Chris Noonan
@nullCat0 followers14 downloads0 copies0 likes26 views
1 detection
Filters
Last updated
All Time
Detection languages
1
Categories
1
1
1
1
Platforms
1
MITRE Techniques
1
1
1
1
1
Detects execution of specific Python scripts (modes.py, extentions.py, udp.pyw) using the windowless Python interpreter (pythonw.exe) from user-writable locations. This behavior is a strong indicator of ModeloRAT delivered via the CrashFix/ClickFix campaign using portable WinPython for stealth.
