coinminer: 058ab625 — PyInstaller bootloader eighth sibling, Sep 2018 MSVC build, AES-encrypted overlay (2.76 MB)

Executive Summary

PyInstaller single-file PE32 dropper, eighth observed sibling in the September 2018 MSVC 2015 cluster. Shares the identical compilation timestamp, linker version, AES key (1qazxsw23edcvfrN), and build path (F:\files\ftp\crack\exe\build\ftpcrack\) with sibling 359fcf01. At 2.76 MB it is smaller than the 4.35 MB 359fcf01 twin but uses the same weak QWERTY-derived AES key, meaning the same key decrypts both overlays. No mining pool strings recoverable from the outer binary; threat logic is entirely inside the AES-encrypted PyInstaller CFFI archive.

What It Is

• File: PE32 executable (GUI) Intel 80386, 6 sections ^[file.txt]
• Size: 2,760,367 bytes (2.76 MB) ^[rabin2-info.txt]
• Compiled: Tue Sep 4 14:43:33 2018 UTC ^[pefile.txt:34] ^[rabin2-info.txt]
• Linker: MSVC 14.0 (Visual Studio 2015) ^[exiftool.json:18]
• Signed: false ^[rabin2-info.txt]
• ASLR / DEP: enabled (DllCharacteristics: 0x8140) ^[pefile.txt:74]
• Subsystem: Windows GUI ^[file.txt]
• Overlay: 2,511,023 bytes starting at raw offset 0x3CE00 (91% of file), zlib-compressed CFFI archive with AES encryption ^[binwalk.txt] ^[manual_analysis]
• Family: coinminer (OpenCTI label) ^[triage.json]
• CAPE: skipped — no Windows guest available ^[dynamic-analysis.md]

How It Works

This binary is a PyInstaller single-file bootloader performing the standard runtime sequence documented at pyinstaller-bootloader and in the cluster page coinminer:

1. CRT initialisation — MSVC entry0 → main() → PyInstaller bootstrap core ^[r2:entry0]
2. Archive resolution — locates the CFFI archive appended past the PE sections (overlay at 0x3CE00) ^[binwalk.txt]
3. Extraction — decompresses zlib blocks and decrypts AES-encrypted entries to %TEMP%\_MEI<XXXX> ^[manual_analysis]
4. Python runtime bootstrap — loads the Python DLL, resolves CPython API procs (Py_Initialize, PyMarshal_ReadObjectFromString, PyEval_EvalCode, etc.) ^[strings.txt:119-212]
5. Script execution — unmarshals the embedded code object and runs __main__.py ^[strings.txt:104-111]
6. Cleanup — deletes the temp directory on exit unless _MEIPASS2 is set ^[strings.txt:115]

AES encryption

Built with the PyInstaller --key option. The first overlay zlib chunk decompresses to a pyimod00_crypto_key module containing:

`1qazxsw23edcvfrN(
F:\files\ftp\crack\exe\build\ftpcrack\pyimod00_crypto_key.pyt
<module>

The key 1qazxsw23edcvfrN is a left-hand QWERTY diagonal walk (1qaz → xsw2 → 3edc → vfr) with trailing N. Because this sample and 359fcf01 share the exact same key and build path, they are almost certainly built from the same PyInstaller spec file, differing only in the Python payload size bundled at build time. ^[manual_analysis]

Cluster delta

The compilation timestamp, linker version, bootloader strings, and now the AES key are identical across 058ab625 and 359fcf01 — these are twins from the same build pipeline, with different payload sizes.

Decompiled Behaviour

• entry0 (0x004079d3): MSVC CRT entry. Calls initialisers, then main(). No anti-debug or VM checks. ^[r2:entry0]
• main (0x00401000): Thin wrapper calling fcn.004049d0 (UTF-8 argv conversion) then fcn.00402520 (PyInstaller bootstrap core). ^[r2:main]
• fcn.00402520: The PyInstaller bootstrap engine — allocates ARCHIVE_STATUS, resolves self/archive path, checks _MEIPASS2, calls SetDllDirectoryW, then unpacks and executes the embedded Python runtime. ^[r2:fcn.00402520]
• Imports are limited to standard Win32 + WS2_32.dll.ntohl (CRT-linked, not actively used) ^[pefile.txt:249-373]
• .rsrc section contains 7 icon groups (PyInstaller default icon inheritance) ^[pefile.txt:159-492]
• Entropy: .text 6.65, .rsrc 7.26 — normal for an unencrypted bootloader; heavy entropy lives in the AES-encrypted overlay. ^[pefile.txt:91-172]

C2 Infrastructure

Not statically observable. The outer binary contains only generic PyInstaller error strings and MSVC CRT locale strings. No hardcoded IPs, domains, pool URLs, or wallet addresses are recoverable without decrypting the overlay. Pool/C2 configuration is presumed to reside inside the AES-encrypted Python payload. ^[strings.txt]

Known overlay artefacts (pre-decryption):

• pyimod00_crypto_key — AES key provider module
• pyimod01_os_path — PyInstaller runtime path shim ^[manual_analysis]
• pyiboot01_bootstrap — PyInstaller bootstrap entry point ^[manual_analysis]
• Multiple embedded PE DLLs (UPX-compressed python27.dll, _hashlib.pyd, msvcr90.dll, etc.) ^[manual_analysis]

