pysilon | 2026-09-20_f116e4d2492183d0d8347fb5c91288d2_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar

resource	yara_rule
static1/unpack001/source_prepared.pyc	pysilon

resource	yara_rule
sample	pyinstaller

resource
2026-09-20_f116e4d2492183d0d8347fb5c91288d2_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar

2026-09-20_f116e4d2492183d0d8347fb5c91288d2_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar

IMPHASH 72c4e339b7af8ab1ed2eb3821c98713a
SHA256 c9216da9eaf8c561d6002f9de38cf1a261c84896f2091ae19c3a4209d7c3956e
MD5 f116e4d2492183d0d8347fb5c91288d2
SHA1 141517ab31889e4707c627672aac072858b6d8a8
SHA512 97d537e301fe8883232e074a8b0bb727bfab8e8bd728b77107bf23592513de37c0b4f41895238736b93f353ff7b1024f1988f6ac33976b5dc44fa08a86fe0b2c
SSDEEP 1572864:fvHcRlKWZh7vXSk8IpG7V+VPhqYdfME7tlHegiYweyJulZUdghhxr7qEjV37U:fvHcRYGhTSkB05awcfLdMpuFhxrGQo
TLSH
T1050833C82744F849E6CA2076F1D5E2988546B4D10F52C59DCEBC1B7E6EA3294EC3BF12
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects Pyinstaller

pyinstaller
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

52656

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

CreateWindowExW ShutdownBlockReasonCreate MsgWaitForMultipleObjects ShowWindow DestroyWindow RegisterClassW DefWindowProcW PeekMessageW DispatchMessageW TranslateMessage PostMessageW GetMessageW MessageBoxW MessageBoxA SystemParametersInfoW DestroyIcon SetWindowLongPtrW GetWindowLongPtrW GetClientRect InvalidateRect ReleaseDC GetDC DrawTextW GetDialogBaseUnits EndDialog DialogBoxIndirectParamW MoveWindow SendMessageW

comctl32

ord380

kernel32

GetACP IsValidCodePage GetStringTypeW GetFileAttributesExW SetEnvironmentVariableW FlushFileBuffers GetCurrentDirectoryW LCMapStringW CompareStringW FlsFree GetOEMCP GetCPInfo GetModuleHandleW MulDiv FormatMessageW GetLastError GetModuleFileNameW LoadLibraryExW SetDllDirectoryW CreateSymbolicLinkW GetProcAddress GetEnvironmentStringsW GetCommandLineW GetEnvironmentVariableW ExpandEnvironmentStringsW DeleteFileW FindClose FindFirstFileW FindNextFileW GetDriveTypeW RemoveDirectoryW GetTempPathW CloseHandle QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObject Sleep GetCurrentProcess TerminateProcess GetExitCodeProcess CreateProcessW GetStartupInfoW FreeLibrary LocalFree SetConsoleCtrlHandler K32EnumProcessModules K32GetModuleFileNameExW CreateFileW FindFirstFileExW GetFinalPathNameByHandleW MultiByteToWideChar WideCharToMultiByte FlsSetValue FreeEnvironmentStringsW GetProcessHeap GetTimeZoneInformation HeapSize HeapReAlloc WriteConsoleW SetEndOfFile CreateDirectoryW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent RtlUnwindEx SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer RaiseException RtlPcToFileHeader GetCommandLineA GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ReadFile GetFullPathNameW SetStdHandle GetStdHandle WriteFile ExitProcess GetModuleHandleExW HeapFree GetConsoleMode ReadConsoleW SetFilePointerEx GetConsoleOutputCP GetFileSizeEx HeapAlloc FlsAlloc FlsGetValue

advapi32

OpenProcessToken GetTokenInformation ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertSidToStringSidW

gdi32

SelectObject DeleteObject CreateFontIndirectW

discord_token_grabber.pyc

SHA256 be495ca4cc94405470e197a0dbeda88efa08dcc970c7ad3674b571515ad93b3f
MD5 a7684f2f409990743d310cd7ec306ddc
SHA1 0949beaa2fc2dbd56e9ac2c111910c8471cb420a
SHA512 fcfebe9c955e7754042bc68056a973e6557929731af19bb28c95491a91909cb77e853a7b6aad03bff4f2c565df7a7804183cf531c72fe25b738f53b1b2ac2351
SSDEEP 384:nGC7RYmnXavkGP3ltcrhntQ5saa2holHVA:nGCuvkoltcrttQ5saaCgHVA
TLSH
T1EF72F9629A87C43EFD98F1B868463B0EFBB406947452934369E79051BE4F220FE910DE
MD5 SHA1 SHA512 SSDEEP TLSH

