Procedure examples

PyDCrypt, along with its functions, is written in Python.

Turian has the ability to use Python to spawn a Unix shell.

THINCRUST can use Python scripts for command execution.

Machete is written in Python and is used in conjunction with additional Python scripts.

DropBook is a Python-based backdoor compiled with PyInstaller.

Keydnap uses Python for scripting to execute additional commands.

PUNCHBUGGY has used python scripts.

KeyBoy uses Python scripts for installing files and performing execution.

Lumma Stealer has used malicious Python scripts to execute payloads.

Chaes has used Python scripts for execution and the installation of additional files.

Bundlore has used Python scripts to execute payloads.

VIRTUALPIE is a Python-based backdoor malware.

Bandook can support commands to execute Python-based payloads.

Pysa has used Python scripts to deploy ransomware.

SpeakUp uses Python scripts.

Cobalt Strike can use Python to perform execution.

Neo-reGeorg is a Python-based web shell.

FRAMESTING is a Python web shell that can embed in the Ivanti Connect Secure CAV Python package.

LAMEHUG can use Python scripts for execution.

PoetRAT was executed with a Python script and worked in conjunction with additional Python-based post-exploitation tools.

CoinTicker executes a Python script to download its second stage.

SPAWNCHIMERA has searched the contents of two Python files scanner.py and scanner_legacy.py by searching for specific lines and replacing them with values that reduce their ability to track mismatches or new files.

Ebury has used Python to implement its DGA.

VIRTUALPITA can call a Python script to run commands on a targeted guest virtual machine.

MechaFlounder uses a python-based payload.

DRYHOOK is a Python-based script that executes within the victim environment.

CookieMiner has used python scripts on the user’s system, as well as the Python variant of the Empire agent, EmPyre.

Lizar has used Python scripts (ps2x.py script and ps2p.py) to execute files on remote hosts using the Impacket library.

Small Sieve can use Python scripts to execute commands.

SILENTTRINITY is written in Python and can use multiple Python scripts for execution on targeted systems.

Remcos uses Python scripts.

Donut can generate shellcode outputs that execute via Python.

IronNetInjector can use IronPython scripts to load payloads with the help of a .NET injector.

Pupy can use an add on feature when creating payloads that allows you to create custom Python scripts (“scriptlets”) to perform tasks offline (without requiring a session) such as sandbox detection, adding persistence, etc.

TeamPCP Cloud Stealer has leveraged Python scripts to download additional payloads, engage in discovery, and to establish persistence.

Mini Shai-Hulud has utilized Python scripts to execute payloads.

CanisterWorm has used a Python script as a second-stage backdoor.

GRIFFON is written in and executed as JavaScript.

KOPILUWAK had used Javascript to perform its core functions.

Tsundere Botnet has the ability to run JavaScript code from the C2 server. Additionally, Tsundere Botnet has used Node.js to execute JavaScript code for the loader component.

AppleSeed has the ability to use JavaScript to execute PowerShell.

EnvyScout can write files to disk with JavaScript using a modified version of the open-source tool FileSaver.

Gootloader can execute a Javascript file for initial infection.

HexEval Loader has executed malicious JavaScript code.

InvisiMole can use a JavaScript file as part of its execution chain.

Avaddon has been executed through a malicious JScript downloader.

The SocGholish payload is executed as JavaScript.

SpicyOmelette has the ability to execute arbitrary JavaScript code on a compromised host.

BeaverTail has executed malicious JavaScript code. BeaverTail has also been compiled with the Qt framework to execute in both Windows and macOS.

DarkWatchman uses JavaScript to perform its core functionalities.