PyStoreRAT_ThreatAnalysis.pdf

**PyStoreRAT — GitHub-delivered HTA/JS RAT:** Morphisec Threat Labs analyzed PyStoreRAT, a modular, fileless JavaScript RAT executed via mshta/HTA and delivered through small Python/JS loader stubs embedded in seemingly legitimate GitHub repos; the implant supports multiple payload types (EXE/DLL/PS/MSI/Python/HTA), implements persistence via scheduled tasks, USB spreading, custom C2 session/token logic, manual deserialization to evade detection, and explicit evasion targeting CrowdStrike Falcon, and was observed deploying the Rhadamanthys stealer — the report provides technical details and IOCs (malicious repos, domains, download URLs, and hashes).