All-Python malware nasty bites Windows victims in Poland
April 20, 2016
Shah Sheikh (1294 articles)

All-Python malware nasty bites Windows victims in Poland

Malware authors have put together a strain of malicious code written entirely in Python, in what may turn out to be an experiment in creating a new type of cross-platform nasty.

PWOBot is written entirely in Python, and compiled via PyInstaller to generate a Microsoft Windows executable.

The malware has already infected a number of Europe-based organisations, particularly in Poland, according to new research.

Distribution routes include the popular Polish file-sharing web service Victims include a Polish national research institution, a Polish shipping company, a large Polish retailer, a Polish information technology organisation, a Danish building company and a French optical equipment provider.

“The malware itself provides a wealth of functionality, including the ability to download and execute files, execute Python code, log keystrokes, spawn a HTTP server, and mine Bitcoins via the victim’s CPUs and GPUs, according to security researchers at Palo Alto Networks.

The underlying code is cross-platform, so the nasty might easily be ported over to the Linux and OS X operating systems. That fact, coupled with a modular design, makes PWOBot a potentially significant threat.

More details on the nasty – including code extracts and other insights – can be found in a blog post by Palo Alto here. ®

Source | TheRegister