The Anatomy of a Malicious Package Logo

The Anatomy of a Malicious Package

0
Free
Visit Website

What does a malicious package actually look like in practice? We'll walk through some hypothetical exercises to see how malware generally works, and what sort of functions we might expect, from relatively simple and temporary, to complex. Additionally, as we are focused primarily on Javascript for this post, we really need to think about two different threat models: what does in-browser malware look like, and how is that going to differ from on-host malware? Attacker Motivations and Mentality As we begin this thought experiment, the first thing to consider is what a potential attacker's targets and goals would be. On-Host The whole concept of "on-host" malware in NPM packages seems a bit unintuitive at first blush, as the immediate association is generally with browser-focused concerns - which must be safe, since the run in the browser sandbox. There are, interestingly enough, some serious advantages from an attacker's perspective.

FEATURES

ALTERNATIVES

A malware/botnet analysis framework with a focus on network analysis and process comparison.

Largest open collection of Android malware samples, with 298 samples and contributions welcome.

A disassembly framework with support for multiple hardware architectures and clean API.

VMCloak is a tool for creating and preparing Virtual Machines for Cuckoo Sandbox.

angr is a Python 3 library for binary analysis with various capabilities like symbolic execution and decompilation.

A suite of secret scanners built in Rust for performance.

A simple framework for extracting actionable data from Android malware

Joe Sandbox Community provides automated cloud-based malware analysis across multiple OS platforms.

CyberSecTools logoCyberSecTools

Explore the largest curated directory of cybersecurity tools and resources to enhance your security practices. Find the right solution for your domain.

Copyright © 2024 - All rights reserved