https://github.com/stratosphereips/malware-cc-recovery
A project to recover a specific malware and make it work.
https://github.com/stratosphereips/malware-cc-recovery
Last synced: 6 months ago
JSON representation
A project to recover a specific malware and make it work.
- Host: GitHub
- URL: https://github.com/stratosphereips/malware-cc-recovery
- Owner: stratosphereips
- License: gpl-2.0
- Created: 2024-02-11T11:57:25.000Z (over 2 years ago)
- Default Branch: main
- Last Pushed: 2024-02-23T13:20:45.000Z (over 2 years ago)
- Last Synced: 2025-09-05T04:10:06.652Z (11 months ago)
- Language: Python
- Size: 17.2 MB
- Stars: 3
- Watchers: 3
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- Contributing: .github/CONTRIBUTING.md
- License: LICENSE
- Code of conduct: .github/CODE_OF_CONDUCT.md
- Citation: CITATION.cff
- Security: .github/SECURITY.md
Awesome Lists containing this project
README
# Malware CC Recovery of PyRation variant Malware
The Malware CC Recovery is a project done by [Tomy-Niepo](https://github.com/tomy-niepo) as part of his internship in the [Stratosphere Laboratory](https://www.stratosphereips.org) to analyze real malware and understand its working.
This repository has the recovered code of the original malware, plus a new implementation of a Command and Control (CC) server and a new implementation of a botmaster bot.
The blog with the description can be found [here online](), or a PDF copy is in [here](). The slides of a presentation on all the work is [here](https://github.com/stratosphereips/Malware-CC-Recovery/blob/main/docs/Analysis%20and%20understanding%20a%20malware%20of%20the%20PyRation%20family.pdf).
## Analysis of the Original Malware
The original malware is a member of the PyRation variant family. It is a Windows PE file with hash MD5 `67e77dcdbf046a0fd91a0bbb3e807831`, SHA256 `bba407734a2567c7e22e443ee5cc1b3a5780c9dd44c79b4a94d514449b0fd39a` ([VirusTotal](https://www.virustotal.com/gui/file/bba407734a2567c7e22e443ee5cc1b3a5780c9dd44c79b4a94d514449b0fd39a)). The original file can be found [here](https://github.com/stratosphereips/Malware-CC-Recovery/blob/main/original-malware.zip).
Previous analyses of this malware were partially done, for example [here](https://www.securonix.com/blog/security-advisory-python-based-pyration-attack-campaign/).
The original malware was done to run on Windows. My adaptation runs well on macOS and maybe Linux (did not finish testing).
## CC Server
Since the malware is only the bot part for Windows, there is no Command and Control server to try and see how it works. This is why I designed and created the CC server to be able to receive multiple bots and give them orders.
## BotMaster
The CC Server is the middle layer and communication software with the Bots (infected computers), but the orders need to come from someplace. My solution for this was to create a new type of client that acts as the botmaster and gives orders to the Bots through the CC server.
Part of the server was based on the ideas from https://github.com/yuv-c/server_client_websocket_chat.
# How to run
- Install the libraries
```bash
python3 -m venv myenv
source myenv/bin/activate
pip install -r requirements.txt
```
- Start the CC server
```bash
python ccserver.py
```
- Start the bots
In another console or computer, start a bot (repeat this for as many bots as you want)
```bash
python malware_client.py
```
If running on macOS, you will need to give permissions to the application where you run the bot. It can be iterm2, or the terminal or other. You need to give the terminal permission to take screenshots of your computer as well as permission to listen to your keyboard. This can be done in settings. Go to 'Privacy and Security' then 'Input Monitoring' and enable, for example, Iterm2. Then, also in 'Privacy and Security' go to 'Screen Recording & System Audio' and enable, for example, Iterm2.
- Start the Botmaster
```bash
python botmaster.py
```
# How to use
As soon as you execute the Botmaster, from the console of the botmaster you can manage all the bots.
## Executing Actions
From the menu, you can select `a` to execute actions
### Action 'write a file from /static/downloads into computer'
This action sends a file from the CC server to all the bots. Be sure the file exists before sending.
In the logs of the server, `server.log` you should see
### Action 'send file name and file contents to write in computer'
This action is to send a file from the Bot to the CC server.
### Action 'make a remeote request from computer'
This action is to ask the Bot to visit a web site and send back the results. It is not working for now.
## Executing commands
The Botmaster can execute commands in all the Bots by sending commands with `c` option.
This can be verified in the CC server file `commands_results.txt`, which in this case has the content:
```
Darwin Conter.local 23.2.0 Darwin Kernel Version 23.2.0: Wed Nov 15 21:53:34 PST 2023; root:xnu-10002.61.3~2/RELEASE_ARM64_T8103 x86_64
Darwin Conter.local 23.2.0 Darwin Kernel Version 23.2.0: Wed Nov 15 21:53:34 PST 2023; root:xnu-10002.61.3~2/RELEASE_ARM64_T8103 x86_64
```
## Automatic functions
The Bot is continually doing three functions
### Screenshot capture
Every 5 minutes, it captures a screenshot of the main windows (desktop) and sends it as a 600x600 size image to the server. The images are stored in the `Documents` folder.
### Keylogger
The bots capture all the keys on all the open applications in the system. Keys are sent to the CC server every 1 minute.
The keys are sent to the server and stored in a file called `keylogs.txt`. An example log is:
```bash
2024-02-22 14:56:04.792776: |shift_r|
2024-02-22 14:56:20.442531: |shift_r|
2024-02-22 14:56:23.221389: |shift_r|
2024-02-22 14:56:23.392227: |shift_r|
2024-02-22 14:56:24.624446: |shift_r|
2024-02-22 14:56:26.855297: |shift_r|
2024-02-22 14:56:29.968832: |shift_r|
2024-02-22 14:56:33.448805: |shift_r|
2024-02-22 14:56:34.547535: |shift_r|
2024-02-22 14:56:39.680636: |cmd|
2024-02-22 14:56:42.754119: |ctrl|
```
### Find installed AntiVirus
Only once when the bot connects to the CC Server it searches all the installed AntiVirus in macOS and sends the list to the CC server.
### Update configuration
Only once when the bot connects to the CC Server, it askes for a configuration file. In this file is possible to change the IP of the CC server and the time configurations for the screenshot capture and keylogger sending.
# Diagram of operation
