Overview

overview

10

Static

static

10

altas installer.exe

windows7-x64

7

altas installer.exe

windows10-2004-x64

9

altas installer.exe

android-13-x64

altas installer.exe

android-13-x64

altas installer.exe

macos-10.15-amd64

altas installer.exe

ubuntu-18.04-amd64

altas installer.exe

debian-9-armhf

altas installer.exe

debian-9-mips

altas installer.exe

debian-9-mipsel

discord_to...er.pyc

windows7-x64

discord_to...er.pyc

windows10-2004-x64

discord_to...er.pyc

android-11-x64

discord_to...er.pyc

android-13-x64

discord_to...er.pyc

macos-10.15-amd64

discord_to...er.pyc

ubuntu-18.04-amd64

discord_to...er.pyc

debian-9-armhf

discord_to...er.pyc

debian-9-mips

discord_to...er.pyc

debian-9-mipsel

get_cookies.pyc

windows7-x64

get_cookies.pyc

windows10-2004-x64

get_cookies.pyc

android-13-x64

get_cookies.pyc

android-13-x64

get_cookies.pyc

macos-10.15-amd64

get_cookies.pyc

ubuntu-18.04-amd64

get_cookies.pyc

debian-9-armhf

get_cookies.pyc

debian-9-mips

get_cookies.pyc

debian-9-mipsel

misc.pyc

windows7-x64

misc.pyc

windows10-2004-x64

misc.pyc

android-10-x64

misc.pyc

android-13-x64

misc.pyc

macos-10.15-amd64

Resubmissions

08-02-2025 12:09

250208-pbptpavper 10

08-02-2025 11:46

250208-nxtjbsspgt 10

06-02-2025 02:27

250206-cxm6rszlfs 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    altas installer.exe

  • Size

    87.5MB

  • Sample

    250208-pbptpavper

  • MD5

    e1c8bc131cc1502e31dec5146351c557

  • SHA1

    95792a7ed9bec9bccf88b3ecdffe1a06fb72b8ef

  • SHA256

    214c22cc13004c4e5c7b6ef898d2c354acc6a27eb5125d8ff783c5e0b6508e06

  • SHA512

    b5807f60f1c5d6fde557c7c27b5424e57eefe7c8c1a962f3949f3a412603f94dfb26eb18e30bd5e1ebbf705a9ef6ccd7d51fe4a74d9d525d1382257b19f4eac0

  • SSDEEP

    1572864:z2GKlEWCsm/OkiqOv8im2AUdfmE7qliwiYgj+h58sMwhue9DOVwJq:znKe3sm/OknOv8i3XfCwy51ueV6

Score
10/10
pysilonandroiddefense_evasiondiscoveryexecutionlinuxmacospersistencepyinstallerupx

Malware Config

Targets

    • Target

      altas installer.exe

    • Size

      87.5MB

    • MD5

      e1c8bc131cc1502e31dec5146351c557

    • SHA1

      95792a7ed9bec9bccf88b3ecdffe1a06fb72b8ef

    • SHA256

      214c22cc13004c4e5c7b6ef898d2c354acc6a27eb5125d8ff783c5e0b6508e06

    • SHA512

      b5807f60f1c5d6fde557c7c27b5424e57eefe7c8c1a962f3949f3a412603f94dfb26eb18e30bd5e1ebbf705a9ef6ccd7d51fe4a74d9d525d1382257b19f4eac0

    • SSDEEP

      1572864:z2GKlEWCsm/OkiqOv8im2AUdfmE7qliwiYgj+h58sMwhue9DOVwJq:znKe3sm/OknOv8i3XfCwy51ueV6

    Score
    9/10
    upxdefense_evasiondiscoveryexecutionpersistence

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Downloads MZ/PE file

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      defense_evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2behavioral3behavioral4behavioral5behavioral6behavioral7behavioral8behavioral9

    • Target

      discord_token_grabber.pyc

    • Size

      17KB

    • MD5

      e523026b612006e580e96bd9e2a8882c

    • SHA1

      03b9938701f7eff11a0c3632ed805e8188598c88

    • SHA256

      8ae6baddc552f9a47c488760a3d3b04f217f7c999dbffc1a548bb09532e6bf77

    • SHA512

      a0f15f5edecbab4894aa3b85092fc2bde34b76f6048b198ce387d59a56d6c74969201cc43d19cd27a9ff0a6ab72268884a90ef206f0be34a5707a7f6ea24a853

    • SSDEEP

      384:cGllyAavwS9F0RW807PPQviowoYbCj+Mo8WWIc02a8:cIlytvX9iRW8inQ6owoYOyM0d2a8

    Score
    1/10
    behavioral10behavioral11behavioral12behavioral13behavioral14behavioral15behavioral16behavioral17behavioral18

    • Target

      get_cookies.pyc

    • Size

      10KB

    • MD5

      b38f506528b3d6d5dbd851426c347b95

    • SHA1

      e91bf4ef42128267934e21be0176e552480f5977

    • SHA256

      85a7c34afad2c270ca690a5b4c30cc8bf16967e623fc77f4de4497901030a93b

    • SHA512

      ab110dc92eba564fd0ec6c6a75e779f588518dc1aa461f072ab02b96bc11fbe25e09faa6a556dc6a127c3e8826382697b72037a0cefbdaf32fd70a723e746295

    • SSDEEP

      192:TzOCIeinQfUF9LdwOEVOFc1mNe47+o+zEzzzzz1zz+HoowAE:TzOUiQccEe4KoOIAE

    Score
    1/10
    behavioral19behavioral20behavioral21behavioral22behavioral23behavioral24behavioral25behavioral26behavioral27

    • Target

      misc.pyc

    • Size

      5KB

    • MD5

      31aa260c6cdeaa9d942cd0dcfcadd16a

    • SHA1

      a6818f3acf5c2ab9d65b41a81cb92b36b85cc932

    • SHA256

      b522284f1a7e518c269c0414160407ec7834a4397f85ef389433b49367b5df9c

    • SHA512

      0dd277ef948315a3554bd8c5110e27afa9b2eac88defc1211771c050cdd27b3668484dec35ec5c5010bff00b62c2cebd9e7286c0b114ad28437719b42bd0fc2c

    • SSDEEP

      96:DSajAihmJG4n3B4SmSSSSlSSSShDwegPbbVxlj0nIAEDS5ejmw01k9Bddpq:eYAfn3ySmSSSSlSSSSeeOPVxx0nIAZeQ

    Score
    1/10
    behavioral28behavioral29behavioral30behavioral31behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Modify Registry

1
T1112

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

File and Directory Discovery

1
T1083

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Virtualization/Sandbox Evasion

1
T1497

Lateral Movement

Collection

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Tasks

static1

pyinstallerpysilon
Score
10/10

behavioral1

upx
Score
7/10

behavioral2

defense_evasiondiscoveryexecutionpersistenceupx
Score
9/10

behavioral3

Score
1/10

behavioral4

Score
1/10

behavioral5

Score
1/10

behavioral6

Score
1/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

Score
1/10

behavioral10

Score
1/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

Score
1/10

behavioral14

Score
1/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

Score
1/10

behavioral32

Score
1/10