Peppy

Executive Summary

Peppy is a long‑standing Python RAT that infects Windows machines via phishing or exploitation campaigns. It establishes persistent backdoor access, harvesting credentials and exfiltrating data through encrypted C2 channels. The threat is most noticeable by anomalous outbound traffic to obscure domains and the presence of typical RAT persistence entries.

Peppy is a Python‑based remote access trojan (RAT) that has been observed in the wild since at least 2012. The malware was first reported by Proofpoint’s Operation Transparent Tribe (March 2016), which identified it as part of a broader family of code that shares core components with the Crimson RAT. The attacker‑controlled payload is typically delivered via phishing, malicious attachments or exploit kits and is designed to operate on Windows hosts. Once executed, Peppy installs persistence by creating startup folder shortcuts and registry run keys, establishing a command‑and‑control (C2) channel over HTTPS or WebSocket traffic encrypted with TLS. Peppys functionality mirrors classic RAT capabilities: it can execute arbitrary shell commands, capture screenshots, record keyboard input, enumerate running processes, harvest credentials from browsers, exfiltrate files, and establish reverse shell connections. It also frequently uses Python’s “import” mechanism to load auxiliary modules at runtime, facilitating dynamic feature extension without requiring updates to the main binary. Because the code is written in Python, many anti‑malware scanners may defer to interpreter heuristics, making detection based on file hashes alone less effective. Operators should focus on behavioral indicators such as unexplained outbound encrypted traffic to rare domains, persistence mechanisms, and active PowerShell or cmd invocation from non‑system processes.

Key Capabilities

• Establishes secure outbound C2 over HTTPS/WebSocket
• Implements Windows persistence via startup folder shortcuts and registry run keys
• Executes arbitrary shell commands locally and remotely
• Captures screenshots and records keystrokes
• Enumerates system processes and reads browser credentials
• Exfiltrates files to the command server
• Injects auxiliary Python modules at runtime for feature extension

ATT&CK Techniques

Recommended Actions

• Block outbound HTTPS traffic to known Peppy C2 domains or block all traffic on unusual ports above 1024 unless needed by business

Suggested Tags