Python malware on the rise
cyborgsecurity.com
Python malware on the rise
1–10 of 70 posts
Re: Python malware on the rise
#2Is it just me, or does this read like a friendly howto for a would-be python malware author?
Re: Python malware on the rise
#3This article lost me, what really confuses me is exceptions in malware with obfuscated code example (I would not call this obfuscated code) and "import cv2" example, does malware installs open-cv library on windows in background ? (this simply does not compute)
Re: Python malware on the rise
#4OT: Those graphs* are interesting in that the spikes for Java/C++ seem to align with fall/spring school semesters, and Javascript tends to invert that pattern and have a spike during the summer (internships? personal summer projects?).
* https://www.cyborgsecurity.com/wp-content/uploads/2020/07/py...
Re: Python malware on the rise
#5This article lost me, what really confuses me is exceptions in malware with obfuscated code example (I would not call this obfuscated code) and "import cv2" example, does malware installs open-cv library on windows in background ? (this simply does not compute)
Author here. The obfuscated code example was to show what a malware author might do to make malware analysis of a Python "compiled" binary more difficult. The code might be obfuscated & turned into an executable before deployed.
As far as the opencv library goes, used by PoetRAT, you can choose to bundle third party packages inside your executable with all the executable generators I mentioned at the beginning of the article like PyInstaller or Nuitka.
Re: Python malware on the rise
#6This article lost me, what really confuses me is exceptions in malware with obfuscated code example (I would not call this obfuscated code) and "import cv2" example, does malware installs open-cv library on windows in background ? (this simply does not compute)
When you run PyInstaller, it bundles an interpreter with all the necessary third-party modules, so there's no need to install things. What that cv2 example shows is how with very few lines of codes, an atacker can open the webcam and obtain 10 images (roughly 1/3rd of a second) of camera footage.
However, in all notebooks that have one, that code will make your litle LED indicator right by the webcam turn on, so it's not particularly quiet about it.
Re: Python malware on the rise
#7This article lost me, what really confuses me is exceptions in malware with obfuscated code example (I would not call this obfuscated code) and "import cv2" example, does malware installs open-cv library on windows in background ? (this simply does not compute)
[deleted]
Re: Python malware on the rise
#8Is it just me, or does this read like a friendly howto for a would-be python malware author?
“What I cannot create, I do not understand." -Richard Feynman
I do hope that those reading this will use this knowledge to do good.
Re: Python malware on the rise
#9This seemed to be more about how to compile/decompile and obfuscate Python code then anything about malware. The two examples were the ability to take screenshots and make web requests were the only two actual potential malware related topics, but even those are fairly basic concepts that have a huge range of applications outside malware. These things are also fairly trivial in most even slightly mature languages.
The section on eval was a little more interesting but still nothing special.
Personally, and this is just my probably uninformed opinion, the biggest thing about Python that makes it useful for malware is its huge, mostly uncurated repository of libraries and addons that are easy to install and use without ever looking at it. This aspect of Python seems likely the most appealing for would be malware writers. The ease of making malicious code widely available without a lot of scrutiny.
Re: Python malware on the rise
#10Is it just me, or does this read like a friendly howto for a would-be python malware author?
It's already quite easy. I made a python reverse shell in 15 minutes with basically no knowledge, and was able to obfuscate it well enough to fool every single antivirus.