cdf871757c513d3d603ffc39ed874d343d50b1fa7e505c15ac80987b5f4cf8f0 | Triage™

Login
Reports

Overview

overview

3

Static

static

3

pyarmor_ru...t__.py

windows10-2004-x64

3

pyarmor_ru...t__.py

windows11-ltsc_2024-x64

3

tools/dox_creator.py

windows10-2004-x64

3

tools/dox_creator.py

windows11-ltsc_2024-x64

3

tools/dox_tracker.py

windows10-2004-x64

3

tools/dox_tracker.py

windows11-ltsc_2024-x64

3

tools/email_lookup.py

windows10-2004-x64

3

tools/email_lookup.py

windows11-ltsc_2024-x64

3

tools/email_search.py

windows10-2004-x64

3

tools/email_search.py

windows11-ltsc_2024-x64

3

tools/emai..._v2.py

windows10-2004-x64

3

tools/emai..._v2.py

windows11-ltsc_2024-x64

3

tools/embe...der.py

windows10-2004-x64

3

tools/embe...der.py

windows11-ltsc_2024-x64

3

tools/endp...ols.py

windows10-2004-x64

3

tools/endp...ols.py

windows11-ltsc_2024-x64

3

tools/fake...5_5.py

windows10-2004-x64

3

tools/fake...5_5.py

windows11-ltsc_2024-x64

3

tools/fake_exodus.py

windows10-2004-x64

3

tools/fake_exodus.py

windows11-ltsc_2024-x64

3

tools/fake...een.py

windows10-2004-x64

3

tools/fake...een.py

windows11-ltsc_2024-x64

3

tools/fake...ure.py

windows10-2004-x64

3

tools/fake...ure.py

windows11-ltsc_2024-x64

3

tools/fake...exe.py

windows10-2004-x64

3

tools/fake...exe.py

windows11-ltsc_2024-x64

3

tools/fakeaddress.py

windows10-2004-x64

3

tools/fakeaddress.py

windows11-ltsc_2024-x64

3

tools/file_pumper.py

windows10-2004-x64

3

tools/file_pumper.py

windows11-ltsc_2024-x64

3

tools/file...exe.py

windows10-2004-x64

3

tools/file...exe.py

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

Target
Darkmagic.zip
Size 11.8MB
Sample261015-wbhtpsde85
SHA256 cdf871757c513d3d603ffc39ed874d343d50b1fa7e505c15ac80987b5f4cf8f0
MD5 49badc7fb7df504180a95de3098e7679
SHA1 b680e60c55363effccd285a0be9ec6beb2cdd358
SHA512 0a2db31132f1add512a1d5a7c73d433c6fa41385333fee5489720fb905afd7761b2a214c5d53ad70a291fb39446bcd298d04fa489d3fb163bc2fabd584f806e9
SSDEEP 196608:BrgQYiAwjSJxjYzLbA9p6qvxZIq9gzTQ+uwKnpPplbAr9LMnUd/BlppzAdjthWOy:CQEwjS0LbIrvzITQPBC9LYUJ3AdjtLzG
TLSH
T130C63318E6608223D1F55E7C09E8CE2327C14AD73EA1235EB7F465B43D7B8B80F6195A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution pyarmor pyinstaller

