empyrean | Cphn-MultiTool[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

Cphn-MultiTool.zip
Size

17.8MB
MD5

9adde2d8b84bbf515644246e0c152bc0
SHA1

0adf5706b9e8501948205eddbfcbeac8e6cdadea
SHA256

ed73cc9cd1933cb0f4751cd8af6cf7cb44d3c6f88b80596b0b1a699510b679f4
SHA512

c89ad3ea5cc646170babb26302d97f11e4ecc49a8ca3e430b71c93dbb5940738612bed5f7d6db607ebe9a14dda4625f7bfa4a5612470b761ef397c326465bdf4
SSDEEP

393216:mMtDBJXpae6sf83GGjysbvGGdHUrfeHh9UhZFyI:xt9JXcjsf3svlUa/KH

Score

10^/10

pyinstaller empyrean

Malware Config

Signatures

Detects Empyrean stealer 1 IoCs

resource	yara_rule
static1/unpack002/main.pyc	family_empyrean

Empyrean family
empyrean

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
static1/unpack001/Cphn-MultiTool/src/utils/upx.exe	pyinstaller

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Cphn-MultiTool/src/utils/upx.exe

Files

Cphn-MultiTool.zip
.zip
Cphn-MultiTool/.git/COMMIT_EDITMSG
Cphn-MultiTool/.git/HEAD
Cphn-MultiTool/.git/config
Cphn-MultiTool/.git/description
Cphn-MultiTool/.git/hooks/applypatch-msg.sample
.sh linux
Cphn-MultiTool/.git/hooks/commit-msg.sample
.sh linux
Cphn-MultiTool/.git/hooks/fsmonitor-watchman.sample
.sh linux
Cphn-MultiTool/.git/hooks/post-update.sample
.sh linux
Cphn-MultiTool/.git/hooks/pre-applypatch.sample
.sh linux
Cphn-MultiTool/.git/hooks/pre-commit.sample
.sh linux
Cphn-MultiTool/.git/hooks/pre-merge-commit.sample
.sh linux
Cphn-MultiTool/.git/hooks/pre-push.sample
.sh linux
Cphn-MultiTool/.git/hooks/pre-rebase.sample
.sh linux
Cphn-MultiTool/.git/hooks/pre-receive.sample
.sh linux
Cphn-MultiTool/.git/hooks/prepare-commit-msg.sample
.sh linux
Cphn-MultiTool/.git/hooks/push-to-checkout.sample
.sh linux
Cphn-MultiTool/.git/hooks/update.sample
.sh linux
Cphn-MultiTool/.git/index
Cphn-MultiTool/.git/info/exclude
Cphn-MultiTool/.git/logs/HEAD
Cphn-MultiTool/.git/logs/refs/heads/main
Cphn-MultiTool/.git/logs/refs/remotes/origin/HEAD
Cphn-MultiTool/.git/logs/refs/remotes/origin/main
Cphn-MultiTool/.git/objects/03/83df7fc328c4f866b3a61efadbf0cc03321199
Cphn-MultiTool/.git/objects/07/7b67a2417790be522458cfab0300b7d4b5f07d
Cphn-MultiTool/.git/objects/1c/7ec343be475f00757f9650013f3649f3caac16
Cphn-MultiTool/.git/objects/1f/e5b6a36e42c08648598bb735259acf3a306566
Cphn-MultiTool/.git/objects/20/4e00f3ea9aeb17361b769b23e8046abe2cf94b
Cphn-MultiTool/.git/objects/24/598f69bdfc7d97f0d8cbe422aa6c6dd24a553d
Cphn-MultiTool/.git/objects/27/7609cdb207471becdbdcb94d21bd23cc4da74a
Cphn-MultiTool/.git/objects/37/59624760903e9068fd7b3eff909a26eeab8ddb
Cphn-MultiTool/.git/objects/49/7848b0c1ef15603cdd61836363a409e9073bb6
Cphn-MultiTool/.git/objects/4b/b2de03e25ce6c40b70ec96e517048e438168dd
Cphn-MultiTool/.git/objects/4d/41ce5a5d3300faabec47d142025505b3dfe0b9
Cphn-MultiTool/.git/objects/51/9ab4a802c9e9a3f7c7b55cef487a64e1f76305
Cphn-MultiTool/.git/objects/58/e62c1dd844bf9073fc08c62a6747bfe5b8b170
Cphn-MultiTool/.git/objects/66/dbdc566b02ef90a25abea80b92a624cab1bbb2
Cphn-MultiTool/.git/objects/67/fe425a08d647f11f4cac33d6167a00ad370d78
Cphn-MultiTool/.git/objects/6b/5819302341366ebb37ee50e81500b9bb077515
Cphn-MultiTool/.git/objects/70/18789e313f4eae2b69f1e389b6ed18587ea049
Cphn-MultiTool/.git/objects/72/5e02543e2b1f1e6401ffbe1b9497396d3b4d6b
Cphn-MultiTool/.git/objects/79/5a0e8e106c415ad6ed42d11f94298685effea4
Cphn-MultiTool/.git/objects/87/50e021cd8049545dd9c8d19904f00ebfe2e014
Cphn-MultiTool/.git/objects/8b/a0e06274f6838bcc8cb5a5f5dc4eb03b9644e9
Cphn-MultiTool/.git/objects/8e/03885903f92ed1e439f76104550037bd34e1c5
Cphn-MultiTool/.git/objects/95/69644aad13bc515b79759904a24938bd92896e
Cphn-MultiTool/.git/objects/95/776f22151859e6921f6cab229223833a9daa98
Cphn-MultiTool/.git/objects/a3/dcc811bf8b55b06e82bb5fdc63d1b413f7daef
Cphn-MultiTool/.git/objects/ae/5c6029ca2745f549022bae2b2144af881d11b4
Cphn-MultiTool/.git/objects/af/5e594c21086ecb84491d343858d4a28b0ae698
Cphn-MultiTool/.git/objects/b2/3cf008154f68769d0ea31394360306b6b28221
