3 ms·
You could maybe reasonably call this “fileless” if it was calling memfd from python. But even then - memfd does leave the file descriptor dangling and accessibl
by prvit 4y ago
You could maybe reasonably call this “fileless” if it was calling memfd from python. But even then - memfd does leave the file descriptor dangling and accessible in /proc/, it’s not much better than just dropping your file in /dev/shm.
In a windows malware context “fileless” means something entirely different from this.
- glitchc 4y agoThat everything is a file in Linux does not take away from the fact that this trojan only exists in volatile memory. It’s a fileless trojan for all intents and purposes.
- prvit 4y agoThe Linux equivalent of fileless malware on Windows would be a python script you pipe straight into the interpreter. The whole purpose of “fileless” malware is to not get caught by AV which will alert on a new files being created and executed. If this malware was piggybacking on the actual python process to do its thing, then maybe you could reasonably call it “fileless”.
- TillE 4y agoYes exactly, fileless malware generally means injecting code into existing trusted processes, which makes it extremely difficult to detect. If your malware can be detected by a simple real-time AV scanner which just hooks file I/O, it definitely isn't fileless.
- rascul 4y agoIt's fileless because the file is in memory instead of a hard disk? That doesn't seem like a good distinction.