A detailed walkthrough of a six-stage Python-based malware loader discovered in a user's startup folder. The analysis traces execution from a suspicious .lnk shortcut through an IronPython interpreter, multiple obfuscated payloads (Base64, Gzip, custom ciphers), a .NET process-hollowing injector targeting msbuild.exe, an execute-assembly loader, AMSI bypass, and finally a URSU-family RAT with AES256-encrypted C2 configuration. The post covers static analysis tools (PeStudio, DIE, Dnspy), manual decoding techniques using CyberChef and custom Python scripts, anti-analysis evasion checks, persistence mechanisms (run keys, scheduled tasks), and C2 command capabilities. IOCs including domains and file hashes with 0 VirusTotal detections at time of discovery are provided.
