Fake RVTools Installer Deploys Modular Python RAT
Summary
A malicious MSI impersonating RVTools, signed with a subsequently revoked Sectigo certificate, uses embedded VBScript and hidden PowerShell to download a WinPython bundle and deploy a modular Python RAT with AD reconnaissance, persistence and encrypted C2.
Key points
- The analyzed MSI impersonates RVTools and contains an embedded VBScript custom action; the article says its Sectigo code-signing certificate was valid at delivery and has since been revoked.
- Obfuscated VBScript launches hidden PowerShell, which downloads a WinPython archive from Dropbox and runs staged Python payloads.
- collector.py gathers host, network, privilege and Active Directory information, staging it in configA.json.
- Pmanager.py establishes persistence using Registry Run keys and a scheduled task, and supports remote command execution.
- The RAT encrypts and compresses staged data before sending it to one of five hardcoded C2 IP addresses; it checks in every 300 seconds and retries more frequently after connection failures.
- The article provides filenames and file hashes for the MSI and Python/VBScript components. Its technical analysis describes malware capabilities, not independently confirmed victim compromise.
Article Details
- Attack Vectors
- A malicious MSI impersonating RVTools was distributed with a valid code-signing certificate and an EULA to appear legitimate.
- An MSI custom action executed an embedded, obfuscated VBScript, which launched hidden PowerShell to download and extract a payload archive from Dropbox.
- The archive deployed a portable WinPython environment containing reconnaissance and RAT components.
- The malware collected host, network, privilege, and Active Directory information, then staged it in configA.json.
- The RAT used Registry Run keys and a scheduled task for persistence, and encrypted staged data before sending it to hardcoded C2 IP addresses over HTTP POST.
- Defensive Notes
- The article notes that certificate revocation provides limited protection where real-time OCSP or CRL checks are not enforced at execution time.
- The reported chain makes signed MSI installers, embedded scripts, hidden PowerShell activity, Registry Run entries, scheduled tasks, and recurring outbound connections relevant behaviors to monitor.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| MD5 | 01a115c6f6ba3837234202a1e0d28bdc | Hash listed for the malicious Binary.MyScript.vbs loader. |
| MD5 | 64bda120cb447e0c03f451190022a57b | Hash listed for the malicious MSI installer. |
| MD5 | 71085940124ad3c035a181acadc10362 | Hash listed for the malicious Pmanager.py RAT component. |
| MD5 | 9192d18a955a9d03e2c70b60aac1784a | Hash listed for the malicious collector.py reconnaissance component. |
| SHA256 | d0f5e98fb840fb5656d3f50613b6f1ec60e57392643159841bc1fa95396087a4 | Malicious MSI installer hash shown in the IOC table and VirusTotal reference URL. |
MITRE ATT&CK
T1016 · System Network Configuration DiscoveryThe malware collected network connections and used the host MAC address and hostname to create a tracking identifier.T1018 · Remote System DiscoveryThe malware queried Active Directory for computer objects to determine the size of the domain environment.T1027 · Obfuscated Files or InformationThe VBScript encoded commands as decimal values, and Python components used obfuscated function and variable names.T1036 · MasqueradingThe malicious MSI impersonated the legitimate RVTools installer and used an EULA to appear trustworthy.T1041 · Exfiltration Over C2 ChannelThe RAT sent encrypted reconnaissance data to attacker infrastructure as HTTP POST traffic.T1053.005 · Scheduled TaskPmanager.py created a daily scheduled task to run the malware after reboot.T1059.001 · PowerShellThe VBScript launched hidden PowerShell to download and execute the payload.T1059.005 · Visual BasicAn embedded VBScript loader initiated the first stage of the infection.T1069.001 · Local GroupsThe malware checked whether the user belonged to BUILTINAdministrators.T1071.001 · Web ProtocolsThe RAT used HTTP POST requests for C2 communication with hardcoded IP addresses.T1082 · System Information Discoverycollector.py gathered host details including hostname, privileges, processes, and installed services.T1105 · Ingress Tool TransferHidden PowerShell downloaded the malicious winp.zip archive from Dropbox.T1218.007 · MsiexecThe MSI used a custom action to invoke the VBScript embedded in its Binary table.T1547.001 · Registry Run Keys / Startup FolderPmanager.py created a Windows Registry Run entry to maintain persistence.T1573.001 · Symmetric CryptographyThe RAT used RC4 to encrypt reconnaissance data and decrypt incoming C2 commands.
People
Vendors
Products
Microsoft Defender SmartScreenThe MSI was signed with a valid Sectigo code-signing certificate tied to Xiamen Lunwei Huage Network Co., Ltd., helping it bypass SmartScreen and security trust checks.Microsoft Windows[T1070.004 ] File Deletion: File Deletion by Windows Installer – The installer used reboot and artifact-cleaning messaging to conceal ongoing activity (‘appears to be meant for “cleaning installation artifacts” butPowerShellA fake RVTools MSI installer was distributed with a valid Sectigo code-signing certificate and used to deploy a modular Python RAT via VBScript, PowerShell, Dropbox, and staged payloads.RVToolsA fake RVTools MSI installer was distributed with a valid Sectigo code-signing certificate and used to deploy a modular Python RAT via VBScript, PowerShell, Dropbox, and staged payloads.VMwareThe campaign targeted VMware administrators and used persistence, reconnaissance, and encrypted C2 traffic to maintain access and steal data.WinPythonThe attack used a multi-stage chain: embedded VBScript in the MSI, hidden PowerShell, a Dropbox download, and a WinPython-based payload archive.