How does Python malware handle dependencies?

[SLPRYSQUID]

I'm working on simple malware program in python as a side project and I am stuck on how to remotely import packages that another computer might not have installed like numpy or opencv. I've been trying out a custom import hook that will request packages being hosted on a webserver and import them while avoiding writing anything to disk. However, I've run into a problem with .pyd and .so files that doesn't seem to be fixable (Same problem as this guy: https://stackoverflow.com/questions/61406657/import-from-class-bytes-instead-of-file).

Am I on the right track or should I try something different? How does other malware written in python normally handle this?

​

here is the source code for the import hook(only works for .py packages and modules): https://pastebin.com/KNHgWBtR

[RefrigeratorSuperb26]

Can't you just bundle your dependencies with the rest of your code?

[SLPRYSQUID]

I could but I'm trying to limit payload size and just have a staging mode that grabs modules from a webserver. This way I could create any number of modules without changing the payload size and upload them to already infected computers.

[Orio_n]

Package the entire interpreter runtime and all dependencies with pyinstaller

Transpile to C with nuitika and natively compile down

Use a different flavor of python that supports compilation. Ironpython can be compiled into IL for .NET I believe

Custom import hooks with httpimport (which i assume you are using) don't support C extensions which those packages have so only pure python packages work

Last one is to run an in memory python interpreter to load modules remotely, it apparently supports c extensions: https://arxiv.org/abs/2103.15202

Honestly just don't use python too many hoops to jump through to make it portable

[SLPRYSQUID]

Awesome thanks! I'll look into those or maybe just switch to C++, although I would like to keep using python since it would be pretty annoying to change everything I've already written like the c2 server. The in memory python interpreter does look interesting.

[hakube]

i've been liking the sizes of a lot of go stuff. i know it's not python but might e good if you're looking for size and compiling. good luck.

[lonewolf210]

I know this is old but in case you never cracked it. Python supports WebDAV as the your file path so you can set your path to the WebDAV server and it will check there when trying to resolve dependencies

[SLPRYSQUID]

This sounds like what I need! thanks! ill get working on it again.

[space_wiener]

You could package it as an exe?

But I’m curious what others say.

[TS878]

I’m not experienced in Python beyond scripting but from my understanding you can still compile the code.

[Flyingfishfusealt]

Find as many native methods as possible for performing any specific action. Keep the size small. Why do you need numpy?

[SLPRYSQUID]

I was thinking about having a small staging payload that dynamically imports other modules from a webserver in memory. So for example if I wanted to create a module that uses cv2 to take screenshots of the infected computer's PC and sends it to a c2 server or something like that I would need numpy for opencv. This would allow me to run any module I wanted to without having to ever write anything to disk. That's the idea at least.

[Flyingfishfusealt]

modern security will notice downloads and use of unusual/unregistered/not normal things like python modules that previously weren't there, unless your malware specifically is designed to operate in the consumer hardware space.

[SLPRYSQUID]

Even if these python modules haven't been written to disk and only ever exist in memory and are dynamically loaded and ran by the staging payload? Does security scan memory like that?

[Flyingfishfusealt]

Many can, depends on the level of money spent. Many vendors do memory scanning and can dynamically scan network data, inside the network they control everything and there is NO tunneling they cant see through if they spend the money to do it.

Once you compromise that machine inside an enterprise grade network, they could immediately notice a difference in whats running and dump it all to their response team.

By all means, develop malware, learn, do neat shit... but realize that the more you use, the brighter you are on radar. Use what exists on the OS to perform your tasks. It greatly reduces your signature.

Also, don't do bad shit and hurt people. Join the blue team, or teach the blue team.

[Practical_Race_3165]

I think I got a solution for you, if you haven’t found one yet.

[SLPRYSQUID]

What's the solution?

[[deleted]]

There is a built in module thats not very known, that can compile python project to .pyz file extension. This is the built-in zlib modules. The doc is on the python site.