H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

PyDCrypt

[PyDCrypt](https://attack.mitre.org/software/S1032) is malware written in Python designed to deliver [DCSrv](https://attack.mitre.org/software/S1033). It has been used by [Moses Staff](https://attack.mitre.org/groups/G1009) since at least September 2021, with each sample tailored for its intended victim organization.(Citation: Checkpoint MosesStaff Nov 2021)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[PyDCrypt](https://attack.mitre.org/software/S1032) is malware written in Python designed to deliver [DCSrv](https://attack.mitre.org/software/S1033). It has been used by [Moses Staff](https://attack.mitre.org/groups/G1009) since at least September 2021, with each sample tailored for its intended victim organization.(Citation: Checkpoint MosesStaff Nov 2021)

Labels

malware
12 recorded

Relationships

uses
from Moses Staff
Group
uses
to Deobfuscate/Decode Files or Information
Technique
uses
to Disable or Modify System Firewall
Technique
uses
to Encrypted/Encoded File
Technique
uses
to File Deletion
Technique
uses
to Match Legitimate Resource Name or Location
Technique
uses
to PowerShell
Technique
uses
to Python
Technique
uses
to System Network Connections Discovery
Technique
uses
to System Owner/User Discovery
Technique
uses
to Windows Command Shell
Technique
uses
to Windows Management Instrumentation
Technique
2 external

References

mitre-attack
S1032
open
Checkpoint MosesStaff Nov 2021
https://research.checkpoint.com/2021/mosesstaff-targeting-israeli-companies/
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance