CoilSnake-4[.]2[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
CoilSnake-4.2.exe
Size 10.9MB
Sample260820-3c7msack2z
SHA256 de1d9b736b435a67755885174858df7f4dbd491282e201dd7fbf60c08839ed70
MD5 a3076ef73fa44bbe66fa145abac99b59
SHA1 cce8264e00192622cfe1b0daf304923f12967470
SHA512 8f7cab78d937790b07a28e28e3eaea8a6df682081ffa8f29a0261a8c66d07549807300f0c484c9a46c96b313bb0ff2cda3fb89aca5b0b97295f388fb5dfa1edb
SSDEEP 196608:noW5O2t4qtwAgyc2sp2vtbYPvbJQlHExdId/sinUTvN8CJ6TDWpoT71:no2OM8As2YUkJQlaydnnUTHMe271
TLSH
T1B1B6334EFFD2005AD74E16373CACACF8985DAD918B23A6532F247A3C9D32756E670244
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

pyinstaller

Malware Config

Signatures

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
sample	pyinstaller

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CoilSnake-4.2.exe

File Explorer

CoilSnake-4.2.exe

.exe 10.9MB
gui.pyc

226B

CoilSnake-4.2.exe

IMPHASH fa2936ff523bbe01bb11c81e10c9ad2d
SHA256 de1d9b736b435a67755885174858df7f4dbd491282e201dd7fbf60c08839ed70
MD5 a3076ef73fa44bbe66fa145abac99b59
SHA1 cce8264e00192622cfe1b0daf304923f12967470
SHA512 8f7cab78d937790b07a28e28e3eaea8a6df682081ffa8f29a0261a8c66d07549807300f0c484c9a46c96b313bb0ff2cda3fb89aca5b0b97295f388fb5dfa1edb
SSDEEP 196608:noW5O2t4qtwAgyc2sp2vtbYPvbJQlHExdId/sinUTvN8CJ6TDWpoT71:no2OM8As2YUkJQlaydnnUTHMe271
TLSH
T1B1B6334EFFD2005AD74E16373CACACF8985DAD918B23A6532F247A3C9D32756E670244
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Detects Pyinstaller

pyinstaller
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

41936

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

user32

CreateWindowExW MessageBoxW MessageBoxA SystemParametersInfoW DestroyIcon SetWindowLongW GetWindowLongW GetClientRect InvalidateRect ReleaseDC GetDC DrawTextW GetDialogBaseUnits EndDialog DialogBoxIndirectParamW MoveWindow SendMessageW

comctl32

ord380

kernel32

IsValidCodePage GetStringTypeW GetFileAttributesExW HeapReAlloc FlushFileBuffers GetCurrentDirectoryW GetACP GetOEMCP GetModuleHandleW MulDiv GetLastError SetDllDirectoryW GetModuleFileNameW GetProcAddress GetCommandLineW GetEnvironmentVariableW GetCPInfo ExpandEnvironmentStringsW CreateDirectoryW GetTempPathW WaitForSingleObject Sleep GetExitCodeProcess CreateProcessW GetStartupInfoW FreeLibrary LoadLibraryExW SetConsoleCtrlHandler FindClose FindFirstFileExW CloseHandle GetCurrentProcess LocalFree FormatMessageW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap GetTimeZoneInformation HeapSize WriteConsoleW SetEndOfFile SetEnvironmentVariableW IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead DecodePointer RtlUnwind SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer RaiseException GetCommandLineA CreateFileW GetDriveTypeW GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetFullPathNameW RemoveDirectoryW FindNextFileW SetStdHandle DeleteFileW ReadFile GetStdHandle WriteFile ExitProcess GetModuleHandleExW HeapFree GetConsoleMode ReadConsoleW SetFilePointerEx GetConsoleOutputCP GetFileSizeEx HeapAlloc CompareStringW LCMapStringW

advapi32

OpenProcessToken GetTokenInformation ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertSidToStringSidW

gdi32

SelectObject DeleteObject CreateFontIndirectW