PULSE NAME
Analysis of Pupy RAT Used in Attacks Against Linux Systems
WHITE AlienVault 2024-04-19 Modified: 2024-05-19
51
IOCs
HIGH VOLUME
Pupy RAT is a cross-platform remote access trojan that has been used by various threat actors, including APT groups, to target Linux and Windows systems. It provides features for remote control, information theft, and post-exploitation attacks. Recent examples include distribution alongside PlugX to target South Korea, and updated versions targeting Russia and Eastern Europe. To prevent infection, systems should be kept updated and anti-malware solutions used.
MITRE ATT&CK & Malware Families
ATT&CK TECHNIQUES
MALWARE FAMILIES
Pupy PlugX - S0013 Thoper TVT DestroyRAT Sogu Kaba Korplug CobaltStrike
Indicators of Compromise (21 / 51 total)
All FileHash-MD5 FileHash-SHA1 FileHash-SHA256 domain hostname
TYPEINDICATORDESCRIPTIONCREATED
FileHash-MD5 1358d7f17b0882a38a3cfa88df256fc1 2024-04-19
FileHash-MD5 16b088b75442e247a8c53161a8a130b0 2024-04-19
FileHash-MD5 1738429d3737b22d52b442c4faef50a1 2024-04-19
FileHash-MD5 2c802c1fac3b0035b2a79cbd56510caa 2024-04-19
FileHash-MD5 2f378559b835cbe9ec9874baec73a578 2024-04-19
FileHash-MD5 3eb3591c8c5d0a5a32dc24f91d6fe7fb 2024-04-19
FileHash-MD5 4c1124695279dd41c0b789235dbabf08 2024-04-19
FileHash-MD5 4eb6509cf46d480647556105b42b4bee 2024-04-19
FileHash-MD5 504612eaebc2660c4ac00f5db1d24fca 2024-04-19
FileHash-MD5 5ab182b00e674cea319e2152e7c3558f 2024-04-19
FileHash-MD5 64802dd9446be23d7188fb87426866cb 2024-04-19
FileHash-MD5 6a0a68b75ad2f087c1a566a6e3de1a28 2024-04-19
FileHash-MD5 71ca0622043a7dec95bb4514ce14d627 2024-04-19
FileHash-MD5 73a6b6e84caf0f12782b70ece7bd60de 2024-04-19
FileHash-MD5 74199f5ca6421ade97cc511651fa2e4b 2024-04-19
FileHash-MD5 9efdf13b1eee7b0c626d785b17cd5c95 2024-04-19
FileHash-MD5 cd206fff363bb5543fc67ed9a9bbe496 2024-04-19
FileHash-MD5 ef13037b082e9e1dfe39ae5cf9d101e3 2024-04-19
FileHash-MD5 ef7651bbbf3f05234f2b1d5e30103588 2024-04-19
FileHash-MD5 f35f7a7fb6c4352510c4f7a448e6ba03 2024-04-19
FileHash-MD5 f50d7a7bc104d87d6a4a9e2f4e1beedc 2024-04-19