3 ms·
This article lost me, what really confuses me is exceptions in malware with obfuscated code example (I would not call this obfuscated code) and "import cv2" exa
by neatze 6y ago
This article lost me, what really confuses me is exceptions in malware with obfuscated code example (I would not call this obfuscated code) and "import cv2" example, does malware installs open-cv library on windows in background ? (this simply does not compute)
- vesche 6y agoAuthor here. The obfuscated code example was to show what a malware author might do to make malware analysis of a Python "compiled" binary more difficult. The code might be obfuscated & turned into an executable before deployed. As far as the opencv library goes, used by PoetRAT, you can choose to bundle third party packages inside your executable with all the executable generators I mentioned at the beginning of the article like PyInstaller or Nuitka.
- theturingnerd 6y agoQuality work! Sidebar, it's crazy to see you on the front page of HN; hope you're doing well man! --t--
- neatze 6y agoThanks for article and explanation I am less confused now. I wonder how large malware payload size will be when packaged with open-cv :)
- vesche 6y agoThey can get really large, especially if it's a dependency that has many dependencies itself! Glad you enjoyed it, thanks so much for reading.
- dr_zoidberg 6y agoWhen you run PyInstaller, it bundles an interpreter with all the necessary third-party modules, so there's no need to install things. What that cv2 example shows is how with very few lines of codes, an atacker can open the webcam and obtain 10 images (roughly 1/3rd of a second) of camera footage. However, in all notebooks that have one, that code will make your litle LED indicator right by the webcam turn on, so it's not particularly quiet about it.
- deleted 6y ago[deleted]