Huntress Traces Six-Stage Python Loader to Likely URSU RAT
Summary
Huntress traced a startup-folder shortcut through six payload stages to a likely URSU RAT, documenting its process-hollowing loader, anti-analysis checks, persistence, and command-and-control capabilities.
Key points
- The investigation began with sysmon.lnk in a Windows startup folder, which launched a renamed IronPython interpreter, ctfmon.exe, with update.py.
- Analysts decoded six payload stages, including loaders that used process hollowing to target msbuild.exe and a stage containing an AMSI-patching script.
- The final .NET payload was assessed as likely belonging to the URSU RAT family; it could collect system information and download files, commands, or plugins from C2 servers.
- The RAT checked for virtual machines, debugging and sandbox indicators, small disks, and Windows XP, and terminated if a check was triggered.
- It established persistence through an elevated scheduled task when admin privileges were available, or a batch file in the current user's Run key otherwise.
- Huntress identified three C2 domains: windowsupdatecdn[.]cn, gjghvga7ffgb[.]xyz, and huugbbvuay4[.]cn.
- Recommended defenses included reviewing startup-folder, Run-key, and scheduled-task activity; monitoring Python files launched by unexpected executables and unusual msbuild.exe activity; and combining manual analysis with automated tooling.
Article Details
- Attack Vectors
- A sysmon.lnk shortcut in the user's Startup folder launched a renamed IronPython interpreter, ctfmon.exe, with update.py as an argument.
- The Python loader used Base64 decoding, byte manipulation, custom encoding, and Gzip decompression across multiple payload stages.
- A .NET payload used process hollowing to inject code into msbuild.exe.
- The final RAT established persistence through scheduled tasks when running with admin privileges, or a batch file in the user's Run key with standard user privileges.
- The RAT contacted configured C2 servers and could download malware through PowerShell or download and load a remote DLL.
- Defensive Notes
- Review suspicious files in Startup folders, Run keys, and scheduled-task locations.
- Monitor process-creation events where Python files are passed to executables that are not Python interpreters or text editors.
- Baseline expected processes that launch msbuild.exe and alert on unexpected launches.
- Use manual analysis and decoding alongside automated tools; do not rely solely on static signatures, VirusTotal, or online sandboxes.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | gjghvga7ffgb[.]xyz | One of three domains extracted from the RAT configuration and identified as a C2 server. |
| DOMAIN | huugbbvuay4[.]cn | One of three domains extracted from the RAT configuration and identified as a C2 server. |
| DOMAIN | windowsupdatecdn[.]cn | One of three domains extracted from the RAT configuration and identified as a C2 server. |
| SHA256 | 169f5dbcd664c0b4fd65233e553ff605b30e974b6b16c90a1fb03404f1b01980 | Hash listed for stage6, identified in the analysis as the final RAT payload. |
| SHA256 | 2ccadfc32db49e67e80089f30c81f91dfff4b20b8fc61714df9e2348542007fd | Hash listed for stage2, a decoded payload in the malware chain. |
| SHA256 | 4417298524182564aed69261b6c556bdce1e5b812edc8a2addfc21998447d3c6 | Hash listed for stage4, a loader payload in the malware chain. |
| SHA256 | 4591eda045e3587a714bb11062eb258f82ee6f0637e6aa4d90f2d0b447a48ef7 | Hash listed for stage3, a decoded executable payload in the malware chain. |
| SHA256 | 9b775dfc58b5f82645a3c3165294d51c18f82ec1b19ac8a41bb320bee92484ed | Hash listed for stage5, a decoded payload in the malware chain. |
| SHA256 | dd1fa3398a9cb727677501fd740d47e03f982621101cc7e6ab8dac457dca9125 | Hash of update.py, the malicious Python loader used in the infection chain. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe loader chain obfuscated payloads with Base64, byte manipulation, custom encoding, and compression.T1047 · Windows Management InstrumentationThe malware used WMI queries to gather information from the operating system.T1053.005 · Scheduled TaskThe malware created an elevated scheduled task for persistence when admin privileges were available, and also used a scheduled task to force a restart.T1055.012 · Process HollowingA .NET payload used ZwUnmapViewOfSection to hollow the msbuild.exe process and inject the decoded payload.T1059.001 · PowerShellThe RAT's Update command downloaded new malware via PowerShell and started it.T1082 · System Information DiscoveryThe malware gathered system information, including operating-system-related details.T1105 · Ingress Tool TransferThe RAT could download new malware and a remote DLL from its C2 servers.T1497.001 · System ChecksThe RAT checked for VMware or VirtualBox hardware descriptions, a small disk, and Windows XP to detect analysis environments.T1518.001 · Security Software DiscoveryThe malware enumerated installed antivirus and security products.T1547.001 · Registry Run Keys / Startup FolderThe malware used a Startup-folder shortcut for persistence and later wrote a batch file to the current user's Run key.T1562.001 · Disable or Modify ToolsA payload contained an AMSI patching script intended to reduce detection of malicious PowerShell activity.T1620 · Reflective Code LoadingThe analysis describes a stage loading decoded code into memory using reflection, and a later loader with a ReflectiveLoader export.T1622 · Debugger EvasionThe malware checked the debugger-attached flag and for dnspy.xml as anti-analysis checks.
People
Malware
Products
IronPythonThe information suggested that ctfmon.exe is a renamed Python interpreter—specifically, an IronPython interpreter, which utilizes a branch of Python with access to .NET libraries. This allows Python code to access deepMicrosoft Windowsc:\\users\<username>\appdata\roaming\microsoft\windows\startmenu\programs\startup\sysmon.lnkMSBuild.exeTowards the end of the encoded data, we also observed a reference to msbuild.exe.PowerShellThis allows Python code to access deep Windows OS functionality typically reserved for .NET or PowerShell. This was interesting and provided enough information to confidently move on to the Python file.
Tools
CyberChefBy copying out the obfuscated string and recreating the logic in CyberChef, we were able to retrieve another Python script—which we saved and named as stage2.py. The decoding logic can be seen below:Detect It EasySaving stage3 as an executable file, we were able to do some basic inspection using PeStudio and Detect-It-Easy (DIE). This quickly led us to the conclusion that this was a .NET file and likely another stager (based ondnSpyBelow, we can see that DIE recognized the file as a .NET executable, which meant we could use Dnspy or ILspy for analysis.ILSpyBelow, we can see that DIE recognized the file as a .NET executable, which meant we could use Dnspy or ILspy for analysis.PEStudioBelow, we can see the file description, indicating that it was a renamed IronPython interpreter. Alternatively, we could have also discovered this information using PeStudio or a similar tool.