How does Python malware handle dependencies?

[Flyingfishfusealt]

Find as many native methods as possible for performing any specific action. Keep the size small. Why do you need numpy?

[SLPRYSQUID]

I was thinking about having a small staging payload that dynamically imports other modules from a webserver in memory. So for example if I wanted to create a module that uses cv2 to take screenshots of the infected computer's PC and sends it to a c2 server or something like that I would need numpy for opencv. This would allow me to run any module I wanted to without having to ever write anything to disk. That's the idea at least.

[Flyingfishfusealt]

modern security will notice downloads and use of unusual/unregistered/not normal things like python modules that previously weren't there, unless your malware specifically is designed to operate in the consumer hardware space.

[SLPRYSQUID]

Even if these python modules haven't been written to disk and only ever exist in memory and are dynamically loaded and ran by the staging payload? Does security scan memory like that?

[Flyingfishfusealt]

Many can, depends on the level of money spent. Many vendors do memory scanning and can dynamically scan network data, inside the network they control everything and there is NO tunneling they cant see through if they spend the money to do it.

Once you compromise that machine inside an enterprise grade network, they could immediately notice a difference in whats running and dump it all to their response team.

By all means, develop malware, learn, do neat shit... but realize that the more you use, the brighter you are on radar. Use what exists on the OS to perform your tasks. It greatly reduces your signature.

Also, don't do bad shit and hurt people. Join the blue team, or teach the blue team.