SCYTHE's in-memory client loads an in-memory CPython interpreter/runtime, even, so you do not even have to compile .py to an exe to run on Windows, for example.
Python malware on the rise
31–40 of 70 posts
Re: Python malware on the rise
#32I think a lot of people will read 'python malware' and assume packages; that's not what this is about. A lot of exploits are two-stage. Stage one is usually the vulnerability, usually written in C given the low-level and tightly controlled instructions required. The exploit breaks security to run an executable or otherwise gain control. Stage two is usually downloading a python executable to grab the goods. There's n…
> Python just runs on a lot of platforms, has a lot of mature drop-in libraries
More than that. Easy interop with dlls/shared libs via ctypes
Re: Python malware on the rise
#33Python is the new VB. Popular and easy to learn.
Yes, VB is popular back then and is very easy to learn. I wonder why VB.Net is not as popular as C# nowadays given that they have the same access to .NET Framework.
Re: Python malware on the rise
#34SCYTHE's in-memory client loads an in-memory CPython interpreter/runtime, even, so you do not even have to compile .py to an exe to run on Windows, for example.
Can you tell me more? A google search isn't showing anything relevant
Re: Python malware on the rise
#35Does anyone have suggestions for example python malware code for reading?
Fortunately, MSFT hasn't purged all of the cool RAT projects from GitHub but I'm curious if anyone here has suggestions.
I'm not a security researcher but I've always found the more nefarious uses of software clever and interesting.
Re: Python malware on the rise
#36The article mentions that Python malware comes with difficulties but in my experience it has the advantage to be an easy and simple way to write reliable malware. Packaging with PyInstaller to create a single (but large) executable is easy and helps avoiding detection as the interpreter is embedded in the PE (I never went in depth on this topic but it would be interesting to check out).
Shameless plug; I wrote a few popular articles on 0x00sec about Python malware on Windows just to show how simple and easy it is to build either using ctypes to call WinAPI functions or using pywin32 wrapper which makes the whole thing a lot faster.
See part 1 here https://0x00sec.org/t/malware-writing-python-malware-part-1/...
Definitely not the way to go if you have limited memory and need to write tiny shell code but it’s good enough for a stage 2 payload.
Re: Python malware on the rise
#37It's a well known problem that many languages (Python, Ruby, Node) have notoriously insecure trust chains in their dependency management frameworks. If more malware is hitting the Python ecosystem, I think it's just a matter of time until someone manages to publish a tainted version of `requests` or some similarly popular Python lib. I know for a fact a lot of cybersecurity automation mind share is in Python. Curious…
Few years ago someone published a trojan version of ``colorama`` with a British spelling ``colourama`` that was found to be mining bitcoins on victims machines!
I really hope I'm skilled enough to write something like this from scratch one day.
Re: Python malware on the rise
#38Python is the new VB. Popular and easy to learn.
Yes, VB is popular back then and is very easy to learn. I wonder why VB.Net is not as popular as C# nowadays given that they have the same access to .NET Framework.
Most of the VB.Net adopters came from VB6, only to find out that VB.Net had very little in common with VB other than syntax. If you had to learn a whole new framework and ecosystem anyway, there were more popular options available for VB refugees out there like C# or Python.
Re: Python malware on the rise
#39The article mentions that Python malware comes with difficulties but in my experience it has the advantage to be an easy and simple way to write reliable malware. Packaging with PyInstaller to create a single (but large) executable is easy and helps avoiding detection as the interpreter is embedded in the PE (I never went in depth on this topic but it would be interesting to check out). Shameless plug; I wrote a few…
Author here: I've seen your guides before, they're really great! I'd say my article looks at the difficulties, but also the great benefits malware authors have by writing in Python.
> Packaging with PyInstaller to create a single (but large) executable is easy and helps avoiding detection as the interpreter is embedded in the PE
If you look down further in the article it explores detecting PyInstaller generated executable using simple YARA rules. So, I'd disagree a bit there. I personally think that Nuitka (talked about in the article) in conjunction with a packer would be the best compilation method to use in-order to evade detection. It's actually quite surprising to me that limited malware samples have been seen in the wild using Nuitka, but as the title of the articles states- it's on the rise.
Re: Python malware on the rise
#40It's a well known problem that many languages (Python, Ruby, Node) have notoriously insecure trust chains in their dependency management frameworks. If more malware is hitting the Python ecosystem, I think it's just a matter of time until someone manages to publish a tainted version of `requests` or some similarly popular Python lib. I know for a fact a lot of cybersecurity automation mind share is in Python. Curious…
The article has nothing to do with package management though.