Reverse Engineering Pyinstaller Malware
Unpacking PyInstaller The first step is to extract all the pyc files from within the PyInstaller executable. This script (pyinstxtractor.py) is able to parse the PyInstaller exe and extract the pyc files.
python3 pyinstxtractor.py sample.exe [+] Processing sample.exe [+] Pyinstaller version: 2.1+ [+] Python version: 37 [+] Length of package: 5738778 bytes [+] Found 61 files in CArchive [+] Beginning extraction...please standby [+] Possible entry point: pyiboot01_bootstrap.pyc [+] Possible entry point: sample.