Loading malware…
Pupy RAT is an open-source, cross-platform remote administration tool used maliciously as a remote access trojan. Also detected as Backdoor.Patpoopy, it incorporates Python and C components and provides remote command execution, data theft, additional module retrieval, and deployment of further malware. Attackers can use it for post-compromise operations and lateral movement. Its reflective-loading functionality supports executing portable executable payloads in memory, helping evade detection. Pupy RAT has also been associated with virtual-machine fingerprinting.
Observed Windows delivery campaigns use phishing emails containing ISO attachments with a malicious shortcut, a legitimate Microsoft-signed Windows Error Reporting executable, an attacker-controlled DLL, and a decoy spreadsheet. The shortcut launches the legitimate executable, which sideloads the malicious DLL. The loader decrypts an embedded payload using RC4, executes Pupy RAT in memory, and opens the spreadsheet to distract the victim while the RAT attempts background command-and-control communication.
Pupy RAT is a commodity tool used by multiple threat actors, including the Iranian espionage groups APT33, APT34, and APT35. Its public availability and use by different operators limit attribution based on the malware alone.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Additionally, both APT34 and APT35 have leveraged Pupy RAT in their campaigns.
Additionally, both APT34 and APT35 have leveraged Pupy RAT in their campaigns.
This blog describes how threat actors use the legitimate WerFault.exe to execute Pupy RAT on the victims’ machine.
16 distinct techniques documented for this family, organized by ATT&CK tactic.
The victim starts the infection chain by clicking on the shortcut file, which uses 'scriptrunner.exe' to execute WerFault.exe.
This PowerShell script, seen in Figure 5, appears to have been generated by Metasploit’s “web_delivery” module to download and execute a payload from a remote server at 45.76.128[.]71, which we speculate was used to create a meterpreter session on the system.
The ISO contains four files, a legitimate WerFault.exe, a malicious DLL named faultrep.dll, a shortcut file named recent inventory & our specialties.lnk and a XLS file named File.xls. The shortcut file has the same name as the ISO image.
This RAT is loaded into the memory and executed while WerFault.exe was executing in the front.
On further analysis we found the RC4 decryption function which contains the data and hard coded string as key... After decrypting the data, we confirmed that the data is a PE file with the magic bytes.
When the victim opens that shortcut file, it uses scriptrunner.exe LOLBin via cmd to execute WerFault.exe from the ISO.
В MITRE ATT&CK скрытые каналы покрывают сразу несколько тактик: Command and Control - DNS (T1071.004 ...). ... DNS tunneling (T1071.004, Command and Control ...) эксплуатирует штатный механизм рекурсивного разрешения имён.
5 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Cited as a background example of an open-source remote access trojan used by APT34 and APT35, not as a component of the Chaos RAT attacks.
Remote access trojan mentioned in relation to historical DNS tunneling lookups on infrastructure later used by the CapraRAT campaign; no clear campaign linkage established.
An open-source cross-platform remote access tool executed from memory via a side-loaded loader. In this case it was decrypted from overlay data using RC4, reflectively loaded, and attempted to establish C2 communications while masquerading behind WerFault.exe.
An open-source Python-based remote access trojan that supports reflective DLL loading to evade detection and can download additional modules. It gives attackers full access to infected devices, enabling command execution, data theft, further malware installation, and lateral movement.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.