June 24, 2016
-
Joe Franscella
,

Are You at Risk of Python Malware?

<p>What is Python? Not all Python programs are viruses. Python is a programming language that is used to create all sorts of applications.</p><p>Python code requires another application, PyInstaller to open and execute its instructions. Python malware is often packaged complete with all of its dependencies and with PyInstaller as one unit. The executable file is usually relatively large and is difficult to remove. Once the breach has occurred, enemies can commandeer your processor for spam ads, make fraudulent financial transactions, or steal secrets.</p><p>Python malware is a sophisticated family of malware. Some versions even perform their own form of maintenance: one form, <a href="http://fullcirclemagazine.org/2016/04/20/pwobot-python-malware-family-can-eat-windows-linux-and-os-x/" target="_blank">PWOBot uninstalls previous versions</a> before taking root itself. How can you know if you are at risk? Ask yourself:</p><p><strong>Do you use Windows, MacOS, or Linux?</strong> Python Malware typically affects PCs but it can be ported to a Linux server. Even if you’re running anti-virus and anti-malware protection software on every terminal, you may still fall victim to a devastating attack.</p><p><strong>Do you or your employees open email?</strong> Malicious software or <a href="https://www.anomali.com/blog/the-truth-about-the-dangers-of-malware">malware</a> is often spread through email. An infected computer is automatically forced to locate the victim’s contact list and send malicious emails on their behalf. Many (not all) users know by now not to open emails from strangers. However, when the threat comes from someone familiar, mistakes can be made. This same mistake is made quite frequently, now that viruses perform social intelligence to dupe even discerning users with names and phrases picked from their individual data trail.</p><p><strong>Do you have files on your server, use an email client or host data on your network?</strong> Of course you do. Most businesses and individuals have some files or workstations they consider essential. Even if you do not have anything of value to steal on your network, criminals may still hold your work stations for a “cash” ransom.</p><p>These simple questions illuminate the gravity of the situation: we are all by and large very vulnerable to Python malware and whatever comes after it. Experts estimate that online crime is an epidemic that <a href="http://www.forbes.com/sites/stevemorgan/2016/01/17/cyber-crime-costs-projected-to-reach-2-trillion-by-2019/#16e961763bb0" target="_blank">will cost the US $2.1 trillion</a> in the next few years.</p><p>The magnitude of viruses like Python malware is increasing exponentially. Try and take comfort knowing there are a few things you can do to protect your equipment and the stored information on it. First, being aware of the prevalence of hacking, spying and espionage occurring in business networks and home computers. Taking action before a cyber-security crisis is your best bet.</p><p>Today IOCs number in the tens of millions. Knowing which of these should matter to your organization at any given moment is now a huge challenge and makes finding value in threat intelligence data increasingly difficult. Download the white paper to understand the value of this breakthrough approach.</p><p><span class="hs-cta-wrapper" id="hs-cta-wrapper-b8474223-9140-4d88-8a84-1c87f8974d60"><span class="hs-cta-node hs-cta-b8474223-9140-4d88-8a84-1c87f8974d60" data-hs-drop="true" id="hs-cta-b8474223-9140-4d88-8a84-1c87f8974d60" style="visibility: visible; display: block; text-align: center;"><a class="cta_button" cta_dest_link="{page_3454}" href="https://cta-service-cms2.hubspot.com/ctas/v2/public/cs/c/?cta_guid=d082dffc-00d1-4e32-9613-f9706ead4533&amp;placement_guid=b8474223-9140-4d88-8a84-1c87f8974d60&amp;portal_id=458120&amp;redirect_url=APefjpETWMIdyqejCuAE5mM7OaqJWxCGtapDAi0TkiiZOoQB-Yy7ZrWnecHvL1KQ9xmBmaZYLOwDSnSK2SvCRiG374xXIPXKX1kAnWdYsx7jLJxrhlLNaCOtfEP_eRSXyOoArSXd9Er91SiUXWKHcgHOzqGxB12bNFkgmnvwrbaG5pjaHVJnuhEauXzVa8_omwJoknTXVZm83JDjGMrnWOUD8050sLEzkLpzTC5B8TanBLRkmQLU3bV17EfWlA5mZmU76Dvd8qOxNf6PVIQsufGY7gZe3dVx0ZkcdJORyZnTKZ09GctjgxIbkMtn8VjPE9yjc--Zd2d5E7sjouCDZ2h0-czT20Xf0Cc340b-DwlWkbPJoon8-ICn7XT65KMEnsPoR4eFLAQc&amp;hsutk=2767d93d6471d657e0c9f660e4b58ef8&amp;utm_referrer=https%3A%2F%2Fblog.anomali.com%2Fare-you-at-risk-of-python-malware&amp;canon=https%3A%2F%2Fblog.anomali.com%2Fare-you-at-risk-of-python-malware&amp;pageId=4187938149&amp;__hstc=41179005.2767d93d6471d657e0c9f660e4b58ef8.1456736058655.1478822660171.1478831861868.179&amp;__hssc=41179005.102.1478831861868&amp;__hsfp=1335165674" id="cta_button_458120_d082dffc-00d1-4e32-9613-f9706ead4533" style="margin: 20px auto;" target="_blank" title="Download Here">Download Here </a> </span> <script charset="utf-8" src="https://js.hscta.net/cta/current.js"></script> <script type="text/javascript">hbspt.cta.load(458120, 'b8474223-9140-4d88-8a84-1c87f8974d60', {});</script> </span></p>

Get the Latest Anomali Updates and Cybersecurity News – Straight To Your Inbox

Become a subscriber to the Anomali Newsletter
Receive a monthly summary of our latest threat intelligence content, research, news, events, and more.