Malware Profile Updated 3 months ago
Download STIX
Preview STIX
PyDCrypt is a malicious software (malware) variant deployed by the Moses Staff group, primarily targeting Israeli companies. The malware is written in Python and built with PyInstaller, designed to infect other computers on a network and execute the main payload, DCSrv. It is typically used in the later stages of an attack, after sufficient reconnaissance has been performed and the environment is compromised. Notably, PyDCrypt's deployment involves removing "calc.exe" from infected machines, suspected to be an attempt to eliminate traces of the StrifeWater Remote Access Trojan (RAT), also named "calc.exe" by the attackers. The discovery of the StrifeWater RAT was facilitated by an analysis of a new PyDCrypt variant. This discovery was made by the Cybereason Nocturnus team following research detailing Moses Staff's Tactics, Techniques, and Procedures (TTPs). PyDCrypt operates by running and sending exclusive encryption keys per hostname, based on MD5 hash and crafted salt. A hardcoded dictionary within the PyDCrypt sample reveals the type of information collected from victims' environments during the reconnaissance stage. An interesting development is the recent discovery of a PyDCrypt variant that appears to be in its testing phase. Instead of deploying a ransomware payload, this variant embeds a test executable that simply prints "Hello" upon execution. This suggests that Moses Staff is actively developing and testing new tools for its cyber operations. The group's activities have resulted in significant data leaks, believed to be exfiltrated through the use of custom tools like PyDCrypt, DCSrv, and StrifeWater.
What's your take? (Question 1 of 5)
Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Possible Aliases / Cluster overlaps
It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at.
IDVotesProfile Description
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Ransomware P...
Associated Malware
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
DCSrv is a variant of ransomware developed by the threat group known as Moses Staff. According to research conducted by the Cybereason Nocturnus team, DCSrv was discovered as part of the Moses Staff arsenal, alongside other tools such as PyDCrypt and StrifeWater. The malware disguises itself as the
StrifeWater is a stealthy Remote Access Trojan (RAT) used in targeted ransomware attacks, primarily deployed by the Iranian APT group, Moses Staff. This malware has been identified as a key tool for initial infiltration and reconnaissance on compromised targets, with various capabilities including l
Associated Threat Actors
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
Moses StaffUnspecified
Moses Staff, an Iranian Advanced Persistent Threat (APT) group, has emerged as a significant cybersecurity threat. The Cybereason Nocturnus Team has been monitoring the activities of this group since 2021, and it has been linked to several major ransomware-style attacks. Initially categorized as hac
Associated Vulnerabilities
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
No associations to display
Source Document References
Information about the PyDCrypt Malware was read from the documents corpus below. This display is limited to 20 results, create a free account to see more
9 months ago
A hack in hand is worth two in the bush
a year ago
StrifeWater RAT: Iranian APT Moses Staff Adds New Trojan to Ransomware Operations
a year ago
Uncovering MosesStaff techniques: Ideology over Money - Check Point Research