Malware

PyXie Lite

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

20 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence1

The second stage payload is a custom-compiled Python interpreter... _run_shell_cmds System Runs a series of commands to gather details about the system

T1059.001PowerShellEvidence1

_get_ps_history User Collects Powershell history

Privilege Escalation

1 technique

T1055Process InjectionEvidence1

If it is determined to be running as LocalSystem, the payload is injected into a newly spawned process chosen from the Windows directory. If not found to be running as LocalSystem, the payload will execute in the memory space of the current process.

Stealth

5 techniques

T1027Obfuscated Files or InformationEvidence1

Significant strings are encrypted... The next stage payload is stored in an encrypted 7z archive... the final stage of PyXie bytecode is contained in an encrypted ZIP file embedded within the interpreter binary... the opcode table had once again been modified.

T1055Process InjectionEvidence1

T1497.001System ChecksEvidence1

OpenProcessToken and GetTokenInformation are called to determine if the process is running under the LocalSystem account. This is used to determine how the next stage payload is executed.

T1620Reflective Code LoadingEvidence1

The decrypted Vatet payload contains the first stage of PyXie prepended by a shellcode loader responsible for mapping the first stage into memory and executing it.

T1622Debugger EvasionEvidence1

A mutex is created to prevent multiple instances from running at the same time.

Credential Access

2 techniques

T1003OS Credential DumpingEvidence2

_mimi_redirector All Runs Mimikatz in memory... reg.exe save hklm\security ... reg.exe save hklm\system ... reg.exe save hklm\sam

T1555Credentials from Password StoresEvidence2

Collects cookies... Collects KeePass safes... _get_passwords All Collects passwords with Lazagne | Collects cookies Collects LogMeIn data Collects Citrix data Collects KeePass safes

Discovery

8 techniques

T1046Network Service DiscoveryEvidence2

_scan_network System Runs network scans... netstat -an ... net view /all ... arp -a ... nslookup -type=any %userdnsdomain%

T1082System Information DiscoveryEvidence2

_main_routine All Collects basic details about the system... As part of the data gathering routines, a number of commands are executed to collect details about the system... systeminfo

T1083File and Directory DiscoveryEvidence2

_find_files System Searches for and collects files and directories based on keywords, directories and extensions specified in the configuration

T1087Account DiscoveryEvidence2

net user ... net group "Domain Admins" ... net group "Enterprise Admins" ... net localgroup ... net localgroup "administrators"

T1135Network Share DiscoveryEvidence1

PyXie Lite Config ... "shell_cmds": [ ... "net share", "net use", "net view /all /domain", "net view /all" ... ]

T1497.001System ChecksEvidence1

OpenProcessToken and GetTokenInformation are called to determine if the process is running under the LocalSystem account. This is used to determine how the next stage payload is executed.

T1518Software DiscoveryEvidence1

PyXie Lite Config ... "software": [" OPOS", "Aldelo", "Actifio", ... "QuickBooks", ... "ScreenConnect", ... "VMware", "Vnc", "VPN", "Wallet"], "registry": ["SOFTWARE\\Ammyy", ... "SOFTWARE\\Veeam" ... ]

T1622Debugger EvasionEvidence1

A mutex is created to prevent multiple instances from running at the same time.

Lateral Movement

1 technique

T1021Remote ServicesEvidence1

PyXie Lite Config ... "portscan": { ... "RDP": [3389], ... "SSH": [22], ... "WinRM": [5985,5986], ... "VNC": [5900, 5800] ... }

Collection

3 techniques

T1074Data StagedEvidence1

PyXie Lite Exfil Staging Paths %temp%\tmp <Random> \wifi_info.txt ... \screen.jpg ... \pwds.txt ... \general.txt ...

T1113Screen CaptureEvidence2

_take_screenshot User Takes a screenshot

T1560Archive Collected DataEvidence1

The staging directory containing the collected data is added to a compressed ZIP archive and encrypted before being sent to the server specified in the gates section of the config.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence2

The staging directory containing the collected data is added to a compressed ZIP archive and encrypted before being sent to the server specified in the gates section of the config.

