pysilon | 2026-08-08_eb56f452031f2a33c8997a0845c42a5a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar

resource	yara_rule
static1/unpack001/source_prepared.pyc	pysilon

resource	yara_rule
sample	pyinstaller

resource
2026-08-08_eb56f452031f2a33c8997a0845c42a5a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar

2026-08-08_eb56f452031f2a33c8997a0845c42a5a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar

IMPHASH 72c4e339b7af8ab1ed2eb3821c98713a
SHA256 2e508ae6896b67c68ce9ae0c4a38a93e94af444628bef9707052cdc281b6dc4d
MD5 eb56f452031f2a33c8997a0845c42a5a
SHA1 a7ffc4f3bb693e33e47926275aa793ab6439bb01
SHA512 8974568dafe0f12add81185efb0fdaee9dd2b1c0664350e2e76c560dd01bd63522f010c30d88beb9ff29ce69d4ebb0ebf7f6bdfe33c14bc4b5f0037fa76d4e3c
SSDEEP 1572864:Bvl9Q1lKISk8IpG7V+VPhq7EklcE7KElQtLafnhoxoI:Bvl92AISkB05awfeEKtEhoxH
TLSH
T1E1C733C79B528414C9A9307D20E5D8BC8536F8D00B69C7B58FB01A6DAFA3B94EE34F51
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects Pyinstaller

pyinstaller
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

52656

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

CreateWindowExW ShutdownBlockReasonCreate MsgWaitForMultipleObjects ShowWindow DestroyWindow RegisterClassW DefWindowProcW PeekMessageW DispatchMessageW TranslateMessage PostMessageW GetMessageW MessageBoxW MessageBoxA SystemParametersInfoW DestroyIcon SetWindowLongPtrW GetWindowLongPtrW GetClientRect InvalidateRect ReleaseDC GetDC DrawTextW GetDialogBaseUnits EndDialog DialogBoxIndirectParamW MoveWindow SendMessageW

comctl32

ord380

kernel32

GetACP IsValidCodePage GetStringTypeW GetFileAttributesExW SetEnvironmentVariableW FlushFileBuffers GetCurrentDirectoryW LCMapStringW CompareStringW FlsFree GetOEMCP GetCPInfo GetModuleHandleW MulDiv FormatMessageW GetLastError GetModuleFileNameW LoadLibraryExW SetDllDirectoryW CreateSymbolicLinkW GetProcAddress GetEnvironmentStringsW GetCommandLineW GetEnvironmentVariableW ExpandEnvironmentStringsW DeleteFileW FindClose FindFirstFileW FindNextFileW GetDriveTypeW RemoveDirectoryW GetTempPathW CloseHandle QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObject Sleep GetCurrentProcess TerminateProcess GetExitCodeProcess CreateProcessW GetStartupInfoW FreeLibrary LocalFree SetConsoleCtrlHandler K32EnumProcessModules K32GetModuleFileNameExW CreateFileW FindFirstFileExW GetFinalPathNameByHandleW MultiByteToWideChar WideCharToMultiByte FlsSetValue FreeEnvironmentStringsW GetProcessHeap GetTimeZoneInformation HeapSize HeapReAlloc WriteConsoleW SetEndOfFile CreateDirectoryW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent RtlUnwindEx SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer RaiseException RtlPcToFileHeader GetCommandLineA GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ReadFile GetFullPathNameW SetStdHandle GetStdHandle WriteFile ExitProcess GetModuleHandleExW HeapFree GetConsoleMode ReadConsoleW SetFilePointerEx GetConsoleOutputCP GetFileSizeEx HeapAlloc FlsAlloc FlsGetValue

advapi32

OpenProcessToken GetTokenInformation ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertSidToStringSidW

gdi32

SelectObject DeleteObject CreateFontIndirectW

discord_token_grabber.pyc

SHA256 2e82faaefa817254cf2a9d5149e3c36c04c3e09aca0bcc1a4e4fa894e137c1b1
MD5 05b1abcf2b8f1457cee0f078bdbb04f0
SHA1 ce070d54e1d54ffd6c4d96b616f21b7466a062c7
SHA512 5af2746296f191af559639b1c5463993e8c4fb25ef945677142a6a02486e6670669eb5a5bdd4c163f1bdd8bd35a7bb8998bbf32e4d0fe9d35db379cf80159a57
SSDEEP 192:iQR8Lslmujbwybyo5HptlYwqJFD7U6r18ZPuNz:vNmcwcpt+D7Ua18uz
TLSH
T15A12F9A6C486485DFE88F37E94573B0C9F369188948D1783490BA662FCCE9C42EB15DE
MD5 SHA1 SHA512 SSDEEP TLSH

