The PyRAT Code: Internals of a Python-Based RAT

Summary

The article profiles PyRAT, a Python-based remote access trojan packaged as an ELF binary using PyInstaller. It runs on both Linux and Windows, communicates with a C2 server over unencrypted HTTP, and supports command execution, file exfiltration, screenshot capture, and a self-destruct routine. Persistence is implemented through XDG autostart on Linux and a Run registry key on Windows. The report emphasizes how lightweight the tool is and how easily it can be repurposed by cybercriminals.

Investigation

Researchers extracted the embedded Python bytecode with pyinstxtractor, decompiled the modules, and identified the primary Agent class that performs host fingerprinting, UID generation, thread management, and C2 coordination. Static analysis surfaced key imports, filenames, registry interaction, and the HTTP POST endpoint used for beaconing. Behavioral testing showed the full workflow: persistence creation, command execution, file enumeration, upload/download operations, ZIP archive creation, screenshot capture, and optional artifact cleanup.

Mitigation

Monitor for suspicious autostart .desktop files created in user profiles and for additions to the HKCU\Run registry key using unfamiliar executable names. At the network layer, watch for outbound HTTP POST traffic to unknown hosts targeting the /api/{uid}/hello endpoint. On endpoints, flag unknown ELF binaries containing embedded Python content and anomalous process behavior such as frequent subprocess execution.

Response

If detected, isolate the system, collect the ELF sample and any associated .desktop files, and preserve relevant registry state. Extract the UID, C2 address, and any files transferred during execution as part of forensics. Block the identified C2 infrastructure, remove persistence, and complete a full cleanup. Rotate credentials for accounts that may have been exposed.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:

  An attacker has obtained a compromised SSH credential for a regular user. After login, they execute a living‑off‑the‑land script that:

  1. Writes the malicious ELF payload (agent-svc.pyc) to the user’s home directory, disguising it as a Python byte‑code file while it is actually an ELF binary.
  2. Copies a masqueraded Debian‑package tool named dpkgn into /usr/local/bin, granting it executable rights. The tool is a thin wrapper that simply launches the ELF payload.
  3. Installs a autostart desktop entry (dpkgn.desktop) into ~/.config/autostart so the payload runs on every graphical session start.
  4. Sets appropriate permissions to avoid immediate suspicion.

  The combined file events (agent-svc.pyc and dpkgn) satisfy the rule’s first condition, while the .desktop file satisfies the second condition.

• Regression Test Script:

  #!/usr/bin/env bash
  set -euo pipefail
  
  # 1. Deploy malicious ELF disguised as .pyc
  MALWARE_PATH="$HOME/agent-svc.pyc"
  echo "Creating fake ELF payload (dummy binary) ..."
  dd if=/dev/zero bs=1 count=1024 of="$MALWARE_PATH" status=none
  chmod +x "$MALWARE_PATH"
  
  # 2. Deploy fake Debian tool named dpkgn
  FAKE_TOOL="/usr/local/bin/dpkgn"
  echo "#!/usr/bin/env bash" | sudo tee "$FAKE_TOOL" > /dev/null
  echo "exec "$MALWARE_PATH" "$@"" | sudo tee -a "$FAKE_TOOL" > /dev/null
  sudo chmod +x "$FAKE_TOOL"
  
  # 3. Create autostart desktop entry
  AUTOSTART_DIR="$HOME/.config/autostart"
  mkdir -p "$AUTOSTART_DIR"
  DESKTOP_FILE="$AUTOSTART_DIR/dpkgn.desktop"
  cat > "$DESKTOP_FILE" <<EOF
  [Desktop Entry]
  Type=Application
  Exec=$FAKE_TOOL
  Hidden=false
  NoDisplay=false
  X-GNOME-Autostart-enabled=true
  Name=Package Manager
  Comment=System Update Service
  EOF
  
  echo "PyRAT persistence artifacts deployed."

• Cleanup Commands:

  #!/usr/bin/env bash
  set -euo pipefail
  
  # Remove malicious ELF
  rm -f "$HOME/agent-svc.pyc"
  
  # Remove fake tool
  sudo rm -f /usr/local/bin/dpkgn
  
  # Remove autostart entry
  rm -f "$HOME/.config/autostart/dpkgn.desktop"
  
  echo "Cleanup completed."