INDICATORS OF COMPROMISE

IOCs tracked for this family

19 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

19 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app6 years ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

palo alto networks unit 42 blogNews

Nov 7, 2020

When Threat Actors Fly Under the Radar: Vatet, PyXie and Defray777

An updated PyXie variant built around a custom Python interpreter. It decrypts staged payloads in memory, collects system, credential, browser, file, and network data, runs reconnaissance commands, and exfiltrates encrypted archives to attacker-controlled internal servers.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching19

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping20

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

PyXie Lite

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

20 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence1

The second stage payload is a custom-compiled Python interpreter... _run_shell_cmds System Runs a series of commands to gather details about the system

T1059.001PowerShellEvidence1

_get_ps_history User Collects Powershell history

Privilege Escalation

1 technique

T1055Process InjectionEvidence1

Stealth

5 techniques

T1027Obfuscated Files or InformationEvidence1

T1055Process InjectionEvidence1

T1497.001System ChecksEvidence1

OpenProcessToken and GetTokenInformation are called to determine if the process is running under the LocalSystem account. This is used to determine how the next stage payload is executed.

T1620Reflective Code LoadingEvidence1

The decrypted Vatet payload contains the first stage of PyXie prepended by a shellcode loader responsible for mapping the first stage into memory and executing it.

T1622Debugger EvasionEvidence1

A mutex is created to prevent multiple instances from running at the same time.

Credential Access

2 techniques

T1003OS Credential DumpingEvidence2

_mimi_redirector All Runs Mimikatz in memory... reg.exe save hklm\security ... reg.exe save hklm\system ... reg.exe save hklm\sam

T1555Credentials from Password StoresEvidence2

Collects cookies... Collects KeePass safes... _get_passwords All Collects passwords with Lazagne | Collects cookies Collects LogMeIn data Collects Citrix data Collects KeePass safes

Discovery

8 techniques

T1046Network Service DiscoveryEvidence2

_scan_network System Runs network scans... netstat -an ... net view /all ... arp -a ... nslookup -type=any %userdnsdomain%

T1082System Information DiscoveryEvidence2

_main_routine All Collects basic details about the system... As part of the data gathering routines, a number of commands are executed to collect details about the system... systeminfo

T1083File and Directory DiscoveryEvidence2

_find_files System Searches for and collects files and directories based on keywords, directories and extensions specified in the configuration

T1087Account DiscoveryEvidence2

net user ... net group "Domain Admins" ... net group "Enterprise Admins" ... net localgroup ... net localgroup "administrators"

T1135Network Share DiscoveryEvidence1

PyXie Lite Config ... "shell_cmds": [ ... "net share", "net use", "net view /all /domain", "net view /all" ... ]

T1497.001System ChecksEvidence1

OpenProcessToken and GetTokenInformation are called to determine if the process is running under the LocalSystem account. This is used to determine how the next stage payload is executed.

T1518Software DiscoveryEvidence1

T1622Debugger EvasionEvidence1

A mutex is created to prevent multiple instances from running at the same time.

Lateral Movement

1 technique

T1021Remote ServicesEvidence1

PyXie Lite Config ... "portscan": { ... "RDP": [3389], ... "SSH": [22], ... "WinRM": [5985,5986], ... "VNC": [5900, 5800] ... }

Collection

3 techniques

T1074Data StagedEvidence1

PyXie Lite Exfil Staging Paths %temp%\tmp <Random> \wifi_info.txt ... \screen.jpg ... \pwds.txt ... \general.txt ...

T1113Screen CaptureEvidence2

_take_screenshot User Takes a screenshot

T1560Archive Collected DataEvidence1

The staging directory containing the collected data is added to a compressed ZIP archive and encrypted before being sent to the server specified in the gates section of the config.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence2

The staging directory containing the collected data is added to a compressed ZIP archive and encrypted before being sent to the server specified in the gates section of the config.

INDICATORS OF COMPROMISE

IOCs tracked for this family

19 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

19 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app6 years ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

palo alto networks unit 42 blogNews

Nov 7, 2020

When Threat Actors Fly Under the Radar: Vatet, PyXie and Defray777

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching19

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping20

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.