Detects Pyinstaller

pyinstaller

get_cookies.pyc

SHA256 6f67d11524ed42b8990be66aed829232514b364746fdceea30e0213204427be4
MD5 ab0f8084441f8312bffc9d26193967ab
SHA1 82b9c1c9cd1f5a38ac2b415a96c88ce99d27455a
SHA512 1722dfe7200b5f8fef0cfc4188953621630c7ee8672586490b9309a40512eb7f99fc56ffe52f6a0970809a38e3bdd8ce1862ba6803fe6d09bdfacda1b3fe1732
SSDEEP 96:4Q0jzMv/ppR+xVBcnqhLchLPxrpTkBWeBDFZcj3KldyzoZ:sSZYXPhYhLP12zij3KnyA
TLSH
T1BEB1E989DE8BE936FDE8F3FA40A5821DBE96F386C1C58303471B90696E855C15C3D50C
MD5 SHA1 SHA512 SSDEEP TLSH

Detects Pyinstaller

pyinstaller

misc.pyc

SHA256 39c73d32dce8fe34f56ca6fce56ae54ca99456c49fa04c949a45ca7d8e7355d9
MD5 5bff7de9304595611b9deeea55076bd3
SHA1 ae5fd2f3fbac4b0587140ab41b30c4d3da286c75
SHA512 4cb8277d8c02380679bcc19ec6cba2dae37b24058116e08cfec30f95a158c1c3b45590c79665ace9abbeda277f1f39be1e806fd90c8dae9a3c44cd69d1157679
TLSH
T1D151D7E5B1882CE5FD7AF6FC10C4073022E47367524C60036648A28B3EEAFD81EB145D
MD5 SHA1 SHA512 TLSH

Detects Pyinstaller

pyinstaller

passwords_grabber.pyc

SHA256 657361e158e5b5d76cf2b615d58c7c34de2d06d40f1c049c0757019fadab5e13
MD5 dbd5603fbc95768a5f3f45e6e1f7f109
SHA1 b1fa1a73c1e9e0ee63cccf5a81210a8aa39bf40a
SHA512 310aabd4b5ef007faaaac149ea5b182c20eb3db2ea576e1039fc86d8ed5bb7e63b437d10c2c876ab40a0f9f7782dbfc5804d02cf12a0d74d9b1fe5b1a9a035d5
SSDEEP 96:4APDnTWeYwD86gWxS6679kZOyfkoXyWQUUEXtH0lLCvpW1mhs0:FzCUD/S6UyRkpoUEKlLz1m+0
TLSH
T1E291FCF7AA01AC97FE69F3FC462D4A196D68F76143878C434E00E18E4D557D96C1C88D
MD5 SHA1 SHA512 SSDEEP TLSH

Detects Pyinstaller

pyinstaller

source_prepared.pyc

SHA256 d1f025eeb706d8a04ac262d22e8bf0e7bcfbd0c3d015655c9f55ab0a3ab618b1
MD5 bf57a86590c27bfc1ffbccf05493097d
SHA1 0007b71c257784387b1a5145f3d57c0544971f81
SHA512 a491e485c6c851e59e8149727a4bbd44cf98d0bf7a46868464a8f56ffd95b17e27f79350f8aae9bc802290d5ce47cd7ece268bcadd371aebc0260b6511dc4fe9
SSDEEP 768:BOOtq+o/byvUVm3hWv7YbLCjeAppQ6BdjxCj9ZiPJbf4scRdB3ooRzE0Zz+Z0Ye:BGzbmxevjeCBdjxMaUDdB3oWzpZzJX
TLSH
T19A531976703E26DAFA33B7B568900789149172D483827BB1980DC675FD8DFF60BA4389
MD5 SHA1 SHA512 SSDEEP TLSH

Detect Pysilon
Detects Pyinstaller

pyinstaller

Sharing

General

Malware Config

Signatures

File Explorer