JDownloader Supply Chain Compromise: Python RAT Detection and Incident Response

---
title: Suspicious Python Execution from Temp Directory
id: 8a4b2c10-9e3d-4f1a-9b5c-2d1e3f4a5b6c
status: experimental
description: Detects python.exe or pythonw.exe running from a temporary directory or AppData local temp, characteristic of PyInstaller malware like the JDownloader RAT.
references:
 - https://attack.mitre.org/techniques/T1059/006/
author: Security Arsenal
date: 2025/02/20
tags:
 - attack.execution
 - attack.t1059.006
logsource:
 category: process_creation
 product: windows
detection:
 selection:
   Image|endswith:
     - '\python.exe'
     - '\pythonw.exe'
   Image|contains:
     - '\AppData\Local\Temp\'
     - '\Temp\'
 condition: selection
falsepositives:
 - Legitimate developers running scripts from temp (rare)
level: high
---
title: Network Connection Initiated by Python Process
id: 1b5c3d21-0f4e-5a2b-0c6d-3e2f4a5b6c7d
status: experimental
description: Detects python.exe or pythonw.exe initiating outbound network connections, potentially indicating C2 beaconing from the JDownloader RAT.
references:
 - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2025/02/20
tags:
 - attack.command_and_control
 - attack.t1071
logsource:
 category: network_connection
 product: windows
detection:
 selection:
   Image|endswith:
     - '\python.exe'
     - '\pythonw.exe'
   Initiated: 'true'
 condition: selection
falsepositives:
 - Legitimate python applications accessing the internet
level: medium

// Hunt for Python execution from non-standard paths (Temp/Downloads)
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("python.exe", "pythonw.exe")
| where FolderPath contains @"\Temp\" or FolderPath contains @"\Downloads\"
| extend ParentProcess = InitiatingProcessFileName, ParentPath = InitiatingProcessFolderPath
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, SHA256, ParentProcess, ParentPath
| order by Timestamp desc

-- Hunt for Python processes running from Temp or User Profile paths
SELECT Pid, Name, Exe, CommandLine, Username
FROM pslist()
WHERE Name =~ "python"
  AND (
     Exe =~ "C:\\Users\\.*\\AppData\\Local\\Temp\\.*" OR
     Exe =~ "C:\\Users\\.*\\Downloads\\.*" OR
     Exe =~ "/tmp/" OR
     Exe =~ "/home/.*/Downloads/.*"
  )

# PowerShell: Hunt for PyInstaller artifacts in JDownloader context
# Check Downloads and Temp for suspicious Python binaries
Write-Host "[+] Hunting for Python RAT artifacts..." -ForegroundColor Cyan

$pathsToScan = @(
    "$env:USERPROFILE\Downloads",
    "$env:TEMP"
)

$suspiciousHashes = @{} # Add known bad hashes here if available

foreach ($path in $pathsToScan) {
    if (Test-Path $path) {
        Write-Host "[+] Scanning $path..." -ForegroundColor Yellow
        
        # Look for python.exe or pythonw.exe in user spaces
        Get-ChildItem -Path $path -Recurse -Filter "python*.exe" -ErrorAction SilentlyContinue | ForEach-Object {
            $file = $_
            $sig = Get-AuthenticodeSignature $file.FullName
            
            if ($sig.Status -ne "Valid") {
                Write-Host "[!] ALERT: Unsigned Python binary found: $($file.FullName)" -ForegroundColor Red
                # Calculate hash for IOCs
                $hash = Get-FileHash -Path $file.FullName -Algorithm SHA256
                Write-Host "    SHA256: $($hash.Hash)" -ForegroundColor Gray
            }
        }

        # Look for JDownloader installers (generic check)
        Get-ChildItem -Path $path -Filter "JDownloader*.exe" -ErrorAction SilentlyContinue | ForEach-Object {
             Write-Host "[*] Found JDownloader Installer: $($_.FullName)" -ForegroundColor Cyan
        }
    }
}

# Linux: Bash script to check for suspicious installer remnants
# Execute on Linux endpoints where JDownloader might have been run

# Define paths to check
DOWNLOADS_DIR="$HOME/Downloads"
TEMP_DIR="/tmp"

echo "[+] Checking for suspicious JDownloader installer remnants..."

# Check for malicious shell scripts or recent Python binaries in temp
find "$TEMP_DIR" -name "*.sh" -mtime -1 -ls 2>/dev/null
find "$DOWNLOADS_DIR" -name "JDownloader*" -ls 2>/dev/null

# Check for running python processes from /tmp or Downloads
ps aux | grep -E "python.*(/tmp|Downloads)" | grep -v grep