New stealthy Python RAT malware targets Windows in attacks

guest · Jan 25, 2023

By Bill Toulas @billtoulas - January 25, 2023

A new Python-based malware has been spotted in the wild featuring remote access trojan (RAT) capabilities to give its operators control over the breached systems.
Click to expand...

Named PY#RATION by researchers at threat analytics company Securonix, the new RAT uses the WebSocket protocol to communicate with the command and control (C2) server and to exfiltrate data from the victim host.

A technical report from the company analyzes how the malware works. The researchers note that the RAT is actively developed as they've seen multiple versions of it since August when the PY#RATION campaign started.
Click to expand...

Distribution via shortcut files
The PY#RATION malware is distributed via a phishing campaign that uses password-protected ZIP file attachments containing two shortcut .LNK files disguised as images, namely front.jpg.lnk and back.jpg.lnk.

When launched, the shortcuts victim sees the front an back of a driver's license. However, malicious code is also executed to contact the C2 (Pastebin in later attacks) and download two .TXT files ('front.txt' and 'back.txt') which are eventually renamed to BAT files to accommodate the malware execution.
Click to expand...

Stealthy PY#RATION RAT
The malware delivered to the target is a Python RAT packed into an executable using automated packers like 'pyinstaller' and 'py2exe,' which can convert Python code into Windows executables that include all the libraries required for its execution.

This helps the malware evade detection, and according to Securonix's tests, version 1.6.0 of the payload deployed undetected by all but one antivirus engine on VirusTotal.
Click to expand...

Securonix researchers say that the malware "leverages Python's built-in Socket.IO framework, which provides features to both client and server WebSocket communication." This channel is used for both communication and data exfiltration.

The advantage of WebSockets is that the malware can simultaneously receive and send data from and to the C2 over a single TCP connection using ports commonly left open in networks like 80 and 443.
Click to expand...

Securonix Security Advisory: Python-Based PY#RATION Attack Campaign Leverages Fernet Encryption and Websockets to Avoid Detection

By D. Iuzvyk, T. Peck, O. Kolesnikov - January 24, 2023
The Securonix Threat Research Team has identified a new Python-based attack campaign (tracked by Securonix as PY#RATION) in the wild. The malware exhibits remote access trojan (RAT) behavior, allowing for control of and persistence on the affected host. As with other RATs, PY#RATION possesses a whole host of features and capabilities, including data exfiltration and keylogging. What makes this malware particularly unique is its utilization of websockets for both command and control (C2) communication and exfiltration as well as how it evades detection from antivirus and network security measures.
Click to expand...

Log in or Sign up

New stealthy Python RAT malware targets Windows in attacks

guest Guest

Log in or Sign up

New stealthy Python RAT malware targets Windows in attacks

guest Guest

Useful Searches