671e86676495fd1a8d718013f0f4196e6ed3e86db2ed5d857d2ae7a8b347d
- SSDEEP 1536:AwmVPlSG/xJ4RyTbNfBf8XT/p/gmFwZhQVsWTVW2P2zVDKxgoa7:3mVPlSaJ4RyTbNfBf8XT/p/gmFwHSsWi
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

discovery
- Legitimate hosting services abused for malware hosting/C2
behavioral3 behavioral4
- Target
  SaladBootstrapper/bin/Salad.dll
- Size 6.2MB
- SHA256 b2f73faae3e8f343eef01cc87efb889a33357faa0c749a4bfe04b1df6a7571e4
- MD5 42fe6e4b1feb2c9c50ae78a0e15ab9ed
- SHA1 74b11462a0b3f67750a4fb7899009acdf58db664
- SHA512 d77ffbccd5f84bf81569dbf21d712f77f6a90042cc49b8ddd119e1ab52e25e7dd2d62563677a3f1f0b16136bb0707eee1c132f4b1702c883f7ee5d8d3d11a536
- SSDEEP 98304:jY+RSMlSw1AwIpYsiVZ+eYbFNjX1Nu6I:MGSMlSw1ArYsiVZ+eYbFNbTRI
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5 behavioral6
- Target
  SaladBootstrapper/bin/vs/base/worker/workerMain.js
- Size 149KB
- SHA256 bdf9433692a08851e13dd58504eef19f51bd2ec7241923a68edf5772e0e53af5
- MD5 27ead90c7702154755785e0e53398755
- SHA1 86b59485fe6f6ccb1805183fa75062a2ac1c859e
- SHA512 6829681575179c90bb7817b17feee60e7d44d8abb15264ab39d7f0edf95dd1d030b99c12b005c753cd786c26ce6f17ff09b058c16f3363596f785e386ef78e82
- SSDEEP 1536:XNSxrkwnz+dTHHfvYYdBwDZ2Ogvh52xgh2hQXIvTBaB7hU74Yc6aphU1PblosJEl:XzdTagJkb+6jFlJJEt9yjjTCD2zw
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral7 behavioral8
- Target
  SaladBootstrapper/bin/vs/basic-languages/bat/bat.js
- Size 2KB
- SHA256 9bca42394fe8922fec24b768eeb8ce04692de6fad82f9052d5b7e70f5c6b0f40
- MD5 4cb475399c4490eea41982dcd6d9653e
- SHA1 fc97d57206ff7fa1c89ff0fc9f6e2f04a20ea185
- SHA512 27eefe83cf38a7d784414d99b472f6fcd7e595691eb0f368254ba1f71aaf702840b62bf232c30c515a8fada234699fefeef496c0c24669cc158cb567227e4783
- MD5 SHA1 SHA512
Score

