> Family · Unclassified Python ngrok RAT Family_

~/packetpursuit $ cat /intel/families/unclassified-python-ngrok-rat.md

typeentityfamilyunclassified-python-ngrok-ratconfidencelowcreated2026-06-14updated2026-06-14scriptratc2credential-accessdiscoverypersistenceimpact

Unclassified Python ngrok RAT Family

Low-skill commodity Windows RAT distributed as a batch script that bootstraps a Python embeddable runtime and runs an obfuscated Python payload. C2 is a free-tier ngrok TCP tunnel. Capabilities span credential theft (Chrome DPAPI, WiFi), screen/webcam capture, remote shell, and system sabotage (BSOD trigger).

Capabilities

  • batch-python-embed-download-stager
  • base64-line-split-obfuscation
  • zlib-compressed-payload
  • xor-single-byte-encryption
  • tcp-cleartext-c2-ngrok
  • chrome-dpapi-master-key-extraction
  • chrome-login-data-exfiltration
  • chrome-cookie-exfiltration
  • wifi-credential-dump-netsh
  • screenshot-sendkeys-clipboard
  • remote-shell-subprocess-popen
  • schtasks-onlogon-persistence
  • bsod-rtladjustprivilege-ntraiseharderror
  • whatsapp-session-localstorage-zip-exfil
  • avicap32-webcam-stub

Build / RE

  • Language: DOS batch + Python 3.10.11 embeddable
  • Packer/Obfuscation: None — manual base64 line-splitting in batch, zlib + XOR in Python layer
  • Anti-analysis: None. No VM checks, debug checks, or timing gates
  • Code quality: Low — dead imports (cv2, numpy), stub commands (webcam, keylog_start), verbose comments admitting incomplete features
  • Signing: None
  • Resources: Downloads Python runtime from legitimate python.org; leverages trust in open-source infrastructure

Deploy / ATT&CK

Tactic Technique Evidence
Execution T1059.003 Batch script launch ^[sample 028301d6/strings.txt:1]
Execution T1059.006 Python inner payload ^[raw/analyses/028301d695ca8918d856cacd951ae7fa54c6a9ab77edf975e1259fa243cc5b71/decoded_payload.py:1]
Command and Control T1071.001 HTTP to ip-api.com for victim geo ^[decoded_payload.py:32]
Credential Access T1555.003 Chrome Login Data SQLite theft ^[decoded_payload.py:145]
Credential Access T1552.004 DPAPI CryptUnprotectData on os_crypt.encrypted_key ^[decoded_payload.py:120]
Discovery T1082 System info enumeration (platform, socket.gethostname) ^[decoded_payload.py:34]
Discovery T1049 netsh wlan show profiles key=clear ^[decoded_payload.py:47]
Collection T1005 Raw file reads of browser databases ^[decoded_payload.py:148]
Collection T1113 PowerShell SendKeys + Clipboard JPEG screenshot ^[decoded_payload.py:41]
Collection T1125 AVICAP32 capture window stub ^[decoded_payload.py:105]
Exfiltration T1041 TCP socket exfil of stolen data ^[decoded_payload.py:26]
Persistence T1053.005 schtasks /create /tn "SystemUpdate" /sc onlogon /rl highest ^[decoded_payload.py:69]
Impact T1490 BSOD via NtRaiseHardError(0xC000007B) ^[decoded_payload.py:73]

Sibling Analyses

  • 028301d695ca8918d856cacd951ae7fa54c6a9ab77edf975e1259fa243cc5b71 (Update.bat) — First observed sample: batch stager + Python embed + ngrok C2 + Chrome/WiFi theft + BSOD trigger. ^[/intel/analyses/028301d695ca8918d856cacd951ae7fa54c6a9ab77edf975e1259fa243cc5b71.html]

Related

  • python-packed-payload — Concept page for malware whose logic lives in Python inside a PE or script carrier
  • unclassified-batch-powershell-dropper — Different batch-dropper family (PowerShell reflective .NET load), similar staging concept but different toolchain
  • schtasks-onlogon-persistence — Procedure page for the persistence mechanism observed here