Snakes on a Domain: An Analysis of a Python Malware Loader | Huntress

This report details a forensic analysis of a multi-stage malware chain initiated by a persistent sysmon.lnk shortcut that launched a renamed IronPython interpreter and successive staged payloads (six stages) leading to a URSU-family RAT. The analysis documents decoding/unpacking routines (Base64, gzip, custom cipher), process hollowing into msbuild.exe, an AMSI bypass, anti-analysis checks, persistence via run keys and scheduled tasks, C2 configuration extraction, and provides file hashes and domains as IOCs.