CRIL researchers document widespread use of the open-source PySilon RAT by multiple threat actors, with VirusTotal reporting over 300 samples since June 2023. PySilon evolved from v1.0 (Dec 2022) to v3.6 (Aug 2023) and now offers extensive capabilities such as keystroke logging, data theft, screen and microphone capture, and remote command execution, often masquerading as legitimate software downloaded from phishing sites. #PySilon #PySilonRAT #CRIL #VirusTotal #GitHub #Discord #AdobePhotoshop.exe
Keypoints
- CRIL has identified open-source PySilon RAT usage by multiple threat actors, with VirusTotal showing 300+ samples since mid-2023.
- PySilon progressed from version 1.0 (Dec 2022) to version 3.6 (Aug 2023), adding advanced features.
- Many samples imitate software/cracks and are tied to phishing or free software download sites.
- The PySilon builder enables attackers to customize binaries and select capabilities via a GUI.
- Threat actors promote PySilon on forums and social channels, signaling rising adoption.
- Core capabilities include keystroke logging, data theft, remote command execution, screen capture, webcam and microphone access, and more.
MITRE Techniques
- [T1566] Phishing – This malware could reach users via phishing sites. ‘This malware could reach users via phishing sites.’
- [T1204] User Execution – The user needs to manually execute the malicious file downloaded from the phishing site. ‘The user needs to manually execute the malicious file downloaded from the phishing site.’
- [T1059] Command and Scripting Interpreter – cmd.exe are used to collect system information. ‘cmd.exe are used to collect system information.’
- [T1059.001] PowerShell – PowerShell command are used to add an exclusion path for Windows Defender. ‘PowerShell command are used to add an exclusion path for Windows Defender.’
- [T1047] Windows Management Instrumentation – WMIC command used to get system information. ‘WMIC command used to get system information.’
- [T1547.001] Registry Run Keys / Startup Folder – Malware adding run entry for persistence. ‘Malware adding run entry for persistence.’
- [T1497] Virtualization/Sandbox Evasion – Performing Anti-VM/Anti-Debug technique for evasion. ‘Performing Anti-VM/Anti-Debug technique for evasion.’
- [T1562.001] Disable or Modify Tools – The malware scans for VM and Debugger-related processes and terminates them. ‘The malware scans for VM and Debugger-related processes and terminates them.’
- [T1003] OS Credential Dumping – Malware attempts to dump credentials to obtain account login and credential. ‘Malware attempts to dump credentials to obtain account login and credential.’
- [T1056.001] Input Capture – The malware possesses the capability to engage in keylogging activities. ‘The malware possesses the capability to engage in keylogging activities.’
- [T1057] Process Discovery – The malware look out a specific processes to terminate. ‘The malware look out a specific processes to terminate.’
- [T1012] Query Registry – The malware is examining the registry to extract system details. ‘The malware is examining the registry to extract system details.’
- [T1082] System Information Discovery – The malware gathers system information through PowerShell, Command Prompt (cmd), and WMIC. ‘The malware gathers system information through PowerShell, Command Prompt (cmd), and WMIC.’
- [T1518.001] Security Software Discovery – The malware is searching for processes associated with virtual machines and debuggers to forcibly terminate. ‘The malware is searching for processes associated with virtual machines and debuggers to forcibly terminate.’
- [T1005] Data from Local System – The malware collects sensitive data from victim’s system. ‘The malware collects sensitive data from victim’s system.’
- [T1071] Application Layer Protocol – TCP is used by the malware to interact with the C&C server. ‘TCP is used by the malware to interact with the C&C server.’
- [T1105] Ingress Tool Transfer – The malware has ability to download files from C&C. ‘The malware has ability to download files from C&C’
Indicators of Compromise
- [Hash] MD5 – 257719c0fb80ef287143fa5b76f9c21f, 210d9beb06bfd931cd493a2f403a1a89fed1fbc6 – PySilon RAT (Adobe Photoshop.exe)
- [Hash] SHA256 – 150e92f301e0bcf4e401be5d21c48ad89dbb12522870fd2a9a2deb3dd818a239 – PySilon RAT sample set
- [Hash] SHA256 – 34eaa3fc0a6bd30088b882805240a03f988ecbfdf89f248a3f87cd4599763eec – Similar PySilon RAT executables
- [File name] – Adobe Photoshop.exe, WinSecureInstaller.exe, Synapse Launcher.exe, Windows Defender.exe – PySilon samples masquerading as legitimate software
Read more: https://cyble.com/blog/emerging-threat-understanding-the-pysilon-discord-rats-versatile-features/