Thursday, April 16, 2020 . PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors . News summary . - Azerbaijan government and energy sector likely targeted by an unknown actor. For exfiltration, it uses FTP, which denotes an intention to transfer large amounts of data. Afterward, it copies 7,074,638 bytes from the end of the file and writes the remaining bytes back to the disk. One, called "frown.py," is responsible for the communications with the command and control (C2). It uses TLS to encrypt the communication that occurs on port 143. For each FTP usage, the credentials are provided by the C2 server during the request. Start routine The communication between the scripts is done via a file called "Abibliophobia23" Commands and results are written into the file using a custom encryption scheme. The binary uses a file system watcher in order to generate an event each time a file is modified in one of the directories in the "Paths" variable of the configuration file. Filesystem monitoring routine Once a file is available, the Dog.exe binary exfiltrates it, using email or FTP depending on the configuration. Additional tools . During our investigation, we identified a couple of additional tools mainly in Python and compiled for Windows: - Klog.exe: A keylogger using an output file called "System32.Log. Tre.py": A script used to create the file with the files/directories tree