{
  "family": "pycrypter",
  "sample_count": 1,
  "category": "ransomware",
  "description": "<h3>Executive Summary</h3>\nPyCrypter is a classification for file-encrypting Ransomware written entirely in Python. While traditionally ransomware was written in C++ or Delphi for speed and low-level system access, the use of Python (often compiled into a standalone executable using tools like PyInstaller or py2exe) has become increasingly common. It allows for rapid development, easy cross-platform porting, and occasionally bypasses older AV engines that struggle to decompile packaged Python scripts.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nPyCrypter is typically distributed via targeted spear-phishing campaigns, malicious macros embedded in Office documents, or deployed directly by attackers who have compromised external-facing RDP servers.\n\nUpon execution, PyCrypter leverages Python's extensive standard library for its attack:\n<ul>\n<li><strong>Standalone Execution:</strong> The malware is usually packaged as a bulky `.exe` file. When run, it extracts a temporary Python interpreter and the malicious `.py` scripts into the `%Temp%` directory to execute.</li>\n<li><strong>Cryptographic Implementation:</strong> PyCrypter typically utilizes well-known Python cryptography libraries (like `cryptography` or `PyCryptodome`) to implement strong encryption (e.g., AES-256 for files, secured by an RSA public key). </li>\n<li><strong>Volume Shadow Copy Deletion:</strong> The Python script will utilize the `os.system` or `subprocess` modules to execute native Windows commands (like `vssadmin delete shadows`) to destroy local backups before encryption begins.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nDespite being written in a high-level scripting language, PyCrypter is highly destructive. It represents a critical tier-one security incident resulting in an immediate loss of data availability. The use of Python also makes the malware easily modifiable by different threat actors, leading to numerous distinct variants.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Severance:</strong> Isolate the infected endpoint (and any servers it can reach) from the network to halt the spread of the encryption across mapped drives.</li>\n<li><strong>Reverse Engineering Potential:</strong> Because it is written in Python, incident responders may occasionally be able to decompile the executable (using tools like `uncompyle6`) to recover the source code. In rare cases of poor cryptographic implementation, this might reveal a hardcoded key or a flaw allowing for decryption.</li>\n<li><strong>Restore from Offline Backups:</strong> Paying the ransom is strongly discouraged. Eradication requires a complete bare-metal wipe of the infected infrastructure and a full restoration from secure, offline backups.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Ransom.PyCrypter",
    "Python.Ransomware",
    "Win32/Filecoder.Python"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1486",
    "T1490",
    "T1059.006"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-02T06:54:00Z",
  "type": "Ransomware (Python-based)",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}