The investigation was by Huntress published 2021-08-17. A user’s startup folder contained a suspicious file called “sysmon.lnk” which, upon investigation, was found to be executing a malicious Python script that injected a remote access Trojan (RAT) onto the system. Huntress places the RAT in the Ursu family with some caution, malware that Cisco Talos describes as generic malware that contacts a C2 server and injects code into the address space of legitimate processes. The payload consisted of six consecutive payloads and included new offensive tooling. One stage was likely built from ExecuteAssembly, an open-source C/C++ alternative to Cobalt Strike’s execute-assembly that loads .NET assemblies and can patch AMSI and ETW along the way. The analysis required custom scripts for de-obfuscation for the different stages. After extracting configuration from the RAT the deduced indicators of compromise (IOCs) showed 0 detections on VirusTotal (as of June 2021).
