Malware Hunting - Using python as an attack weapon
summary
Python scripts pull malware from the MalwareBazaar API and drop samples on a VM to measure signature, NGAV and ML detection; a daily batch test unpacks >200 samples unpacked from one date and shows CyberReason deletes almost all while Sophos misses ~100 and spikes CPU/memory, degrading protection. A separate script opens a reverse shell via Python socket to validate runtime defenses; CrowdStrike’s signature-only config fails to block download-and-execute flows despite aggressive policy.
AI-written summary · about
chapters (7)
- 0:00Malware hunting intro
- 2:57Understanding threats
- 8:11Python for malware tests
- 11:22First detection test
- 15:38Simulating infection breaks
- 20:59Reverse shell attack
- 21:22Q&A
related talks
33mBasic Malware Analysis for Incident Responders
46mLiving off the Cloud: A Server-Free Approach to Malware Ops
47mDetecting and analyzing files-less malware
18mMac-A-Mal: An Automated Platform for Mac Malware Hunting
40mAnalyzing Windows Malware on Linux: Getting Started Tips and Examples
48mCatch me if you can: Building a Web Malware Analyzer using Machine Learning
40mHunt and Gather: Developing Effective Threat Hunting Techniques
56mAutomating Linux Malware Analysis Using Limon Sandbox