PY#RATION

Initial infection of PY#RATION begins with a phishing email containing a malicious attachment .zip file, documents.zip in our case for v1.6.0.

Initial infection of PY#RATION begins with a phishing email containing a malicious attachment .zip file, documents.zip in our case for v1.6.0. The zip file is password protected.

The “Command” class. This allows the attacker to interact with the system by issuing shell commands.

The files are then renamed to .bat files and then executed... Malicious VB script is then echoed into another file, “c.txt” in our case. Wscript.exe is then called to execute the newly built file.

Malicious VB script is then echoed into another file, “c.txt” in our case. Wscript.exe is then called to execute the newly built file.

Once the zip file is extracted, the user is presented with two convincing .lnk files disguised as the two .jpg files. When executed by the user a front and back image of a seemingly valid UK driver’s license is displayed along with the malicious code.

Persistence is established by dropping CortanaAssist.bat into the local user’s startup directory “ %appdata%/Microsoft/Windows/Start Menu/Programs/Startup/CortanaAssist.bat ”

Contained inside the zip file are two shortcut (.lnk) files that reference two corresponding files located on a remote C2 server, front.jpg(.lnk) and back.jpg(.lnk).

Persistence is established by dropping CortanaAssist.bat into the local user’s startup directory “ %appdata%/Microsoft/Windows/Start Menu/Programs/Startup/CortanaAssist.bat ”

Contained inside the zip file are two shortcut (.lnk) files that reference two corresponding files located on a remote C2 server, front.jpg(.lnk) and back.jpg(.lnk).

The 1.6.0 version’s main Python code was also hidden behind a trivial layer of fernet... This helps attackers reduce the ability for AV detections to trigger on anything malicious as it masked many easily identifiable strings

Next, the Microsoft utility certutil.exe is leveraged to decode “unrar.cert” into the exe file “unrar.exe” which is then executed

It is also apparent that new features and anti-evasion techniques have since been introduced into the later versions.

The not-so-subtle “ KeyRecorder ” class does just as the name suggests — it acts as a keylogger that lets the attacker record the victim’s keystrokes

After analyzing the source code, we can determine that the PY#RATION malware contains the following additional functionalities... Password/cookie extraction from browser stores

another Python-based Infostealer malware, which grabs and extracts local PC data including browser credential stores... In this case, browser data is recorded, parsed and sent out to C2

The configuration parameter IN_NETWORK_SCAN is also new and makes use of the Python class NetworkScanner, which as its name suggests, attempts to probe the surrounding network for IPs and ports.

Other classes allow for general enumeration which provides system information and antivirus protection status.

The “ actions ” class gives the attacker the ability to transfer files from host to C2 or vice versa.

It is also apparent that new features and anti-evasion techniques have since been introduced into the later versions.

The not-so-subtle “ KeyRecorder ” class does just as the name suggests — it acts as a keylogger that lets the attacker record the victim’s keystrokes

After analyzing the source code, we can determine that the PY#RATION malware contains the following additional functionalities... Clipboard stealer

The executable “ctask.exe” is then executed... Persistence is established... After executing the 1.0 version of the malware, the attackers downloaded an additional executable, “one.exe”... another Python-based Infostealer malware, which grabs and extracts local PC data including browser credential stores, cryptocurrency wallets, and user and system data.

What makes this malware particularly unique is its utilization of websockets for both command and control (C2) communication and exfiltration... The PY#RATION malware leverages Python’s built in Socket.IO framework

When the shortcut is executed, the remote server is contacted to download two additional files to the user’s temp directory.

The malware exhibits remote access trojan (RAT) behavior, allowing for control of and persistence on the affected host.

The malware exhibits remote access trojan (RAT) behavior... including data exfiltration... utilization of websockets for both command and control (C2) communication and exfiltration