Cphn-MultiTool/.git/objects/b4/1276d74e5f19e84ece62a29f8465bd6e100a16
Cphn-MultiTool/.git/objects/bb/3aea7b4723386d6cfa120d43773fad4a9fd564
Cphn-MultiTool/.git/objects/d2/74a7c459079b3eb4ebb287b6c3302054ffdeca
Cphn-MultiTool/.git/objects/d4/1240498b670f370817df268603fb7a180dc071
Cphn-MultiTool/.git/objects/d8/d92e97a6500201710af9d22fdd0b9838eb35d8
Cphn-MultiTool/.git/objects/e9/5d26c1a29b7d073bef060e0c43888f69ace0e6
Cphn-MultiTool/.git/objects/f8/33bd2d9dbc0a4b8564174141bfbf6ddfcdd034
Cphn-MultiTool/.git/objects/fa/df82e444e42da126d9eb2d91e4180cea968ca7
Cphn-MultiTool/.git/objects/fc/2cae3ab59ed333a246e1ef09eb8b7adbf65d76
Cphn-MultiTool/.git/objects/ff/785b635527139f6a6b4182ff8c2d224a781d9a
Cphn-MultiTool/.git/objects/pack/pack-57ad17fd504e273b62f25b7037b16eb969e480dd.idx
Cphn-MultiTool/.git/objects/pack/pack-57ad17fd504e273b62f25b7037b16eb969e480dd.pack
Cphn-MultiTool/.git/packed-refs
Cphn-MultiTool/.git/refs/heads/main
Cphn-MultiTool/.git/refs/remotes/origin/HEAD
Cphn-MultiTool/.git/refs/remotes/origin/main
Cphn-MultiTool/LICENSE
Cphn-MultiTool/README.md
Cphn-MultiTool/images/terminal.png
.png
Cphn-MultiTool/requirements.txt
Cphn-MultiTool/src/main.py
Cphn-MultiTool/src/utils/DownloadToken.py
Cphn-MultiTool/src/utils/__pycache__/DownloadToken.cpython-310.pyc
Cphn-MultiTool/src/utils/__pycache__/DownloadToken.cpython-311.pyc
Cphn-MultiTool/src/utils/__pycache__/accountNuker.cpython-310.pyc
Cphn-MultiTool/src/utils/__pycache__/accountNuker.cpython-311.pyc
Cphn-MultiTool/src/utils/__pycache__/blockAllFriends.cpython-310.pyc
Cphn-MultiTool/src/utils/__pycache__/blockAllFriends.cpython-311.pyc
Cphn-MultiTool/src/utils/__pycache__/closeDMs.cpython-310.pyc
Cphn-MultiTool/src/utils/__pycache__/closeDMs.cpython-311.pyc
Cphn-MultiTool/src/utils/__pycache__/common.cpython-310.pyc
Cphn-MultiTool/src/utils/__pycache__/common.cpython-311.pyc
Cphn-MultiTool/src/utils/__pycache__/createServers.cpython-310.pyc
Cphn-MultiTool/src/utils/__pycache__/createServers.cpython-311.pyc
Cphn-MultiTool/src/utils/__pycache__/deleteFriends.cpython-310.pyc
Cphn-MultiTool/src/utils/__pycache__/deleteFriends.cpython-311.pyc
Cphn-MultiTool/src/utils/__pycache__/deleteServers.cpython-310.pyc
Cphn-MultiTool/src/utils/__pycache__/deleteServers.cpython-311.pyc
Cphn-MultiTool/src/utils/__pycache__/deleteWebhook.cpython-310.pyc
Cphn-MultiTool/src/utils/__pycache__/deleteWebhook.cpython-311.pyc
Cphn-MultiTool/src/utils/__pycache__/fuckAccount.cpython-310.pyc
Cphn-MultiTool/src/utils/__pycache__/fuckAccount.cpython-311.pyc
Cphn-MultiTool/src/utils/__pycache__/getAllFriends.cpython-310.pyc
Cphn-MultiTool/src/utils/__pycache__/getAllFriends.cpython-311.pyc
Cphn-MultiTool/src/utils/__pycache__/hypesquadChanger.cpython-310.pyc
Cphn-MultiTool/src/utils/__pycache__/hypesquadChanger.cpython-311.pyc
Cphn-MultiTool/src/utils/__pycache__/leaveServer.cpython-310.pyc
Cphn-MultiTool/src/utils/__pycache__/leaveServer.cpython-311.pyc
Cphn-MultiTool/src/utils/__pycache__/load.cpython-310.pyc
Cphn-MultiTool/src/utils/__pycache__/loginWithToken.cpython-310.pyc
.js
Cphn-MultiTool/src/utils/__pycache__/massDM.cpython-310.pyc
Cphn-MultiTool/src/utils/__pycache__/massDM.cpython-311.pyc
Cphn-MultiTool/src/utils/__pycache__/tokenInfo.cpython-310.pyc
Cphn-MultiTool/src/utils/__pycache__/tokenInfo.cpython-311.pyc
Cphn-MultiTool/src/utils/accountNuker.py
Cphn-MultiTool/src/utils/blockAllFriends.py
Cphn-MultiTool/src/utils/build.bat
Cphn-MultiTool/src/utils/closeDMs.py
Cphn-MultiTool/src/utils/common.py
Cphn-MultiTool/src/utils/createServers.py
Cphn-MultiTool/src/utils/deleteFriends.py
Cphn-MultiTool/src/utils/deleteServers.py
Cphn-MultiTool/src/utils/deleteWebhook.py
Cphn-MultiTool/src/utils/fuckAccount.py
Cphn-MultiTool/src/utils/getAllFriends.py
Cphn-MultiTool/src/utils/hypesquadChanger.py
Cphn-MultiTool/src/utils/leaveServer.py
Cphn-MultiTool/src/utils/massDM.py
Cphn-MultiTool/src/utils/tokenInfo.py
Cphn-MultiTool/src/utils/upx.exe
.exe windows:5 windows x64 arch:x64