Detects Pyinstaller

pyinstaller

get_cookies.pyc

SHA256 792f864f45d9d7902a9def274d83395b0f0e956dbbdfe55bf5b6ff982decccdd
MD5 35694b536dc0c47d0553ae39c50bb446
SHA1 e33bd8932fde60b2b0882541f4e9cfbae79c842c
SHA512 fd6ff8f6376d6c3e0f1629fa17c26e905e2eb21fc345c5c53208f327bd0ddeb4046769742a4ed3d8040db604df8622e8e1d1372d80aa3c712b8f5f4be5413a93
SSDEEP 192:lNal3eiNis9QfUF2x3NC79F211G67+EtAhN:lJiB2XtF7jKkAhN
TLSH
T11D12E648EF9FD03FFC64F1B40801AB0DF6A59681B145834376BF8824AF1BA91AD944DE
MD5 SHA1 SHA512 SSDEEP TLSH

Detects Pyinstaller

pyinstaller

misc.pyc

SHA256 2e05a5f62cb667213f1d6d3c892f1fe9caf4680b4e6403f6fc8e16abfcdd9ce7
MD5 6d495b44e9fd2e8a2e29cbbd1b0be969
SHA1 a4835f4b9cbcc40067336750b7cdabee39c942f6
SHA512 0e075cefec03031069ca3586bab20bd1557aa073f3bc03a5e850e6b1fef02f7ba2f659d02369902b0fbab1d56b8e9de3cdca72afd63036569075fb7281c32e25
SSDEEP 96:XSMlhlvyz7DweHPF8+VB7sHIZGQSWfvmyyZ1k9qHub:iolvyzgevq+VBXZGQlvmV1kkHub
TLSH
T16291D7C275D6D8B6FCA0E1F810512F9E73B081A1B144D307318AA6256E6E6B04D612DF
MD5 SHA1 SHA512 SSDEEP TLSH

Detects Pyinstaller

pyinstaller

passwords_grabber.pyc

SHA256 3fc08fad501f41bc1609acc74caafc253dc3d3d3215ba19486db8300339ebae9
MD5 9e6db476a4508dbecc9be6d3fded1844
SHA1 744090e98eab78bdaf662be63870e3db481cbb01
SHA512 cecc7960b7f777caf9d1e976ed6373e60d79979980f2755daca46930bfc719862643a1391fd72c9b173a92e36d99be0d60320570b21bf9918bb127366f81cbaa
SSDEEP 192:A114qWLfhuUIxDPK2cxDJb+XUhitovgEuz:64qWLfMFyVxDAE/4
TLSH
T19CF1E8867F83C877F821F0F55821271EB76891A2B704C307257B906C5D2BAB58C148CF
MD5 SHA1 SHA512 SSDEEP TLSH

Detects Pyinstaller

pyinstaller

source_prepared.pyc

SHA256 55ad4e1216049a61df15ee761348526c9fdc479b40ff288b02bfbe4cd21392dd
MD5 ace40cf7c2ace6c82e1dfec2bf69da89
SHA1 7ce15dcecf246b54b1737d144049fb5dc2899002
SHA512 404ac2f4b6cd04276a31d6e1320b15823f2497ab58a925c339c3e14f785c529a854ceb88126cea6c2f015a2fdd748d784163f2e1882fdb71432afa68ced724e8
SSDEEP 3072:cyaaOOxFySrtv4o4PZTw0IYScR0X6IvdXz5csTW0:3aaOOxFySR4ooIf80Xusn
TLSH
T1C3F3E4C037A7E93BF556A5399925338F7B8441B2B222CB076AF7B024FD525206CD21ED
MD5 SHA1 SHA512 SSDEEP TLSH

Detect Pysilon
Detects Pyinstaller

pyinstaller

Sharing

General

Malware Config

Signatures

File Explorer