S0192 · threatengine.sh

Home/Tool / Malware/Pupy

Tool / Malware

Pupy

S0192 · Linux, Windows, macOS, Android

Pupy is an open source, cross-platform (Windows, Linux, OSX, Android) remote administration and post-exploitation tool. It is written in Python and can be generated as a payload in several different ways (Windows exe, Python file, PowerShell oneliner/file, Linux elf, APK, Rubber Ducky, etc.). Pupy is publicly available on GitHub.

ATT&CK S0192 1 actors documented 23 indicators

Sigma rules0 YARA rules2 Live IOCs23

◆

Actors Using This

chinaAPT10

⚊

Live Indicators

23 total

Indicators are defanged for safe handling. Newest first.

Show indicators (23)ip:port38[.]147[.]189[.]199:9001
ip:port168[.]144[.]36[.]228:443
ip:port172[.]104[.]57[.]250:443
ip:port172[.]104[.]57[.]250:9000
ip:port107[.]175[.]113[.]106:55
ip:port103[.]79[.]79[.]105:9001
ip:port172[.]86[.]107[.]196:443
ip:port176[.]31[.]71[.]168:443
ip:port34[.]64[.]98[.]201:443
ip:port34[.]64[.]98[.]201:8443
ip:port103[.]79[.]79[.]105:8444
ip:port64[.]190[.]113[.]161:443
ip:port18[.]167[.]174[.]198:443
ip:port45[.]150[.]198[.]28:443
ip:port38[.]147[.]189[.]199:443
ip:port103[.]27[.]186[.]185:443
ip:port143[.]42[.]74[.]25:443
ip:port35[.]201[.]196[.]246:443
ip:port64[.]176[.]73[.]125:443
ip:port172[.]86[.]109[.]7:443
ip:port168[.]144[.]36[.]228:9000
ip:port172[.]86[.]76[.]218:443
ip:port103[.]27[.]186[.]185:9001

Aliases

Pupy

Intelligence Graph · click any node to traverse

CVETechnique ActorTool Family

drag to reposition · click any node to traverse · button top-right enlarges

External lookups - second-class, for what we don’t hold ourselves

MITRE ATT&CK Malpedia MalwareBazaar ThreatFox

Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities

Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs

Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures

Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1

About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service

threatengine.sh · Open-source threat intelligence platform · 100+ authoritative sources · Every fact traces to its origin