Static task

static1

3 signatures

pyinstaller pyarmor

Behavioral task

behavioral1

Sample

pyarmor_runtime_000000/__init__.py

Resource

win10v2004-20260911-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral2

Sample

pyarmor_runtime_000000/__init__.py

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

Behavioral task

behavioral3

Sample

tools/dox_creator.py

Resource

win10v2004-20260911-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral4

Sample

tools/dox_creator.py

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

Behavioral task

behavioral5

Sample

tools/dox_tracker.py

Resource

win10v2004-20260911-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral6

Sample

tools/dox_tracker.py

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

Behavioral task

behavioral7

Sample

tools/email_lookup.py

Resource

win10v2004-20260911-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral8

Sample

tools/email_lookup.py

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

Behavioral task

behavioral9

Sample

tools/email_search.py

Resource

win10v2004-20260911-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral10

Sample

tools/email_search.py

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

Behavioral task

behavioral11

Sample

tools/email_tool_v2.py

Resource

win10v2004-20260911-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral12

Sample

tools/email_tool_v2.py

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

Behavioral task

behavioral13

Sample

tools/embed_builder.py

Resource

win10v2004-20260911-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral14

Sample

tools/embed_builder.py

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

Behavioral task

behavioral15

Sample

tools/endpoint_tools.py

Resource

win10v2004-20260911-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral16

Sample

tools/endpoint_tools.py

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

Behavioral task

behavioral17

Sample

tools/fake_bluemagic_5_5.py

Resource

win10v2004-20260911-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral18

Sample

tools/fake_bluemagic_5_5.py

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

Behavioral task

behavioral19

Sample

tools/fake_exodus.py

Resource

win10v2004-20260911-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral20

Sample

tools/fake_exodus.py

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

Behavioral task

behavioral21

Sample

tools/fake_paypal_screen.py

Resource

win10v2004-20260911-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral22

Sample

tools/fake_paypal_screen.py

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

Behavioral task

behavioral23

Sample

tools/fake_signature.py

Resource

win10v2004-20260911-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral24

Sample

tools/fake_signature.py

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

Behavioral task

behavioral25

Sample

tools/fake_signature_exe.py

Resource

win10v2004-20260911-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral26

Sample

tools/fake_signature_exe.py

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

Behavioral task

behavioral27

Sample

tools/fakeaddress.py

Resource

win10v2004-20260911-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral28

Sample

tools/fakeaddress.py

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

Behavioral task

behavioral29

Sample

tools/file_pumper.py

Resource

win10v2004-20260911-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral30

Sample

tools/file_pumper.py

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

Behavioral task

behavioral31

Sample

tools/file_pumper_exe.py

Resource

win10v2004-20260911-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral32

Sample

tools/file_pumper_exe.py

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

Malware Config

Targets

- Target
  pyarmor_runtime_000000/__init__.py
- Size 103B
- SHA256 37711a3bfd3a6332a73b27591cc617d2a14a793cdfffb97ceee8edfbab06ab3f
- MD5 f10c615c6ba838cebca5ae4beeffb872
- SHA1 d4479865d2a68c2a228ed9ffa95d8f1d80cca9a0
