Full Report
Join us on a threat analysis journey as we discover a very shady Python—and a very friendly RAT.
Analysis Summary
# Tool/Technique: IronPython-based Malware Loader & PureRAT
## Overview
This threat involves a multi-stage infection chain (six consecutive payloads) starting with a malicious shortcut file (`.lnk`) that leverages a renamed **IronPython** interpreter. IronPython is a legitimate branch of Python that integrates with the .NET framework, allowing the attacker to execute Python scripts with deep Windows OS access. The ultimate goal of this loader was the injection of a remote access Trojan (RAT), identified as **PureRAT**.
## Technical Details
- **Type:** Malware Loader / Remote Access Trojan (RAT)
- **Platform:** Windows
- **Capabilities:** Persistence, Obfuscation, .NET/PowerShell integration, Remote Access, Information Stealing.
- **First Seen:** June 2021 (Reported August 2021)
## MITRE ATT&CK Mapping
- **[TA0003 - Persistence]**
- [T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder]
- **[TA0002 - Execution]**
- [T1059.006 - Command and Scripting Interpreter: Python]
- **[TA0005 - Defense Evasion]**
- [T1036.003 - Masquerading: Rename System Utilities] (Renaming IronPython to `ctfmon.exe`)
- [T1027 - Obfuscated Files or Information]
- **[TA0011 - Command and Control]**
- [T1219 - Remote Access Software] (PureRAT)
## Functionality
### Core Capabilities
- **Renamed Interpreter:** Uses a renamed version of `ipy.exe` (IronPython) called `ctfmon.exe` to bypass basic detection filters looking for Python or PowerShell.
- **Persistence:** Places a shortcut file (`sysmon.lnk`) in the Windows Startup directory to ensure the loader runs upon every user login.
- **.NET Interoperability:** Because it uses IronPython, the scripts can directly invoke .NET namespaces, enabling complex Windows API calls.
### Advanced Features
- **Multi-Stage Loading:** Utilizes six different stages of scripts/payloads to increase the difficulty of analysis and bypass security products.
- **PureRAT Integration:** The final stage delivers PureRAT, a commodity .NET-based RAT capable of file management, keylogging, and remote shell access.
- **Environmental Awareness:** The Python scripts are designed to interact with the filesystem and registry to hide the RAT's configuration.
## Indicators of Compromise
*Note: Some hashes were reported as having 0 detections on VirusTotal at the time of analysis.*
- **File Names:**
- `sysmon.lnk` (in Startup folder)
- `ctfmon.exe` (Renamed IronPython interpreter)
- `update.py` (Stage 1 script)
- **Directory Paths:**
- `C:\Users\<user>\AppData\Roaming\PpvcbBQh\`
- **Network Indicators:**
- `193[.]161[.]193[.]99` (C2 IP Address - defanged)
- **Behavioral Indicators:**
- `ctfmon.exe` executing `.py` files from unusual directories.
- Unexpected files appearing in `%APPDATA%\Roaming\Microsoft\Windows\Start Menu\Programs\Startup`.
## Associated Threat Actors
- While specific named groups (like APTs) were not linked in this report, the toolset aligns with evolving cybercriminals shifting from custom Python stealers to **PureRAT** (commodity .NET malware).
## Detection Methods
- **Signature-based:** Monitoring for the specific hash of the renamed IronPython interpreter.
- **Behavioral detection:**
- Identifying non-standard processes (e.g., `ctfmon.exe` located in `AppData`) passing script arguments.
- Alerting on the creation of `.lnk` files in the Startup directory that point to interpreters (Python, PowerShell, CMD).
- **YARA:** Target the unique strings within the multi-stage Python scripts and the PureRAT .NET binary.
## Mitigation Strategies
- **Folder Restrictions:** Use AppLocker or Software Restriction Policies (SRP) to prevent executable files (including Python interpreters) from running out of `%APPDATA%` or `%TEMP%` directories.
- **Startup Monitoring:** Monitor and alert on changes to the `\Startup\` folder and relevant `Run` registry keys.
- **Interpreter Control:** If IronPython or standard Python is not required for business operations, block or audit their execution.
## Related Tools/Techniques
- **IronPython:** The underlying framework used for the loader.
- **PureRAT:** The final stage payload.
- **AsyncRAT / Warzone RAT:** Similar commodity .NET RATs mentioned as part of the broader threat landscape.