bf090cf7078414c9e157da7002ca727f06053b39fa4e377f9a0050f2af37d3a2

Small Sieve Python backdoor payload 'index.exe' (PyInstaller-bundled Python 3.9) - hash published in Appendix B Table 3 of CISA AA22-055A. Beacons via the Telegram Bot API with hex byte-shuffling traffic obfuscation.

family

Small Sieve

first seen

Feb 23, 2022

publisher

CISA