Malicious Python Package Hides Sliver C2 Framework in Fake Requests Library Logo

Cybersecurity scientists have discovered a destructive Python bundle that purports to be an offshoot of the preferred requests library and has been identified concealing a Golang-model of the Sliver command-and-handle (C2) framework within just a PNG graphic of the project’s brand.

The deal utilizing this steganographic trickery is requests-darwin-lite, which has been downloaded 417 situations prior to it staying taken down from the Python Package deal Index (PyPI) registry.

Requests-darwin-lite “appeared to be a fork of the ever-preferred requests package deal with a couple essential discrepancies, most notably the inclusion of a destructive Go binary packed into a massive variation of the true requests side-bar PNG emblem,” software package source chain security organization Phylum said.

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

The alterations have been released in the package’s setup.py file, which has been configured to decode and execute a Base64-encoded command to assemble the system’s Universally Unique Identifier (UUID).

In what is actually an fascinating twist, the an infection chain proceeds only if the identifier matches a certain price, implying that the author(s) powering the package deal is searching to breach a specific machine to which they are by now in possession of the identifier attained via some other means.

This raises two possibilities: Both it is a very qualified attack or it truly is some kind of a screening system forward of a broader campaign.

Ought to the UUID match, the requests-darwin-lite proceeds to examine data from a PNG file named “requests-sidebar-massive.png,” which bears similarities with the genuine requests package deal that ships with a equivalent file known as “requests-sidebar.png.”

What’s distinct right here is that although the real emblem embedded inside of requests has a file measurement of 300 kB, the one contained inside of requests-darwin-lite is about 17 MB.

The binary knowledge hid in the PNG picture is the Golang-based Sliver, an open up-source C2 framework that’s designed to be utilised by security experts in their pink workforce operations.

The exact finish purpose of the offer is at this time unclear, but the enhancement is at the time once again a signal that open up-resource ecosystems proceed to be an beautiful vector to distribute malware.

With a wide vast majority of codebases relying on open up-source code, the regular inflow of malware into npm, PyPI, and other package deal registries, not to point out the current XZ Utils episode, has highlighted the need to have for addressing issues in a systematic method that usually can “derail big swaths of the web.”

Observed this post intriguing? Abide by us on Twitter  and LinkedIn to read additional exceptional content material we publish.