MITRE ATT&CKsoftware (malware)
S1032 PyDCrypt
- Domain
- enterprise
- Platforms
- Windows
- Version
- 1.1
- Created
- 2022-08-11
Description
PyDCrypt is malware written in Python designed to deliver DCSrv. It has been used by Moses Staff since at least September 2021, with each sample tailored for its intended victim organization.
Related
Uses · MITRE ATT&CK (11)
- T1686 Disable or Modify System Firewall technique
- T1027.013 Encrypted/Encoded File sub-technique
- T1059.001 PowerShell sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1059.006 Python sub-technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
- T1070.004 File Deletion sub-technique
- T1140 Deobfuscate/Decode Files or Information technique
- T1033 System Owner/User Discovery technique
- T1047 Windows Management Instrumentation technique
- T1049 System Network Connections Discovery technique
Referenced by MITRE ATT&CK · uses (1)
- G1009 Moses Staff group
References
- https://research.checkpoint.com/2021/mosesstaff-targeting-israeli-companies/ Checkpoint MosesStaff Nov 2021