- SHA512 8cf52b470a9b57ff0b9cc5b2102e5ced1e494bbcee7a433650dfa83255074c2ac54c08b8da72d74c02799e03e588e67fd236aa6cb0717d483c82d95978ced950
- TLSH
  T1F4B012510804AE83F27451C183665C388BB570933F8004740F5D677047CA602CD88391
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  tools/dox_creator.py
- Size 3KB
- SHA256 a66ce8df795eeeee1a0e64ca9539ac75406e19b62f515a80d0f54ac810f988d8
- MD5 02913cc82f4fb82166c285ff8e0698b8
- SHA1 b4560f1d4392c5d646348918e343b43b0dd4cd91
- SHA512 49c441f609d4b9e408907ce0a273f4d05570001109c5d94baa26b56393446ac27948a973b90ff2a9666d7520ac77b6add77c2d2721b5334dbb9b261fc0ef03de
- TLSH
  T1C971A9C15211E17F5BA2C9582E17BDC82969E8DFC9C5E701E0841B0FF2A8239A5E53C2
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  tools/dox_tracker.py
- Size 3KB
- SHA256 563b2c3650253574e8d528ce976a0c4f3e3df2442e1a5973fd97d6f2e4763145
- MD5 cc01632f68b7b7e375ca767113f0a556
- SHA1 2798e2f38a91659a59236a3788f72be96bd73834
- SHA512 c4b751abc5fe7d91670f00798dfe0163031abe7814935889b32093bd7f0edbdb2e4b8503e57c3e918de69beef2150d8b1947afa735ecd11ed0821cdea4f99933
- TLSH
  T14C71DDC34622E27E4A57C9442F53BE9C6968DADFC5C4D745B0C4190FE1A823C84E43C2
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  tools/email_lookup.py
- Size 3KB
- SHA256 a532de006cdc970fe24ef0fc6b23400a4a8a0dd2372a9671e263ed60880eb0ee
- MD5 44c048d37a52aa8f2d4f66fc829b5e6f
- SHA1 bc8e194bb12c02d609f5c50ab9049cf0bd04631a
- SHA512 357069d5c3cd72a052410180b2617b3fe7be6b1f77401b63ae9003f67aeea509016f081fea6ce7bb4839baa8e726b1b21607f18b4a74f5da016c37c46dac55cc
- TLSH
  T1A871AAC26612D07F5B92CA052F53BE98691EE8EFD9C5E300B1844A1FE1A823DC0E67C1
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  tools/email_search.py
- Size 31KB
- SHA256 44d26dccfdf75aff1f8aaa7ec544af547108fe66d462ebd6fdabe9d3030a3020
- MD5 c44f3ac7929798b5356cc529c8535004
- SHA1 93a1bba4e70a0c8b6ba26fc78da5007fd9a61795
- SHA512 1fbfc4d1b70f7cb99931b474a3539e7b4108d1b8f32fcac51060e484eb35261cfee7299df30598f9165b61a170b4d2e05e6724d9412982923ca49aeddc147dd4
- SSDEEP 768:H/IswHajJx5vmoHi/+rLdMND66so6r2oN6TlTdxkPdCRURFoA:H/IslVvmaS+XSNKBCoATlTdWG6oA
- TLSH
  T19DE2B9845622E13E4B97CE182F43BADC2968D9EFC5C9E705F0845A4FE0A873C94E57C2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  tools/email_tool_v2.py
- Size 50KB
- SHA256 3735202a45413ff71c22d957263a3203f00a64d3dd49df8460057bdf22e49409
- MD5 78c338d4b86198294b99f390e4f813d1
- SHA1 a6f56733fe131ddd6c94cd3041ca302fc4f1df01
- SHA512 d65f6121b7591de7f6c8822d04e1aec59dfc81b2b312b18e6c8f8f76820690c482c0511a6772aca221b26e09e37fd99e065bce15f44a53b38175a545e3b54590
- SSDEEP 1536:ZR2cYOuMopKaspEkSAxITcXJw55ha8kR/yAXtzDC:ZR2cYOBaspEk1xIE85oNBygJu
- TLSH
  T1A83398859622E17E5B97CE182F43AED82869D9EFC4C9E301F0C45A4FE4A873C94E57C1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  tools/embed_builder.py
- Size 13KB
- SHA256 2a7b2cf02d51bda548b55fa786f837cde1c03c99ac71c87ee97cf0a2de25ab18
- MD5 f10150029a9289e220f7e83f0b4e0e0e
- SHA1 e6aacdd7e1e7b827f9f2d350f16b79a97c285872
- SHA512 b11ed8c3f8108a2d52f91046641310ae96f00e4439b483c65cc95537850bf632198ecad1d6724bb3a2f82b77ce02a586cbfb80ad45eab311271a52951e5db1fe
- SSDEEP 384:r5qgMEwvsUkN//x10th+Qu+gohnrHEBn9iq:r4vX/kNRWI/+1hrkLiq
- TLSH
  T18B52CC819622E13F5B97C9196F43BAD82969D9EFD4C9E340F0C45A4FE0A833C94E57C2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  tools/endpoint_tools.py
- Size 17KB
- SHA256 f242b5d5596bbac3f353b9e6b7232a14906787764caa1e3506068a64e6ea611c
- MD5 a2b1a53328c69a12506fe138c4a40f67
- SHA1 928485bcce3105d1b289bdb6c7194c9f5672ea07
- SHA512 7b4a73bbbbc86d9a5b7a8665d553dbae7480c2ee5f76c4e3522ca7f8fbe4d80d65ebae977dfe1968519f4bd4977c170af4fb987dfa552caad44e7b05a023c59c
- SSDEEP 384:20t3JyBsw4IK1bWatFIBGihZxv9IaB07zD1b3OTT:2HJ4IZasBLZl9Ia2nRO/
- TLSH
  T13572BA859622E17E5B96CD182F43AACC2869D9EFC5C9E701F0C45A4FE0AC73C94E57C1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  tools/fake_bluemagic_5_5.py
- Size 1KB
- SHA256 b9956fa1facc8642c66bb328cfcf9c4373f229d449bb2b29359c44333c5fa2ac
- MD5 82e0f1f73112e13782b8d77297c2f2c3
- SHA1 d7d8b0bc9a4886a0731e4884eeb56b2cd0f5edab
- SHA512 61d820274d84c357d0a60d7eec9d41a850f1bbe2587a8ca77ca13b48ee6d227a516b9ba25cee3d19d40b163ba6927d3a58cc6fd032a0b951b3b93e1659be8824
