The Anatomy of a Malicious Package Logo

The Anatomy of a Malicious Package

0
Free
Visit Website

What does a malicious package actually look like in practice? We'll walk through some hypothetical exercises to see how malware generally works, and what sort of functions we might expect, from relatively simple and temporary, to complex. Additionally, as we are focused primarily on Javascript for this post, we really need to think about two different threat models: what does in-browser malware look like, and how is that going to differ from on-host malware? Attacker Motivations and Mentality As we begin this thought experiment, the first thing to consider is what a potential attacker's targets and goals would be. On-Host The whole concept of "on-host" malware in NPM packages seems a bit unintuitive at first blush, as the immediate association is generally with browser-focused concerns - which must be safe, since the run in the browser sandbox. There are, interestingly enough, some serious advantages from an attacker's perspective.

FEATURES

ALTERNATIVES

A tool for deep analysis of malicious files using ClamAV and YARA rules, with features like scoring suspect files, building visual tree graphs, and extracting specific patterns.

A Burp Suite plugin for automatically adding XSS and SQL payload to fuzz

Interactive incremental disassembler with data/control flow analysis capabilities.

A Burp plugin for identifying potential vulnerabilities in web applications

Discontinued project for file-less persistence, attacks, and anti-forensic capabilities on Windows 7 32-bit systems.

Yabin creates Yara signatures from malware to find similar samples.

A malware/botnet analysis framework with a focus on network analysis and process comparison.

A malware processing and analytics tool that utilizes Pig, Django, and Elasticsearch to analyze and visualize malware data.

PINNED