New Clickfix variant ‘CrashFix’ deploying Python RAT
This rule detects various activities associated with the 'CrashFix' variant of the 'Clickfix' malware, which deploys a Python-based Remote Access Trojan (RAT). The detection logic covers several stages of the attack: 1. **Browser Extension Installation**: Identifies the creation of a specific malicious Chrome extension file (.crx) with a unique identifier. 2. **Command and Control (C2) Traffic**: Monitors network connections to known malicious URLs and IP addresses associated with the malware's C2 infrastructure. 3. **Malicious Hashes**: Detects the execution of processes with specific SHA256 hashes known to belong to the CrashFix malware. 4. **LOLBIN Abuse**: Identifies the use of living-off-the-land binaries (LOLBINs) like 'finger.exe' and 'ct.exe' in suspicious command-line combinations, potentially for discovery or execution. 5. **Malicious IP Communication**: Looks for network connections initiated by 'ct.exe' with the 'confirm' argument, indicating communication with potentially malicious remote IPs. 6. **Python TTPs**: Detects Python execution patterns, specifically 'pythonw.exe' running 'modes.py' and making outbound network connections to non-local IPs, indicative of the Python RAT. 7. **Persistence via Registry Run Key**: Monitors for registry modifications related to 'pythonw.exe modes.py', suggesting persistence mechanisms. 8. **Persistence via Scheduled Task**: Identifies the creation of scheduled tasks that execute 'run.exe' and 'udp.pyw', another persistence method.
Microsoft Sentinel (KQL)
