pysilon | 13df4655f33615850a8d9cc85ec34d190a0295d9465fbf300cf0f2ca188018c3

General

Target

source_prepared.exe
Size

84.1MB
Sample

250321-lsehhawtgt
MD5

71c55d3a21623b2a240440d6e39ae3d5
SHA1

c7ebbeddcfa01f7df24d7c0b37e50b5e2ef4087c
SHA256

13df4655f33615850a8d9cc85ec34d190a0295d9465fbf300cf0f2ca188018c3
SHA512

a96caeeac6c7915e9cf7da8aa09ac8110d2eeb7059565a781c15e096479bc406626a6b9538ffb05200d1e2caa3458ca00fe7c355c63b43456024608195498d14
SSDEEP

1572864:ptIupuqVjl/lWWdP4OkiqOv8im2AUdfUE7nlhnwgiYweyJulZUdg/Xgz2UZvkOJv:AYFrbdgOknOv8i3XfNLwZpu7XgznkOF

Score

10^/10

Malware Config

Targets

- Target
  
  source_prepared.exe
- Size
  
  84.1MB
- MD5
  
  71c55d3a21623b2a240440d6e39ae3d5
- SHA1
  
  c7ebbeddcfa01f7df24d7c0b37e50b5e2ef4087c
- SHA256
  
  13df4655f33615850a8d9cc85ec34d190a0295d9465fbf300cf0f2ca188018c3
- SHA512
  
  a96caeeac6c7915e9cf7da8aa09ac8110d2eeb7059565a781c15e096479bc406626a6b9538ffb05200d1e2caa3458ca00fe7c355c63b43456024608195498d14
- SSDEEP
  
  1572864:ptIupuqVjl/lWWdP4OkiqOv8im2AUdfUE7nlhnwgiYweyJulZUdg/Xgz2UZvkOJv:AYFrbdgOknOv8i3XfNLwZpu7XgznkOF
Score

9^/10

defense_evasion execution persistence upx
- Enumerates VirtualBox DLL files
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1
- Target
  
  discord_token_grabber.pyc
- Size
  
  16KB
- MD5
  
  725de9fcbbafc763e52c1890229e95d3
- SHA1
  
  9f706ed61c350f634c1219a450680d8d943fab94
- SHA256
  
  61a871eed93301374ff8242c30e7da5ef568ba1fdd612482a0bba99583ae675f
- SHA512
  
  993ec6762f902ccd8753ce64a045717255aa63d7af58f0e38f997e4433ff302581479ef83a2bf0faba768981d2e471b01071de7373894fc506716571ba61e56a
- SSDEEP
  
  384:nGC7RYmnXavkxzG7WltcrhntQ5saa2h12VA:nGCuvk8WltcrttQ5saaCsVA
Score

3^/10
behavioral2
- Target
  
  get_cookies.pyc
- Size
  
  9KB
- MD5
  
  c9a26682b507d80f6293b7812712a656
- SHA1
  
  08717581287f9ce3ce45620b65bf9af9388bd56d
- SHA256
  
  977c728a338029209993bdea34d5476491be08fedcdc4d9810aa477e26118638
- SHA512
  
  54eeb20ea0cf309fa5eb31b3f37318e07965217f6f8adc8b1ba2cef8c7559db82792b8470f44e8989efde29b31b13e79d97c6c9a6549e765190336edbc4c02c7
- SSDEEP
  
  192:lNal3eiNis9QfUFoxJvm79F211G67+PtAhN:lJiB2lrj7jKlAhN
Score

3^/10
behavioral3
- Target
  
  misc.pyc
- Size
  
  4KB
- MD5
  
  f450829addc19ea4da350682ab197177
- SHA1
  
  d945d4aeb21e9aa3b995c05afa4ae9310427b664
- SHA256
  
  5d285150443c750bb0b68da4cc87732b81703e9665f719247a0ee62bd9482ca6
- SHA512
  
  645a11a031c4872b378201555a1c2a0aaa5537cb83d9a98028f09dbcfac527b691b8ef417b616ad2a7ce3d2920f4081fbd8dd201e83db74dacb01615510d15bb
- SSDEEP
  
  96:XSMlhlv6KPDweHPF8+VB7sHIZGhIW0vmyyZ1k93hub:iolvJ0evq+VBXZGh4vmV1kFhub
Score

3^/10
behavioral4
- Target
  
  passwords_grabber.pyc
- Size
  
  7KB
- MD5
  
  7d2e86e5d8afcff3d134f866f33d836c
- SHA1
  
  1791cfa048717d69f51c56ecf63f5047b088532d
- SHA256
  
  30c7051140e658b94573f4fd7bcdfcef0ac6e54aec22a69220632437f6f465cd
- SHA512
  
  555fb2eafcb4a9d5762608396969d635e6d260f50089e1bc949a2c37aa6531526ee8c3e365e10b88b04b5afb966d3d112e5bbcf4414e4ffef305c1fbb61dbc5b
- SSDEEP
  
  192:A114qWLfhuUIxzOK2cxDJb+XUhetovxEPz:64qWLfMtzVxDAEW7
Score

3^/10
behavioral5
- Target
  
  source_prepared.pyc
- Size
  
  168KB
- MD5
  
  ad1133c08b87621703f891626a498bbe
- SHA1
  
  935b6665468d19a94fc5dce1c999a831530d404d
- SHA256
  
  95eb04df830f0f66401fbdedd9bcfcefcdeebb68d626bc1c35a1404ce4abe2cc
- SHA512
  
  12e78dbccd2ec5f798a68508f44aa53f7766e4632e8f3fa3b8b330a61b52f6d4eaa0d7e0143d546e69e37ccf7e0df9803dc75dc13f6980cc6f82809a7fdb0885
- SSDEEP
  
  3072:Nvf5aOO2UaSMS46o4PZTJ0pZXScT0wfxIvdXz4sTWP:NX5aOO2UaSc6ojpUY0wfvsS
Score

3^/10
behavioral6