Malicious Python Package Hides Sliver C2 Framework in Fake Requests Library Logo

Cybersecurity researchers have identified a destructive Python package that purports to be an offshoot of the common requests library and has been uncovered concealing a Golang-variation of the Sliver command-and-manage (C2) framework inside a PNG graphic of the project’s logo.

The bundle using this steganographic trickery is requests-darwin-lite, which has been downloaded 417 instances prior to it remaining taken down from the Python Deal Index (PyPI) registry.

Requests-darwin-lite “appeared to be a fork of the at any time-preferred requests package with a number of vital variations, most notably the inclusion of a destructive Go binary packed into a substantial edition of the actual requests side-bar PNG emblem,” software program offer chain security organization Phylum mentioned.

The modifications have been launched in the package’s setup.py file, which has been configured to decode and execute a Base64-encoded command to gather the system’s Universally Unique Identifier (UUID).

In what is an appealing twist, the an infection chain proceeds only if the identifier matches a specific worth, implying that the author(s) behind the deal is looking to breach a unique machine to which they are currently in possession of the identifier obtained through some other usually means.

This raises two choices: Either it is really a highly targeted attack or it’s some type of a tests process forward of a broader campaign.

Should the UUID match, the requests-darwin-lite proceeds to read details from a PNG file named “requests-sidebar-substantial.png,” which bears similarities with the reputable requests package that ships with a related file called “requests-sidebar.png.”

What is different in this article is that although the serious symbol embedded inside of requests has a file dimension of 300 kB, the 1 contained inside requests-darwin-lite is all-around 17 MB.

The binary information hid in the PNG graphic is the Golang-primarily based Sliver, an open up-resource C2 framework which is built to be employed by security specialists in their crimson staff operations.

The precise end aim of the package is at the moment unclear, but the improvement is at the time again a sign that open-supply ecosystems keep on to be an desirable vector to distribute malware.

With a wide bulk of codebases relying on open-source code, the steady inflow of malware into npm, PyPI, and other offer registries, not to point out the current XZ Utils episode, has highlighted the have to have for addressing issues in a systematic method that otherwise can “derail big swaths of the web.”

Located this report intriguing? Abide by us on Twitter  and LinkedIn to study additional unique material we post.

Some parts of this article are sourced from:
thehackernews.com