Malcat-WTF Full Analysis

6239 objects analysed - generated 2026-05-31 08:46:27 UTC
xiaomi/mimo-v2.5-pro Tokens823,477 Elapsed6m 40.4s Cost0.1701 EUR
AI summary Technical report
Summary
Clean
92%
Malware
Malicious
File name msi_to_nsis_to_py_to_dotnet.msii
Type CFB
Architecture MSI
Size 18.8 MiB
SHA256 ee0f0f2f089ee0594da5750bb4e342c34d703ea045ed80c3b73c81d2f3de8bd4
AI report

Summary / behavior

This is a highly sophisticated multi-stage malware delivery chain disguised as a legitimate RVtools installer. The file is an MSI installer (CFB format, ~19.7MB) that wraps an NSIS installer containing a trojanized software supply chain attack.

Attack chain: MSI → NSIS → Python 3.12 runtime + .NET dropper → obfuscated Python bytecode payload

Key behaviors:

  1. Masquerading as RVtools: The MSI claims to be "RVtools System 4.7.0.2" (a legitimate VMware reporting tool) with fake metadata from "RVtools System" company, packaged via "MSI Wrapper (25.0.54.0)".
  2. Decoy installation: Installs a legitimate RVtools MSI (rvtools4.7.1.msi) as cover while the malicious payload executes silently in the background.
  3. Domain-joined targeting: Checks if the machine is domain-joined (reads TcpIp\Parameters\Domain) and Windows version before deploying payload — exits if not domain-joined.
  4. Python runtime deployment: Deploys a full embedded Python 3.12 runtime with pythonnet, clr_loader, cffi, and pycparser libraries to execute obfuscated Python bytecode.
  5. Renamed system tools: Deploys System.Management.Automation.dll (PowerShell) renamed as Unicode.Data.Automation.dll, and pythonw.exe renamed as UsbService86.exe.
  6. Persistence: Writes UpdateWINPY to SOFTWARE\Microsoft\Windows\CurrentVersion\Run registry key pointing to a malicious Python bytecode file disguised as LICENSE.txt.
  7. COM hijacking: Modifies SOFTWARE\Microsoft\MSDTC\MTxOCI\OracleOciLibPath to C:\ProgramData\SysIco.
  8. MSDTC service manipulation: Reconfigures the MSDTC service (sc config msdtc start= demand, sc config msdtc obj= "LocalSystem").
  9. Hidden execution: The .NET dropper (start.exe) launches processes with CreateNoWindow=true, UseShellExecute=true, WindowStyle=Hidden.

Sub-files analyzed:

Key detections and IOCs

Malicious indicators:

  1. Multi-layered installer wrapping (MSI → NSIS → Python → .NET) designed to evade detection
  2. Brand impersonation: Impersonates RVtools (legitimate VMware tool) with entirely fake metadata
  3. Renamed system binaries: System.Management.Automation.dll → Unicode.Data.Automation.dll; pythonw.exe → UsbService86.exe
  4. Registry persistence: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\UpdateWINPY
  5. COM hijacking: HKLM\SOFTWARE\Microsoft\MSDTC\MTxOCI\OracleOciLibPath = C:\ProgramData\SysIco
  6. Domain-joined targeting: Filters victims by checking domain membership
  7. Obfuscated payload: Python bytecode with randomized function/class names (e.g., bRliQzDc, EPQJcBMm, GoZPmsRg)
  8. Hidden execution: .NET dropper uses CreateNoWindow, WindowStyle=Hidden
  9. Future-dated metadata: Copyright 2026, debug date 2058-08-01
  10. YARA matches: ValuableFileExtensions (ransomware-associated extensions), ElevatePrivileges, RunShell

IOCs:

Evidence

  1. MSI metadata is fake: Title "RVtools System 4.7.0.2", author "RVtools System", comments "Provides system services for Windows processes", but the wrapped NSIS installer has VersionInfo from "Obsidian Vector Labs" with internal name "EchoPulse" and product "NexusCore Runtime" — completely different entities.
  2. NSIS script disassembly (): The EchoPulse() function performs: hidden window → install decoy RVtools MSI → sleep 4 minutes → check domain membership → extract Python runtime + payload → configure MSDTC → set Run key persistence → execute payload.
  3. Renamed PowerShell: Unicode.Data.Automation.dll () has InternalName = System.Management.Automation.dll and FileDescription = System.Management.Automation — this is the PowerShell engine, renamed to avoid AV detection.
  4. Renamed pythonw.exe: UsbService86.exe () has OriginalFilename = pythonw.exe from "Python Software Foundation" v3.12.3.
  5. .NET dropper code (): Main method takes a file path argument, checks existence with File.Exists, creates ProcessStartInfo with CreateNoWindow=true and WindowStyle=Hidden, then starts the process — classic hidden process launcher.
  6. Payload is obfuscated PYC: Both LICENSE.txt and LICENSE1.txt are detected as Python 3.12 bytecode files (PYC), not text files. All function names are randomized (e.g., func_0_HsEnr, func_1_lRrmc). All strings are random alphanumeric (e.g., pIXkyTjIZwyuXEXZARvvS7VuV).
  7. Duplicate payload deployment: The NSIS script extracts the full payload to both $INSTDIR\SystemWEB\SystemInfo\ and $INSTDIR\AppUpdate\SystemInfo\, executing the SystemWEB copy and setting the AppUpdate copy for persistence via Run key.
  8. Anomalies flagged: ElevatePrivileges (AdjustTokenPrivileges import), RunShell (cmd.exe reference), ValuableFileExtensions (ransomware-associated file extensions list), EmbeddedProgram.

Counter-arguments

  1. Kesakode verdicts are inconclusive: No Kesakode verdict on the root file. The CustomActionDll had very low-confidence matches (CobaltStrike 4/100, AMTsol 2/100) — likely false positives. The .NET dropper and payload files had no Kesakode detections.
  2. Obfuscation makes payload analysis incomplete: The actual malicious Python payload could not be fully decompiled due to heavy obfuscation. While the deployment mechanism is clearly malicious, the exact capabilities of the final payload (C2 communication, data exfiltration, etc.) could not be fully determined.
  3. Legitimate components included: The package includes a genuine RVtools MSI installer (rvtools4.7.1.msi), a legitimate Python 3.12 runtime, and legitimate Python libraries (pythonnet, cffi, pycparser). The start.exe .NET dropper itself is a very simple program — its maliciousness depends on what it's asked to execute.
  4. The Unicode.Data.Automation.dll could theoretically be a renamed legitimate copy: However, embedding PowerShell inside a software installer under a disguised name is not a legitimate practice.

Verdict

This file is malicious with 92% confidence. It is a sophisticated supply-chain style malware delivery mechanism that impersonates the legitimate RVtools application. The multi-stage installation chain (MSI → NSIS → Python/.NET) deploys a heavily obfuscated Python bytecode payload with persistence via registry Run keys, COM hijacking via MSDTC settings, and hidden execution. The use of renamed PowerShell and pythonw binaries, domain-joined targeting, decoy legitimate installer, and extensive obfuscation all indicate a targeted attack tool designed for enterprise environments. The exact final payload capabilities remain unclear due to the obfuscation of the Python bytecode, but the entire delivery infrastructure exhibits clear malicious intent.