1e92fd54d65284238a0e3b74b2715062

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

user32

CreateWindowExW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW

comctl32

ord380

kernel32

IsValidCodePage
GetStringTypeW
GetFileAttributesExW
HeapReAlloc
FlushFileBuffers
GetCurrentDirectoryW
GetACP
GetOEMCP
GetModuleHandleW
MulDiv
GetLastError
SetDllDirectoryW
GetModuleFileNameW
GetProcAddress
GetCommandLineW
GetCPInfo
SetEnvironmentVariableW
ExpandEnvironmentStringsW
CreateDirectoryW
GetTempPathW
WaitForSingleObject
Sleep
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
FreeLibrary
LoadLibraryExW
FindClose
FindFirstFileExW
CloseHandle
GetCurrentProcess
LocalFree
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
WriteConsoleW
SetEndOfFile
GetEnvironmentVariableW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
RemoveDirectoryW
FindNextFileW
SetStdHandle
SetConsoleCtrlHandler
DeleteFileW
ReadFile
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW

advapi32

OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW

gdi32

SelectObject
DeleteObject
CreateFontIndirectW

Sections

.text
Size: 162KB - Virtual size: 161KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 74KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 61KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
main.pyc
Cphn-MultiTool/start.bat

Sharing

General

Malware Config

Signatures

Files

1e92fd54d65284238a0e3b74b2715062

Headers

DLL Characteristics

File Characteristics

Imports

user32

comctl32

kernel32

advapi32

gdi32

Sections

.text Size: 162KB - Virtual size: 161KB

.rdata Size: 74KB - Virtual size: 74KB

.data Size: 3KB - Virtual size: 64KB

.pdata Size: 8KB - Virtual size: 8KB

_RDATA Size: 512B - Virtual size: 348B

.rsrc Size: 61KB - Virtual size: 61KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 162KB - Virtual size: 161KB

.rdata
Size: 74KB - Virtual size: 74KB

.data
Size: 3KB - Virtual size: 64KB

.pdata
Size: 8KB - Virtual size: 8KB

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 61KB - Virtual size: 61KB

.reloc
Size: 2KB - Virtual size: 1KB