tr4cefl0w
Joined 6 years ago
Karma
11
Submissions
2
Member since
Jul 14
Recent submissions
Comment · 6 years ago
Comment · 6 years ago
The article mentions that Python malware comes with difficulties but in my experience it has the advantage to be an easy and simple way to write reliable malware. Packaging with PyInstaller to create a single (but large) executable is easy and helps avoiding detection as the interpreter is embedded in the PE (I never went in depth on this topic but it would be interesting to check out).
Shameless plug; I wrote a few popular articles on 0x00sec about Python malware on Windows just to show how simple and easy it is to build either using ctypes to call WinAPI functions or using pywin32 wrapper which makes the whole thing a lot faster.
See part 1 here https://0x00sec.org/t/malware-writing-python-malware-part-1/...
Definitely not the way to go if you have limited memory and need to write tiny shell code but it’s good enough for a stage 2 payload.
As for Nuitka, I was not able to make it work but I will try again. The alternative I also tried in the past was using Cython to generate C code then compile it but because it requires packaging Python std libs Dlls it was too much trouble and I ran into crashes when running.
I also had bad experiences when using packers because they have a tendency to trigger AV detection just for being packers, like ASProtect. Python malware is definitely a topic that deserves more in depth dive.
Good work!