PyInstaller Sample Analysis

Unpack and decompile compiled Python malware.

Analyze the Python binary at /home/remnux/samples/stealer.exe:

1. Use remnux-ssh triage_python on the file
2. If PyInstaller detected, use pyinstaller_extract to unpack it
3. Decompile any .pyc files found with python_decompile
4. Extract C2 configuration from the decompiled source
5. Cross-reference IOCs with virustotal