Skip to content

Malware

PIEHOP

According to Mandiant, PIEHOP is a disruption tool written in Python and packaged with PyInstaller version 2.1+ that has the capability to connect to a user supplied remote MSSQL server for uploading

PIEHOP is a Windows malware family.

Background

Per Mandiant, PIEHOP is a Python-based disruption tool bundled with PyInstaller version 2.1+ that can connect to a user-specified remote MSSQL server to upload files and send remote commands to an RTU. Its main function is meant to be invoked from another Python file using either control=True or upload=True, and it always requires the oik, user, and pwd arguments; when run with control=True it additionally needs iec104.


Source: Malpedia (Fraunhofer FKIE).