- TLSH
  T17531AAC74A13E07A4FA2CC555E27FE981E68E8ABD8C4E71992C0574FE79822D80D57C2
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  tools/fake_exodus.py
- Size 3KB
- SHA256 8e0b41c6dba12a111bf4bded56d05d796c1c2513c0954ec8bf887c2657b60bf3
- MD5 54a661085f3e9629f028a0544bcdb16b
- SHA1 fe7692290e8215db2fbd85b6e4e5aa30a5449b07
- SHA512 115f10548bba2c0f4af23d75da3a8c641b2dc4356c6cf14d53db37abf1cde04f4e34ac9fd1d4a0533648c3017093528f487efbf064b48dc876c586a106205cc2
- TLSH
  T1F871ACCA5622E07F4A52CD152F57A9CC2D58E8DFD8C9E705F1880A4FE2A873D91E47C1
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  tools/fake_paypal_screen.py
- Size 51KB
- SHA256 1e017b78d5a7a6da07ca341862f9678abc7278d97c94e9e981fd9e36b5347eb9
- MD5 cf6abedc69ee68ad205ee390ea9399e5
- SHA1 3a33cf7d5f50c1ee2c54f75de2dc0fc769bcb600
- SHA512 d1a942a24afe947e32c26ceb7389baa882cdbcc48c78620cc5c2ffa4c5063e8fe1103b61edb37a6cc085147a79eb61324dbedf1f7193f1f4ff572f4582fd9139
- SSDEEP 1536:TnR+KmLXpv9qVDHiI2Q8wQlQSJjDI/uztmwRtb+z:TR+pjpv8HiIEwQlQSJjDI2ztq
- TLSH
  T1403386849622E17E5B96CD182F43AEDC2869D9EFD5C9E701F0841A4FF0A873C94E57C2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  tools/fake_signature.py
- Size 16KB
- SHA256 4a7b00bfe60f3fef81c19970babe9f31f66af53e6987f8481c68df3e02508133
- MD5 79a3a8b248eec0dc24c39d3e23017f42
- SHA1 35e29f26b786e683a2d40cf8259f5a2c079c4188
- SHA512 784e6db53368d54cbcfa915b232c0c1f153458d27b198f79b069acbbe3aa6f48a5a4f9c56802640a9610a839df11a2fbeb09ed5899b740ec84f1ea16b42c561b
- SSDEEP 384:WtgiF9rYMz9sXBPGn6W8uOPWXKrNUUKtl0aaKdPcxq1W6r:WtZTY69A46sOPMKBo0ukxq1WU
- TLSH
  T1B77297855622E17F4B57CD182F47AECC6968D9DFD8C9E301F0885A4FE1A863C94E4BC2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  tools/fake_signature_exe.py
- Size 17KB
- SHA256 0792b4dcd685d3dbddd1bea058dc9d7ef3195c5e13020794abd77488d0f9aff4
- MD5 eee064d67a2f112911535383999ed927
- SHA1 d7680a7f2a103336ab42ce4fc84db76d1644fcf2
- SHA512 a47fe2a995985f8bc484077085c6b92a02ac1588ad94acc12d7653ce5ba70177cdcedf55fd8a792e42978d4d3d3f806c614d777a2f6d3c18b3d45674989477ef
- SSDEEP 384:MwlOgXh7SvIb8UNtCPQ7N+epiiFShh37ZijXRzhDp:9gabzuQ7N+YiiFShhLZizPp
- TLSH
  T19A72AC855622E17E5B92CD192F03AEDC2869D9EFC8C9E701F0845A4FF4A873C94E47C2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  tools/fakeaddress.py
- Size 30KB
- SHA256 35349894307adf67c589957644ea2cd3364740f6b21fc0fb130da2bfbfca25ba
- MD5 e8d2ba63ee563ec6897412bb1cf67668
- SHA1 f6f1355f44e1a25aac20fbe5fa502a6d1b9dc8d1
- SHA512 cec01f152c6486b9ee9a9d5e43276b9551f3636659b9f26adc1c5c03451822c7cacc8ff150eb84e5354d7bb4aab5579db136a83af5633441cdf13f3634f0d306
- SSDEEP 768:PhrIFe5CQk4KvomqyFvaeX/TB88H3bqVmqRdaSZsib:PhrIFe/P6omqyxlvXereib
- TLSH
  T1A5D2A9855622E17E1B96CE192F43BEDC2868D9EFC9C9E701F0C41A4FE4A873894E57C1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  tools/file_pumper.py
- Size 14KB
- SHA256 8b98d9a742b78796b629291dba222cbb8f25328b3345ea883bf4e7019724a172
- MD5 fee094d6178dd6940c8699e942864842
- SHA1 e46bb2b7f28b4ca35c978201281703d049ebdf18
- SHA512 52716b067fbeb493f5b9d64748041058cb6538b971f1838357dd4f19feefa199fd8de354877de2019328e2b516299b5835a084ff770220138556aea9de4e6700
- SSDEEP 384:xmt9GE/mbb/qvXI4/7c2u0pLJr7OG8TWAeM6GRNcN3:Mt9GJbiv44/ZR1r7qCTTGfcR
- TLSH
  T1D062DB855622E17E4A97CE082F47AEDC6869D5EFC9C9E701F0C41A4FF4A833884E57C2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  tools/file_pumper_exe.py
- Size 17KB
- SHA256 f848d907e6ffb21a900eba7a2bab49dd387d99001b2aceeb1edf9b703fbd2f39
- MD5 eb9837ddc0e576ae4f99b641e3aab051
- SHA1 d7c242db939dc8868d099373d9c5d2bd384fcb40
- SHA512 37032521966ae4f549adb32424c0a860bfbeafc02e244194d3ca77d8a6d453f8f0b6474f2bcbd9a90270f69a35024ccdfb11ddaf8dff86d0c5691a47e18f2b28
- SSDEEP 384:sc0mvmTnM3xrht4kgHAmmaQ0ZlVtp/0kK6GMNp4w4esqprW5b:diA3/KZlVte7MNy2npiB
- TLSH
  T1E482A8855A21E27F5A96C9182F43AECC2869D9EFD5C9E701F0845A0FF0A873C94F5BC1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Windows Command Shell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

pyinstallerpyarmor

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32

© 2018-2026

Terms | Privacy