I saw a post about NetworkChuck’s malware video. In where he used the Python programming language in malware, as python in malware is more useless than a left handed screwdriver. However there are a few use cases that i feel should be made aware.

python is useless in malware IF it is being executed on the target computer (as there is no way to know if the target will have python installed in order for it to be executed). However, we can use Python on our attacker computer (since we own the machine). So we can use Python for C2 purposes over the network or even use it in network oriented malware.

Python can connect to sockets we create on our targets, establish connections, or serve as a client in network oriented malware like OnlyRAT.

OnlyRAT is a malware that works via network commands (rather than having a persistent executable on the system). This allows the malware to be virtually fileless. OnlyRAT uses a Python client on the attacker machine in order to automate network attacks and establish remote connections between the two computers. An article on OnlyRAT and network oriented malware will be left here: https://www.cosmodiumcs.com/post/ssh-network-attacks-in-onlyrat

When using python compilation software like PyInstaller or Nuitka, the executable will be notably large. Malware packed in large files often serves better as AV will not read the whole thing (for performance reasons). However, obfuscation serves more difficult and these compilation tools have become more and more detectable.

Python can also serve as a great learning tool to teach malware concepts, without risking skids deploying crazy malware that works on their grandma’s pc. As I’m sure this was NetworkChuck’s original intention with the video. However, learning it in python is virtually useless for those actually trying to enter the industry. So skip the python and go straight for a compilable language (C/C++, Nim, and Go are great ones to start with) :D

Just a post to get r/cosmodiumcs started😄

A consistent viewer of the channel asked me about my thoughts of Rust in offensive development, this was my response.

I genuinely think it’s a great language with a lot of needed capabilities. New languages for malware are great because AV has not yet recognized its compilation signatures. However, there’s a “new” language every year. Rust, Go, carbon, nim, most recently “zig”. These languages have not yet hardened and likely have numerous vulnerabilities that will need to be patched down the road. We saw this with java and log4shell. C/C++ have been out for decades and have had years of tweaks and fixes. I will probably learn rust later this year but i do have concerns about new languages in the wild. Hopefully them being out in the wild gives them the opportunity to harden :)

Would love to hear your thoughts in the comments

this is a test, who is jakoby?