3 ms·

Does it work on obfuscated calls? For example, a base 64 encrypted string that gets decrypted and then passed to a shell. Altough, I guess in that case, the sh

Does it work on obfuscated calls? For example, a base 64 encrypted string that gets decrypted and then passed to a shell. Altough, I guess in that case, the shell call itself is suspicious. What if the shell call itself is obfuscated?

deleted 4y ago
[deleted]
ashishbijlani 4y ago
> a base 64 encrypted string that gets decrypted and then passed to a shell. This is a very common malicious behavior. Packj detects obfuscation [1] as well as spawning of shell commands (exec system call) [2]. I've updated threats.csv to flag code obfuscation. 1. https://github.com/ossillate-inc/packj/blob/main/main.py#L486 https://github.com/ossillate-inc/packj/blob/main/main.py#L48... 2. https://github.com/ossillate-inc/packj/blob/main/main.py#L481 https://github.com/ossillate-inc/packj/blob/main/main.py#L48...