Interesting Tidbits

1. Twin to 359fcf01 — Same AES key, same build path, same timestamp, same linker. The only delta is file size (2.76 MB vs 4.35 MB) and overlay size (~2.5 MB vs ~4.3 MB). This strongly suggests the same actor rebuilt the spec with a different (smaller) Python payload. ^[manual_analysis]
2. Weak AES key reuse — Because 1qazxsw23edcvfrN is hardcoded in both samples, anyone who extracts the key from one can decrypt the overlay of the other. Key reuse across builds is an opsec failure. ^[manual_analysis]
3. Build path leak — F:\files\ftp\crack\exe\build\ftpcrack\ again. The ftpcrack project name may be the actor's working directory or a masquerade. ^[manual_analysis]
4. 27 zlib streams in overlay — More compressed blocks than some siblings (e.g., b4cc27e3 had ~18), indicating a larger Python standard-library surface area in the bundled runtime. ^[binwalk.txt] ^[manual_analysis]
5. pyinstxtractor / pyi-archive_viewer failure — Both tools failed because they read the CArchive cookie from the first MEI magic occurrence (inside a decompressed entry name at 0x1f330) rather than the actual cookie near EOF. Manual zlib decomposition was required. ^[manual_analysis]
6. floss.txt and capa.txt both failed — floss.txt is a tool mis-invocation (binary path passed to --no); capa.txt failed because the default signature path is missing on this station. Neither failure is malware-induced. ^[floss.txt] ^[capa.txt]
7. No YARA matches beyond generic PE — outer bootloader lacks mining-family signatures. ^[triage.json]

How To Mess With It (Homelab Replication)

• Toolchain: Install Python 2.7 + PyInstaller 3.4 on a Windows research VM.
• Build an AES-encrypted onefile payload: pyinstaller --onefile --windowed --key '1qazxsw23edcvfrN' your_script.py
• Verify: strings on the output EXE should show pyimod00_crypto_key.pyt. The overlay zlib chunks will decompress to AES key modules rather than plaintext Python.
• Decrypt: Patch pyi-archive_viewer to use the recovered key, or modify PyInstaller's archive.py to skip the decryption loop and dump decrypted entries.
• Learning outcome: Understanding the --key option means analysts cannot rely on simple zlib decompression; extraction requires the AES key or a runtime detonation with process-memory dumps.

Deployable Signatures

YARA rule

rule PyInstallerBootloader_AESCoinminer_2018_QwertyKey {
    meta:
        description = "PyInstaller single-file bootloader with AES-encrypted coinminer payload (2018 cluster, weak QWERTY-derived key)"
        author = "Titus"
        date = "2026-06-16"
        sha256 = "058ab6252975132460f88bca500c298352643888767b81ec73afe355ec593a34"
    strings:
        $pyi1 = "pyimod00_crypto_key" ascii wide
        $pyi2 = "PyInstaller: FormatMessageW failed." ascii wide
        $pyi3 = "_MEIPASS2" ascii wide
        $pyi4 = "Failed to execute script %s" ascii wide
        $pyi5 = "pyi-runtime-tmpdir" ascii wide
        $inflate = "inflate 1.2.8 Copyright 1995-2013 Mark Adler" ascii wide
        $key = "1qazxsw23edcvfrN" ascii wide
    condition:
        uint16(0) == 0x5a4d and
        $pyi1 and
        $key and
        3 of ($pyi2, $pyi3, $pyi4, $pyi5) and
        $inflate
}

Sigma rule

title: PyInstaller Bootloader AES Coinminer Execution
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains:
            - '_MEI'
            - 'PyInstaller'
        Image|endswith: '.exe'
    condition: selection
falsepositives:
    - Legitimate PyInstaller-built applications
level: medium

IOC list

Behavioral fingerprint statement

This binary is a PyInstaller single-file PE32 bootloader compiled with MSVC 14.0 on Sep 4 2018. At runtime it allocates an ARCHIVE_STATUS structure, resolves its own path, checks the _MEIPASS2 environment variable, then decompresses and AES-decrypts a zlib-compressed CFFI archive from the PE overlay to a %TEMP%\_MEI<XXXX> directory. It loads python27.dll via LoadLibraryA, resolves CPython API functions via GetProcAddress, and executes the embedded __main__.py script. No anti-debug or VM checks are present. The outer binary contains no mining pool strings; all threat logic is inside the AES-encrypted overlay.

Detection Signatures

No capa.txt available due to missing signature path on station.

References

• coinminer — Cluster entity page
• pyinstaller-bootloader — Concept page
• python-packed-payload — Concept page
• /intel/analyses/359fcf01a54b89eabcbfcecd734e2af60b6bfa19ffd7fcdd87b1e4ed15db599c.html — Twin sibling (same AES key, same build path, larger payload)
• Artifact ID: da72af72-6b86-42b9-bafd-758a8c1bd7f4 ^[metadata.json]

Provenance

Report generated from:

• file.txt, exiftool.json, pefile.txt, strings.txt, ssdeep.txt, tlsh.txt, yara.txt, metadata.json, triage.json, floss.txt, capa.txt, binwalk.txt, rabin2-info.txt, dynamic-analysis.md
• Manual overlay decomposition with Python zlib and pefile
• radare2 decompilation of entry0, main, and fcn.00402520
• PyGhidra import (queued, analysis incomplete at time of writing)
• No CAPE dynamic analysis (skipped — no Windows guest)