Python和恶意软件：开发没有混淆的隐形和规避恶意软件
Python and Malware: Developing Stealth and Evasive Malware Without Obfuscation
摘要：
随着恶意活动的不断增加和新攻击载体的利用，有必要评估用于检测它们的防御机制的有效性。为此，我们的工作有两方面的贡献。首先，它引入了一种混淆恶意代码的新方法，以绕过多引擎扫描程序（如VirusTotal）的所有静态检查。有趣的是，我们生成恶意可执行文件的方法并不是基于引入新的打包器，而是基于现有的和广泛使用的Python打包工具的功能的增强，Python可以用于所有类似的打包工具。正如我们所证明的，这个问题是几乎所有防病毒引擎所固有的，而不是Python特有的。第二，我们的工作暴露了著名的沙箱的重大问题，这些沙箱允许恶意软件逃避检查。因此，我们表明，隐形和规避恶意软件可以有效地开发，绕过最先进的恶意软件检测工具，而不会引起任何警报。
英文摘要：
With the continuous rise of malicious campaigns and the exploitation of new attack vectors, it is necessary to assess the efficacy of the defensive mechanisms used to detect them. To this end, the contribution of our work is twofold. First, it introduces a new method for obfuscating malicious code to bypass all static checks of multi-engine scanners, such as VirusTotal. Interestingly, our approach to generating the malicious executables is not based on introducing a new packer but on the augmentation of the capabilities of an existing and widely used tool for packaging Python, PyInstaller but can be used for all similar packaging tools. As we prove, the problem is deeper and inherent in almost all antivirus engines and not PyInstaller specific. Second, our work exposes significant issues of well-known sandboxes that allow malware to evade their checks. As a result, we show that stealth and evasive malware can be efficiently developed, bypassing with ease state of the art malware detection tools without raising any alert.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
