ClearFake / CastleLoader Abuses Paste-and-Run Techniques for Malware Delivery

Summary

The report examines the widespread use of ClearFake and the emergence of CastleLoader, a malware loader that relies on paste-and-run techniques. CastleLoader delivers multiple payload types, including RATs and infostealers, while abusing legitimate Python distributions through a Bring-Your-Own-Interpreter (BYOI) approach. The infection chain commonly begins with fake CAPTCHA prompts on compromised websites that trick users into running obfuscated commands.

Investigation

Researchers analyzed the CastleLoader infection chain and identified caret-obfuscated command lines along with portable Python interpreters disguised as PDF documents. The investigation showed how a secondary script applies triple-layer encoding before retrieving an RC4-encrypted payload. The malware was also observed using process injection to execute malicious code inside legitimate python.exe processes.

Mitigation

Organizations should implement controls that reduce unauthorized command execution through copy-paste actions and monitor for suspicious child processes launched by browsers or command interpreters. Restricting unapproved interpreter execution and detecting unusually frequent caret characters in CLI strings can help mitigate these attacks. Blocking known malicious domains associated with ClearFake and CastleLoader campaigns is also recommended.

Response

If suspicious caret-obfuscated commands or unexpected Python processes are detected, isolate the affected endpoint immediately to stop additional payload delivery. Perform memory forensics on the python.exe process to identify injected shellcode and recover C2 configuration data. Review web proxy logs for connections to known malicious domains to determine the scope and origin of the compromise.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary is attempting to deploy a loader (mimicking CastleLoader behavior). To evade detection by simple EDR string matching for “powershell” or “download”, the attacker uses the cmd.exe escape character (^) to break up the command. The goal is to execute a command that looks like powershell.exe -enc ... but is presented to the OS as p^o^w^e^r^s^h^e^l^l.exe. This targets the selection_pattern logic in the detection rule by using repetitive caret-character pairings.

• Regression Test Script:

  # Simulation script to trigger CastleLoader-style command obfuscation.
  # This uses the caret (^) to obfuscate the command string.
  
  Write-Host "[*] Starting Simulation: Obfuscated Command Execution"
  
  # Triggering selection_pattern: ([a-zA-Z0-9]^){2,}
  # This creates a pattern of char+caret repeated.
  cmd.exe /c "w^h^o^a^m^i"
  
  # Triggering selection_obfuscation: ^[^a-zA-Z0-9s]
  # This places a caret followed by a non-alphanumeric character.
  cmd.exe /c "dir ^!"
  
  Write-Host "[*] Simulation Commands Executed."

• Cleanup Commands:

  # No persistent artifacts are created by these commands.
  # Manual check to ensure no unexpected cmd.exe processes remain.
  Stop-Process -Name cmd -ErrorAction SilentlyContinue