A Deep Dive into 70 Layers of Obfuscated Info-Stealer Malware

https://medium.com/checkmarx-security/a-deep-dive-into-70-layers-of-obfuscated-info-stealer-malware-bdeeac0f04db

by akyuu • 3 years ago

13 3 3 years ago

I wonder why certain usernames are blocked. Are they typically honeypots or something?

muhehe• 3 years ago

This article feels weird to me. It starts (in about 3 bullet points) with mentioning super duper 70layers of obfuscated supermalwar; how their company is awesome and unbeatable and finally that their customers are safe. Then there is very shallow text of several "this steals your X" without much details.

This ad sucks.

ashishbijlani• 3 years ago

I've been building Packj [1] to detect exactly such attacks. It can flag dummy, malicious, abandoned, typo-squatting, and other "risky" PyPI/NPM/Ruby/PHP/Maven/Rust packages by carrying out static/dynamic/metadata analysis.

It scans for 40+ attributes such as num funcs/files, spawning of shell, use of SSH keys, network communication, use of decode+eval, etc. to flag risky packages. Packj Github action [2] can alert if a risky dependency is pulled into your build.

1. https://github.com/ossillate-inc/packj 2. https://github.com/ossillate-inc/packj-github-action

A Deep Dive into 70 Layers of Obfuscated Info-Stealer Malware

Related Stories