Overview
overview
8Static
static
8PySilon-ma...nux.sh
ubuntu-18.04-amd64
1PySilon-ma...nux.sh
debian-9-armhf
1PySilon-ma...nux.sh
debian-9-mips
1PySilon-ma...nux.sh
debian-9-mipsel
1PySilon-ma...on.bat
windows7-x64
1PySilon-ma...on.bat
windows10-2004-x64
1PySilon-ma...der.py
windows7-x64
3PySilon-ma...der.py
windows10-2004-x64
3PySilon-ma...ler.py
windows7-x64
3PySilon-ma...ler.py
windows10-2004-x64
3PySilon-ma...ber.py
windows7-x64
3PySilon-ma...ber.py
windows10-2004-x64
3PySilon-ma...ies.py
windows7-x64
3PySilon-ma...ies.py
windows10-2004-x64
3PySilon-ma...64.dll
windows7-x64
1PySilon-ma...64.dll
windows10-2004-x64
1PySilon-ma...isc.py
windows7-x64
3PySilon-ma...isc.py
windows10-2004-x64
3PySilon-ma...ber.py
windows7-x64
3PySilon-ma...ber.py
windows10-2004-x64
3PySilon-ma...ons.py
windows7-x64
3PySilon-ma...ons.py
windows10-2004-x64
3PySilon-ma...rol.py
windows7-x64
3PySilon-ma...rol.py
windows10-2004-x64
3PySilon-ma...put.py
windows7-x64
3PySilon-ma...put.py
windows10-2004-x64
3PySilon-ma...sod.py
windows7-x64
3PySilon-ma...sod.py
windows10-2004-x64
3PySilon-ma...per.py
windows7-x64
3PySilon-ma...per.py
windows10-2004-x64
3PySilon-ma...ing.py
windows7-x64
3PySilon-ma...ing.py
windows10-2004-x64
3Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
03-07-2024 03:33
Behavioral task
behavioral1
Sample
PySilon-malware-3.7.5/PySilon-linux.sh
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral2
Sample
PySilon-malware-3.7.5/PySilon-linux.sh
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral3
Sample
PySilon-malware-3.7.5/PySilon-linux.sh
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral4
Sample
PySilon-malware-3.7.5/PySilon-linux.sh
Resource
debian9-mipsel-20240611-en
Behavioral task
behavioral5
Sample
PySilon-malware-3.7.5/PySilon.bat
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
PySilon-malware-3.7.5/PySilon.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
PySilon-malware-3.7.5/builder.py
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
PySilon-malware-3.7.5/builder.py
Resource
win10v2004-20240611-en
Behavioral task
behavioral9
Sample
PySilon-malware-3.7.5/compiler.py
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
PySilon-malware-3.7.5/compiler.py
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
PySilon-malware-3.7.5/resources/discord_token_grabber.py
Resource
win7-20240611-en
Behavioral task
behavioral12
Sample
PySilon-malware-3.7.5/resources/discord_token_grabber.py
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
PySilon-malware-3.7.5/resources/get_cookies.py
Resource
win7-20231129-en
Behavioral task
behavioral14
Sample
PySilon-malware-3.7.5/resources/get_cookies.py
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
PySilon-malware-3.7.5/resources/libopus-0.x64.dll
Resource
win7-20240508-en
Behavioral task
behavioral16
Sample
PySilon-malware-3.7.5/resources/libopus-0.x64.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral17
Sample
PySilon-malware-3.7.5/resources/misc.py
Resource
win7-20231129-en
Behavioral task
behavioral18
Sample
PySilon-malware-3.7.5/resources/misc.py
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
PySilon-malware-3.7.5/resources/passwords_grabber.py
Resource
win7-20240611-en
Behavioral task
behavioral20
Sample
PySilon-malware-3.7.5/resources/passwords_grabber.py
Resource
win10v2004-20240611-en
Behavioral task
behavioral21
Sample
PySilon-malware-3.7.5/resources/protections.py
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
PySilon-malware-3.7.5/resources/protections.py
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
PySilon-malware-3.7.5/resources/source_code/audio_control.py
Resource
win7-20240508-en
Behavioral task
behavioral24
Sample
PySilon-malware-3.7.5/resources/source_code/audio_control.py
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
PySilon-malware-3.7.5/resources/source_code/block_input.py
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
PySilon-malware-3.7.5/resources/source_code/block_input.py
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
PySilon-malware-3.7.5/resources/source_code/bsod.py
Resource
win7-20240611-en
Behavioral task
behavioral28
Sample
PySilon-malware-3.7.5/resources/source_code/bsod.py
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
PySilon-malware-3.7.5/resources/source_code/crypto_clipper.py
Resource
win7-20240419-en
Behavioral task
behavioral30
Sample
PySilon-malware-3.7.5/resources/source_code/crypto_clipper.py
Resource
win10v2004-20240611-en
Behavioral task
behavioral31
Sample
PySilon-malware-3.7.5/resources/source_code/file_downloading.py
Resource
win7-20240220-en
Behavioral task
behavioral32
Sample
PySilon-malware-3.7.5/resources/source_code/file_downloading.py
Resource
win10v2004-20240508-en
General
-
Target
PySilon-malware-3.7.5/resources/source_code/crypto_clipper.py
-
Size
4KB
-
MD5
8e512488105128ef43b45a026c02bcb2
-
SHA1
3728ddbb7f1af53bd3c0a3afce4bf38e99fa7b6f
-
SHA256
a10f1d124d8b4d22cb0a612493c747d06209dd3a793965fda8b4de9d075ff34e
-
SHA512
46118eac86c291bb7e46bf1a9ea07d62388a3e09f25d79c69e08d42f3bdaf6be68dcb60d8e69936c80f97b0dddfcacc6e073a221736f808a4d744ba6aabc8864
-
SSDEEP
96:a1LoVOBa5ASQtCd45yO5HvgyKo/WzIRLTwM/hRBSLUrPlb/W/R//tXM/xR0:xOBa5ASQtCd4IO5Pv+0iMJXTZ+/Z/pMQ
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_Classes\Local Settings rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\py_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\py_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\py_auto_file rundll32.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.py rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.py\ = "py_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\py_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\py_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 2896 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
AcroRd32.exepid process 2896 AcroRd32.exe 2896 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 1312 wrote to memory of 2744 1312 cmd.exe rundll32.exe PID 1312 wrote to memory of 2744 1312 cmd.exe rundll32.exe PID 1312 wrote to memory of 2744 1312 cmd.exe rundll32.exe PID 2744 wrote to memory of 2896 2744 rundll32.exe AcroRd32.exe PID 2744 wrote to memory of 2896 2744 rundll32.exe AcroRd32.exe PID 2744 wrote to memory of 2896 2744 rundll32.exe AcroRd32.exe PID 2744 wrote to memory of 2896 2744 rundll32.exe AcroRd32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\PySilon-malware-3.7.5\resources\source_code\crypto_clipper.py1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\PySilon-malware-3.7.5\resources\source_code\crypto_clipper.py2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\PySilon-malware-3.7.5\resources\source_code\crypto_clipper.py"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEventsFilesize
3KB
MD5a3421681b06ccd65f36ec803a7c2c598
SHA14dcc8c6dd4a9ae1aa0f0bfacea0a6d7b9d0e5bb6
SHA256ffcccd908f2a798546edaa3b2a00b7ecd44b81fe157440551b0bbc79b5d2c838
SHA512b2ca27ef61c95ff9d53bda6e86631faca8bdffedcb097629fcf29fc88a9ffe390d210f8d66f228fb29d1ecb26b3695a113ff6a5d12ddda1482f3d953d1153f82