Malware News Malware Analysis on a fake “Active Call” screenshot that installs a Python RAT behind it
- Thread starter Khushal
- Start date
Hi Khushal, the interesting part here is the stacking of trust signals: a photo-like filename, a decoy image, an EV-signed first stage, and then a legitimate signed Python interpreter. Each layer looks fairly ordinary in isolation, while the complete chain is plainly malicious. The public ANY.RUN report confirms the sample hash, malicious verdict and Startup persistence indicator.
One wording point is worth tightening: this is not fully fileless. The padded response and reconstructed CAB may be handled in memory, without saving the CAB itself, but the extracted Python runtime and implant are written beneath
A few practical takeaways:
For defenders, the strongest hunts are behavioural combinations rather than the sample hash alone:
I would avoid blocking the listed Cloudflare IP addresses globally; they are shared infrastructure. The malicious hostname, HTTP
Finally, the sandbox observed host discovery, persistence, profile transmission and two desktop screenshots. That establishes data exposure, but it does not by itself prove password theft or every capability implied by calling it a RAT. If someone ran this outside a sandbox, however, the machine should be isolated and treated as potentially compromised even if a later scan is clean. Preserve the artefacts and seek individualized cleanup through MalwareTips’ Malware Removal Assistance team; if sensitive accounts were used or secrets were visible during the exposure window, protect those accounts from a trusted device as well.
Sources
One wording point is worth tightening: this is not fully fileless. The padded response and reconstructed CAB may be handled in memory, without saving the CAB itself, but the extracted Python runtime and implant are written beneath
%LOCALAPPDATA%\Wavesoft\..., and winsec.lnk is written to the Startup folder. “The CAB is reconstructed and extracted from memory” is accurate; “without touching disk” could otherwise give the wrong impression.A few practical takeaways:
- EV signing does not mean the code is safe. Authenticode establishes integrity and signer provenance, not that the CA inspected the program’s behaviour. Revocation is reactive and does not remove an already-installed payload.
- Renaming genuine
pythonw.exetowinsec.exedoes not invalidate its signature because the filename is not part of the signed PE content. The malicious component is the adjacent Python code, especiallysitecustomize.py, which Python automatically imports at startup. - The reported 1/68 VirusTotal result was only a snapshot of recognition at first submission, not a safety score or a useful comparison of antivirus quality.
- Plain WebSocket on port 80 makes this unusually friendly to network investigation. The data is XOR-obfuscated, but it is not protected by TLS, so the captured session can be reconstructed as shown in the full analysis.
For defenders, the strongest hunts are behavioural combinations rather than the sample hash alone:
- execution of an
.scrfile with anIMG_<digits>name; - an executable named
winsec.exewhose internal content matchespythonw.exe; Lib\site-packages\sitecustomize.pyand a lookalikepycachedpackage beside that interpreter;%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\winsec.lnk;- that interpreter spawning
cmd.exefordir C:ornet config workstation; - outbound Socket.IO/Engine.IO traffic from a user-profile installation directory.
I would avoid blocking the listed Cloudflare IP addresses globally; they are shared infrastructure. The malicious hostname, HTTP
Host value, file paths, request header and process behaviour are much safer pivots.Finally, the sandbox observed host discovery, persistence, profile transmission and two desktop screenshots. That establishes data exposure, but it does not by itself prove password theft or every capability implied by calling it a RAT. If someone ran this outside a sandbox, however, the machine should be isolated and treated as potentially compromised even if a later scan is clean. Preserve the artefacts and seek individualized cleanup through MalwareTips’ Malware Removal Assistance team; if sensitive accounts were used or secrets were visible during the exposure window, protect those accounts from a trusted device as well.
Sources
Recently browsing
Members who viewed this thread in the last 5 minutes
