PyDCrypt
- ID
- S1032
- Type
- Malware
- Platforms
- Windows
- Source
- attack.mitre.org
- MITRE last modified
- 11 Apr 2024
PyDCrypt is malware written in Python designed to deliver DCSrv. It has been used by Moses Staff since at least September 2021, with each sample tailored for its intended victim organization.[1]
Techniques used (11)
- T1027.013 Encrypted/Encoded File
- T1033 System Owner/User Discovery
- T1036.005 Match Legitimate Resource Name or Location
- T1047 Windows Management Instrumentation
- T1049 System Network Connections Discovery
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1059.006 Python
- T1070.004 File Deletion
- T1140 Deobfuscate/Decode Files or Information
- T1686 Disable or Modify System Firewall