3^/10

discovery execution
behavioral10 behavioral9
- Target
  SaladBootstrapper/bin/vs/basic-languages/coffee/coffee.js
- Size 3KB
- SHA256 e706c9f8e5c5a0cb01b2f4e4879ec34a050d6eb2a8840284eb7badd9d78099f9
- MD5 9d0c4ac1691eed0a480c3e9246490d29
- SHA1 38258864fd070c35cec6b68715d58771df9fe3e1
- SHA512 437a703607a9f0cb96ffb56312d149b95f596290591d14098c36d978b2e1fdba3c3712c9099923bc0a709c5c0ebd7eea868f63dfbcc69cdf5a9325b8a67006b6
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral11 behavioral12
- Target
  SaladBootstrapper/bin/vs/basic-languages/cpp/cpp.js
- Size 5KB
- SHA256 a7c2bea7ca3d9e203a3a286735945fe010c8f4f8d46620386ee8befc6a78b32b
- MD5 0a16509e6cd0155fb622e785cfe976c7
- SHA1 7afa7f823191c43d7a4bdd7d91577495de62c21a
- SHA512 2cbc48cb10c467561c6a84f59405e9c2f864640b3a21e6fe5cd14ad1a7ca5667b766b3c0511df26f28205dd17338a878bd1164a4f5875235a73214f3e4aeb49d
- SSDEEP 96:hFDMgRs/rbV1+gqVV1+/LVb9ZRC2seM6jjz13MwVcEghhb6Yw76wGcmvRBNIs:hZGrTOcVv5M61h8hSeiYL
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral13 behavioral14
- Target
  SaladBootstrapper/bin/vs/basic-languages/csharp/csharp.js
- Size 4KB
- SHA256 6b3be9a86ee8e3202f51745d94d24cc1eefbcf7d9e6d94fbaf70146b084e835f
- MD5 f8f841d13c9220e15dcd6bc386b37ba2
- SHA1 2b8b7003820d19ed83afde98c845db5e3d5753f8
- SHA512 0b167865b8d7847792c80144e83bdf33655db6ecc0934bb3290f8b5793fee8168aeaf9d74b3541a9424c4f180aad496c2d8710e3847a5bf9d4b2c960ddea4ae5
- SSDEEP 96:hFDMgRsVx+rbV1+gqGV1+hmQuq1cBh8b7gj8/pLxb6J994wGcKU7dYIkI:hZi+rTtPsRXpw9SiKUJGI
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral15 behavioral16
- Target
  SaladBootstrapper/bin/vs/basic-languages/csp/csp.js
- Size 1KB
- SHA256 4b5a5d7d50986b86b00833447e097c0f01a4388ce1765b48e7e371d06e3a4789
- MD5 22ada25d590811dcff4e5f5d698e583b
- SHA1 c43d4846967d5037ef05b102e49d1fbc54e45fbc
- SHA512 c8373ea0b78114f82e8bf027473f72ada0d8acd51623152a0072111d8b3b7d5ac310a1cc510c4e4cd2e97a7686db3c87b2da675fc910898bd11108e4b50ed189
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral17 behavioral18
- Target
  SaladBootstrapper/bin/vs/basic-languages/css/css.js
- Size 4KB
- SHA256 bd331fd3bd2c37b0c3150035325f163ac9266bf6d942310764815e676d856d91
- MD5 49ad30f1151cfd7a74677fdc6dd13da9
- SHA1 286d47f0a4cfa26da2e4d1f1317a8c87000bb5fc
- SHA512 7337706bfd5bd54938da0fba35e97f8e5780491c04b58d43fc6d905bd2dca92897f1ed8d48e42665f166da7684cc6e29a63ae73f8d3779a9feb97c397a642f0d
- SSDEEP 96:hFDMgRsozIq+q17qcq6V1+/aMj1cqTroIrqjKf8O3lzXY0Jc:hZzzv9VmjoOf8O39XbJc
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral19 behavioral20
- Target
  SaladBootstrapper/bin/vs/basic-languages/dockerfile/dockerfile.js
- Size 2KB
- SHA256 65b86fc54e9b35d6cb84f01dfb905680dbcad6605757de1d6bca84e3029889af
- MD5 e32de981bdaf75e6ffb8fe40bc955a68
- SHA1 bef1af7b26ea01c987c7a6295bb7192d83a32068
- SHA512 a3eadd8c1389dff6c2c6e595efff69be3a573d01e4e16b8e4a8b28f63e4c48c9c439b5dd93666d81d703d1c6b5bf927cc8e47d04af270128095f0d579407c2f4
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral21 behavioral22
- Target
  SaladBootstrapper/bin/vs/basic-languages/fsharp/fsharp.js
- Size 3KB
- SHA256 1390079babc117d3f376735780d98f409f317eb4628d17106642c6933ea1da7f
- MD5 de122b3bc44a8714f386dc80282dcb12
- SHA1 06888a9b616993e9af9797cec64c6d419065f2cb
- SHA512 ab48f2e5bfa6ea0024530141bb5d35b9090ee0254a3e8f8b86fa36cc8c2fca8000a3caafcfffc1d83e21c488e1f1990c91f537290b54fbbca1d3c7be090dfba5
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral23 behavioral24
- Target
  SaladBootstrapper/bin/vs/basic-languages/go/go.js
- Size 2KB
- SHA256 46d1757c3cd3dbc3c7b465a338880144922a1c34c30e36f06ff2db8c2ff75b86
- MD5 5b4484c914cd97aff4510b803f2517ef
- SHA1 8f275ac36c57c4c464e30f92f525ffbd0fd436c6
- SHA512 b34c64f9997f4b72760eca270d2a0c2e22d83467d3f0bc82e7c0e63d62d8f9d74a144a28d676a223cdefef417af723801ac0535375d0dd64bb3a81e87617fed0
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral25 behavioral26
- Target
  SaladBootstrapper/bin/vs/basic-languages/handlebars/handlebars.js
- Size 6KB
- SHA256 31d25588d120e7c79f3332ff3b3c794cebd0554c7578e3bb37b3cac366e4f6c2
- MD5 3ca7cf83292b56444548f2914c0e1811
- SHA1 4be5b1adaa187d82a94967e6960d811acd700b93
- SHA512 2d337b64def0d42f8bd6476cf31e806f67f77d26c95c68e75574fc310f7974852a810f8b197238559a2cb20d07914de5844481477321cdcb2c68c47da9088eb8
- SSDEEP 96:hFDMgRspITV1+/I/+B1BerJzlWK2BZwIBTIwbcdg6EHpf4Og6E8S6g6EB+FpAjE3:hZhbYbQRld2BZ1O0p4OE60+dMZLDs
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral27 behavioral28
- Target
  SaladBootstrapper/bin/vs/basic-languages/html/html.js
- Size 4KB
- SHA256 c717ac0701d3b1e22dc52a0c53608214297e5fab7bc7011cf4e964f2eca9d62f
- MD5 630fa41f59a189aed68b4db82559de95
- SHA1 14a527d27240ba0effcfa43a5c46b9289e96b822
- SHA512 e15c602788f13afd1e19e5f82de7a35eb9656950553bc3913205ba3e70ddf87199b7f9b358db7b7704efd3dc85029ad277692b6b84f5f549964b9dd7cce1ad60
- SSDEEP 96:hFDMgRsfInV1+/6mQVV1+HBwBRl0GSytHd6EHaK4T6Ef6EByyEhcKMgEQEJWf:hZLP+4+GLl0GSytHLaK4ccKM2
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral29 behavioral30
- Target
  SaladBootstrapper/bin/vs/basic-languages/ini/ini.js
- Size 1KB
- SHA256 1f0feeae58c32f6e1f31b78f7e2aab3c91da387e464234c0f55ebff0e77444a2
- MD5 b9252b74381fe17565d494711f4c9093
- SHA1 9ed6a00a166c0b5abdbb3ea45fa7df3a5defc8ee
- SHA512 2fe594de8ac3444223edc011cbd7f08a6f8ab2de2bf56919c2d6f1208e22391652d14549c3822c21c4999139ffce711fdbf00725e95aa01068bf5f223c3b8710
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

pyinstallerpysilon

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

discoveryexecution

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32