Trojan:Python/Metasploit!MTB

The Trojan:Python/Metasploit!MTB malware comes with a Python-adapted version of the Meterpreter payload that can function as a single component or in a layered structure, establishing a reverse connection to a command-and-control (C2) server via TCP, HTTP, or HTTPS. To minimize initial detection, a lightweight activator often runs first, retrieving the full payload from a remote server operated by threat actors. This variant of Metasploit operates stealthily by using Python's built-in libraries to allocate memory, typically around 1MB, and injecting its code into existing processes rather than starting new ones, blending its activities with legitimate Python or system routines. 

Once active, the compromised host initiates outbound communication to specified C2 servers, which have been observed at addresses including 179[.]60.147[.]4 on port 58731, 108[.]62.118[.]160, and the internal address 192[.]168.68[.]21 on ports 4444 and 1337. While simpler variants cannot use encoding, more advanced versions employ encryption such as RC4 with custom keys and specialized protocols for obfuscation. Its capabilities are extensive, including launching shell commands, managing files, capturing screenshots, monitoring user input for credentials, and using Python-tailored tools for privilege escalation and system reconnaissance to allow lateral movement. 

Designed for evasion, the payload avoids writing to disk by loading additional components into memory from transient online sources. Although the core payload lacks inherent persistence, a threat actor can add it by modifying Python configurations, such as through scheduled tasks or by hiding within standard scripts. Communication with the C2 server uses a efficient Type-Length-Value (TLV) format, allowing for dynamic extension loading to expand its capabilities. Data exfiltration is protected by encryption that often mimics the TLS 1.0 protocol. The malware is deployed as a raw script generated by tools like msfvenom, but for greater stealth, it can be compiled into a standalone binary using utilities like py2exe to mask its activity from scanners while maintaining a persistent reverse shell session.