Cybersecurity researchers from Securonix have recently discovered a new Python-based malware that’s capable of stealing files and logging keystrokes from affected endpoints.
Dubbed PY#RATION, the malware is apparently being actively developed, with the researchers spotting multiple versions since August 2022. The malware uses the WebSocket protocol to reach out to the command & control (C2) server, get instructions, and potentially extract sensitive data.
Securonix say the malware leverages Python’s built-in Socket.IO framework, which provides features to both client and server WebSocket communication. The malware uses this channel to pull data and receive commands, the advantage of WebSocket, the publication claims, is that it allows the malware to receive and send data over a single TCP connection, via commonly open ports, at the same time.
PY#RATION’s features include, among others, network enumeratiTo distribute the malware, the attackers are using the good old phishing email. The email comes with a password-protected .ZIP archive which, when unpacked, delivers two shortcut files, designed to look like image files – front.jpg.lkn, and back.jpg.lnk.
The “front” and “back” file names refer to the front and the back of a non-existent driver’s license. If the victims click the files, they’ll get two more files downloaded from the internet – front.txt and back.txt. These are later renamed to .bat files and executed.
The malware itself tries to disguise itself as Cortana, Microsoft’s virtual assistant, to discourage its removal from the system.
