Procedure examples

reGeorg is a Python-based web shell.

InvisibleFerret is written in Python and has used Python scripts for execution.

UPSTYLE is a Python-based application.

PyDCrypt, along with its functions, is written in Python.

Turian has the ability to use Python to spawn a Unix shell.

THINCRUST can use Python scripts for command execution.

Machete is written in Python and is used in conjunction with additional Python scripts.

DropBook is a Python-based backdoor compiled with PyInstaller.

Keydnap uses Python for scripting to execute additional commands.

PUNCHBUGGY has used python scripts.

KeyBoy uses Python scripts for installing files and performing execution.

Lumma Stealer has used malicious Python scripts to execute payloads.

Chaes has used Python scripts for execution and the installation of additional files.

Bundlore has used Python scripts to execute payloads.

VIRTUALPIE is a Python-based backdoor malware.

Bandook can support commands to execute Python-based payloads.

Pysa has used Python scripts to deploy ransomware.

SpeakUp uses Python scripts.

Cobalt Strike can use Python to perform execution.

Neo-reGeorg is a Python-based web shell.

FRAMESTING is a Python web shell that can embed in the Ivanti Connect Secure CAV Python package.

LAMEHUG can use Python scripts for execution.

PoetRAT was executed with a Python script and worked in conjunction with additional Python-based post-exploitation tools.

CoinTicker executes a Python script to download its second stage.

SPAWNCHIMERA has searched the contents of two Python files scanner.py and scanner_legacy.py by searching for specific lines and replacing them with values that reduce their ability to track mismatches or new files.

Ebury has used Python to implement its DGA.

VIRTUALPITA can call a Python script to run commands on a targeted guest virtual machine.

MechaFlounder uses a python-based payload.

DRYHOOK is a Python-based script that executes within the victim environment.

CookieMiner has used python scripts on the user’s system, as well as the Python variant of the Empire agent, EmPyre.

Lizar has used Python scripts (ps2x.py script and ps2p.py) to execute files on remote hosts using the Impacket library.

Small Sieve can use Python scripts to execute commands.

SILENTTRINITY is written in Python and can use multiple Python scripts for execution on targeted systems.

Remcos uses Python scripts.

Donut can generate shellcode outputs that execute via Python.

IronNetInjector can use IronPython scripts to load payloads with the help of a .NET injector.

Pupy can use an add on feature when creating payloads that allows you to create custom Python scripts (“scriptlets”) to perform tasks offline (without requiring a session) such as sandbox detection, adding persistence, etc.

TeamPCP Cloud Stealer has leveraged Python scripts to download additional payloads, engage in discovery, and to establish persistence.

Mini Shai-Hulud has utilized Python scripts to execute payloads.

CanisterWorm has used a Python script as a second-stage backdoor.