Python-based PyRAT with Cross-Platform Capabilities and Extensive Remote Access Features
A Python-based remote access trojan has been identified, targeting both Windows and Linux systems with advanced surveillance and data theft functionalities.
A Python-based remote access trojan has been identified, targeting both Windows and Linux systems with advanced surveillance and data theft functionalities.
The malware establishes command-and-control communication via unencrypted HTTP channels, allowing attackers to execute commands, steal files, and capture screenshots remotely. Upon execution, it collects system details such as the operating system, hostname, and current username, which are then transmitted to the attacker's server.
Researchers from K7 Security Labs identified the malware as an ELF binary written entirely in Python during investigations on VirusTotal. It was packaged using PyInstaller version 2.1 with Python 2.7, disguising its malicious code within a seemingly legitimate executable.
The main entry point was found in a file named agent-svc.pyc , which contains the complete remote access functionality under a class called "Agent." The malware achieves persistence differently depending on the operating system:
Researchers from K7 Security Labs identified the malware as an ELF binary written entirely in Python during investigations on VirusTotal.
On Linux systems, it creates an autostart entry at ~/.config/autostart/dpkgn.desktop , using a name that mimics legitimate Debian package tools. On Windows systems, it adds a registry entry in the current user's Run key under the name "lee," ensuring automatic execution at startup.
The trojan communicates with its command server through HTTP POST requests, transmitting system data in plain JSON format. This design is susceptible to network monitoring and detection. It uses a semi-persistent identifier combining the victim's username with their MAC address, allowing tracking of individual infections.
Communication frequency varies based on activity, with idle periods having longer intervals and active sessions polling every half second for responsiveness.
The malware supports extensive file operations, including unrestricted uploads and downloads using multipart form-data encoding. It can enumerate directories, change working directories, and create ZIP archives for data exfiltration using DEFLATE compression. Screenshot capture is performed using PIL’s ImageGrab module, with images saved as JPEG files and uploaded automatically.
All operations run in separate threads, ensuring continuous availability for receiving new commands while executing existing tasks.
Based on reporting by Cyber Security News.