Re:Python malware on the rise
by neatze on Monday July 13, 2020 @04:06PM
(#23825018)
This article lost me, what really confuses me is exceptions in malware with obfuscated code example (I would not call this obfuscated code) and "import cv2" example, does malware installs open-cv library on windows in background ? (this simply does not compute)
[ Parent
| on HN ]
Author here. The obfuscated code example was to show what a malware author might do to make malware analysis of a Python "compiled" binary more difficult. The code might be obfuscated & turned into an executable before deployed.
As far as the opencv library goes, used by PoetRAT, you can choose to bundle third party packages inside your executable with all the executable generators I mentioned at the beginning of the article like PyInstaller or Nuitka.
Thanks for article and explanation I am less confused now.
I wonder how large malware payload size will be when packaged with open-cv :)
They can get really large, especially if it's a dependency that has many dependencies itself! Glad you enjoyed it, thanks so much for reading.
Re:Python malware on the rise
by theturingnerd on Monday July 13, 2020 @04:25PM
(#23825224)
Quality work! Sidebar, it's crazy to see you on the front page of HN; hope you're doing well man! --t--
Re:Python malware on the rise
by dr_zoidberg on Monday July 13, 2020 @04:15PM
(#23825117)
When you run PyInstaller, it bundles an interpreter with all the necessary third-party modules, so there's no need to install things. What that cv2 example shows is how with very few lines of codes, an atacker can open the webcam and obtain 10 images (roughly 1/3rd of a second) of camera footage.
However, in all notebooks that have one, that code will make your litle LED indicator right by the webcam turn on, so it's not particularly quiet about it.