【ブログ】
◆PyXieとの遭遇：新手の悪質なPython RAT (Cylance, 2019/12/26)
https://www.cylance.com/ja_jp/blog/jjp-meet-pyxie-a-nefarious-new-python-rat.html
【関連情報】
◆Pythonで実装されたマルウェア「PyXieRAT」はどこが危険なのか？ (マイナビニュース, 2019/12/26 14:06)
https://news.mynavi.jp/article/20191226-946543/
【IoC情報】
◆PyXie (IoC (TT Malware Log))
https://ioc.hatenablog.com/entry/2019/12/26/000000
【インディケータ情報】
■ハッシュ情報(Sha256) - ローダーDLL -
1d970f2e7af9962ae6786c35fcd6bc48bb860e2c8ca74d3b81899c0d3a978b2b
3a47e59c37dce42304b345a16ba6a3d78fc44b21c4d0e3a0332eee21f1d13845
3aa746bb94acee94c86a34cb0b355317de8404c91de3f00b40e8257b80c64741
56e96ce15ebd90c197a1638a91e8634dbc5b0b4d8ef28891dcf470ca28d08078
5937746fc1a511d9a8404294b0caa2aedae2f86b5b5be8159385b6c7a4d6fb40
7330fa1ca4e40cdfea9492134636ef06cd999efb71f510074d185840ac16675d
78471db16d7bd484932c8eb72f7001db510f4643b3449d71d637567911ca363b
814357417aa8a57e43d50cb3347c9d287b99955b0b8aee4e53e12b463f7441a0
92a8b74cafa5eda3851cc494f26db70e5ef0259bc7926133902013e5d73fd285
a765df03fffa343aa7a420a0a57d4b5c64366392ab6162c3561ff9f7b0ad5623
c3b3f46a5c850971e1269d09870db755391dcbe575dc7976f90ccb1f3812d5ea
c9400b2fff71c401fe752aba967fa8e7009b64114c9c431e9e91ac39e8f79497
d271569d5557087aecc340bb570179b73265b29bed2e774d9a2403546c7dd5ff
de44656b4a3dde6e0acdc6f59f73114ce6bb6342bec0dcd45da8676d78b0042e
e0f22863c84ee634b2650b322e6def6e5bb74460952f72556715272c6c18fe8e
ea27862bd01ee8882817067f19df1e61edca7364ce649ae4d09e1a1cae14f7cc
edd1480fe3d83dc4dc59992fc8436bc1f33bc065504dccf4b14670e9e2c57a89
f9290cd938d134a480b41d99ac2c5513a964de001602ed34c6383dfeb577b8f7
■ハッシュ情報(Sha256) - 暗号化されたペイロード -
366d47b95e216863ee64e0024e2bbf0bf1b66420986fe0a5b3e805ce795dcf9f
d031081b8c211994b5406bf3f2544c0d6ebcbab384f23e393f084b49563e1d12
f466bc20544bf203155142cf14456e55b0e756aa93ecfb5edc74ba7ed60f9573
ca68f02bd01650383af68f0c129482faf283329dd1e6a18821ad26fc2c3d00b2
d776235e628422ada7f1e976a3cf771049286edf2219583028fbbd6229af72b9
50a4b19b38caea4eea042704314f5ae1acf2162c7353fb92bc896dcada14b86a
610c3536ceafc0e4ad0d60c683052ee7272e29049ceac909b1d1e55ac1206f49
7ee6235f0e653a36a818a12531657f6dac5f3fb41efa1e1c63f6761ba3faeb90
265e5e1389b3145bf2ac1a017b67a54d84bc361dc3795120656dcabc1212c34a
■ハッシュ情報(Sha256) - PyXie RATインタープリター -
8d2b3b0cbb32618b86ec362acd142177f5890917ae384cb58bd64f61255e9c7f
■ハッシュ情報(Sha256) - PyXie RATのバイトコード-
d1429f54baaad423a8596140a3f70f7d9f762373ad625bda730051929463847d
■ハッシュ情報(Sha256) - Cobalt Mode -
ade8f07bf7918343bf307ec35837327efc7a85a0edac5ab5b2cd037134af8d57
■ハッシュ情報(Sha256) - Cobalt Strikeローダー -
fd93858f4e7356bebe30dd0dfe07367e3ddf6164bb78725e1c543b093558cf64
a50b58e24eb261157c4f85d02412d80911abe8501b011493c7b393c1905fc234
0d14a1b5574dc12f6286d37d0a624232fb63079416b98c2e1cb5c61f8c2b66ff
625c22b21277c8a7e1b701da9c1c21b64bfa02baef5d7a530a38f6d70a7a16d0
bd7da341a28a19618b53e649a27740dfeac13444ce0e0d505704b56335cc55bd
d612144c1f6d4a063530ba5bfae7ef4e4ae134bc55dcf067439471934b841b00
ce0936366976f07ea24e86733888e97e421393829ecfd0fde66bd943d4b992ab
3259dd0efed1d28a149d4e8c4f980a19199d9bead951ee1231e3a26521185f2f
e5fede5eb43732c7f098acf7b68b1350c6524962215b476de571819b6e5a71fc
f6ff873e1bd3d0e6b6182792aebd781f4f60be39d49085ba3d64658456260402
608f34a79e5566593b284ef0d24f48ea89bc007e5654ae0969e6d9f92ec87d32
b1f54b88c9b7680877981f6bebde6aea9effbc38a0a8b27a565fb35331094680
d50f28cf5012e1ffde1cd28655e07519dadcf94218b15c701c526ab0f6acb915
56934547dcf0d7ecf61868ae2f620f60e94c094dbd5c3b5aaf3d3a904d20a693
73609f8ebd14c6970d9162ec8d7786f5264e910573dff73881f85b03163bd40e
2ceb5de547ad250140c7eb3c3d73e4331c94cf5a472e2806f93bf0d9df09d886
840985b782648d57de302936257ba3d537d21616cb81f9dce000eaf1f76a56c8
e48e88542ec4cd6f1aa794abc846f336822b1104557c0dfe67cff63e5231c367
cb2619b7aab52d612012386d88a0d983c270d9346169b75d2a55010564efc55c
88565b4c707230eac34d4528205056264cd70d797b6b4eb7d891821b00187a69
91c62841844bde653e0357193a881a42c0bc9fcc798a69f451511c6e4c46fd18
ddf83c02effea8ae9ec2c833bf40187bed23ec33c6b828af49632ef98004ea82
edecfdd2a26b4579ecacf453b9dff073233fb66d53c498632464bca8b3084dc5
