PixyNetLoaderMalware
Last reported 8 months ago, by Zscaler ThreatLabz1 report
ATT&CK techniques
6 of 24 · each with the sentence it comes from- T1027Obfuscated Files or Information
“Defense Evasion, Obfuscated Files or Information: Dynamic API Resolution”
- T1027.003Steganography
“T1027.003”
- T1027.007Dynamic API Resolution
“T1027.007”
- T1027.009Embedded Payloads
“All the embedded payloads are encrypted using a 0x47 byte long rolling XOR key: shfioehh243t3dcwechortjbo6k7pjl8lop7ku45ht3u4grywefdyehriobjojko5k65iyh.”
- T1053Scheduled Task/Job
“Execution, Scheduled Task/Job: Scheduled Task”
- T1053.005Scheduled Task
“T1053.005”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
APT28 Leverages CVE-2026-21509 in Operation Neusploit“We analyze the capabilities of the resulting tools, including MiniDoor, PixyNetLoader, and a Covenant Grunt implant, along with their command-and-control (C2) communications.”
Indicators in its reports
named in the reports above- 95e59536455a089ced64f5af2539a449in 1 report
- 4592e6173a643699…30330d16fe08in 1 report
- b2ba51b4491da860…4ac42010b546in 1 report
- 2f7b4dca1c79e525aef8da537294a6c4in 1 report
- c4799d17a4343bd3…248b99295d4din 1 report
- 1ed863a32372160b…4eea69807f50in 1 report
- 4727582023cd8071a6f388ea3ba2feaain 1 report
- d788d85335e20bb1…29d36083dddcin 1 report
- 5a17cfaea0cc3a82…61e0a0a6ec02in 1 report
- d47261e52335b516a777da368208ee91in 1 report
- c8c84bf33c05fb3a…b73649b93dcein 1 report
- fd3f13db41cd5b44…e71cbf07436bin 1 report
- 7c396677848776f9824ebe408bbba943in 1 report
- d577c4a264fee270…b89f714972a5in 1 report
- c91183175ce77360…927be4c7607fin 1 report
- f3b869a8d5ad243e35963ba6d7f89855in 1 report
- c1b272067491258e…82d157aaf90ain 1 report
- a944a09783023a2c…270861c2a8eein 1 report
- f05d0b13c633ad889334781cf4091d3ein 1 report
- 7bbb530eb77c6416…e49bd084465cin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.