base64_payload2.py

PYTHON

HOSTILE

Mal-ecule

Size 1.2 KB download

First seen 117 days ago

Analyzed 117 days ago

Ecosystem malcontent-samples

Objectives

anti-static/obfuscation C2 payload decoded from base64

supply-chain Fake PyPI payload downloader

anti-static/obfuscation/eval Base64 decode with exec execution

command-and-control/dropper/delivery Background exec with devnull

persistence/login Malicious .pth file execution pattern (import; exec)

command-and-control/infrastructure PHP URL endpoint (often used for C2)

anti-static/obfuscation/code-metrics Very long lines (>1000 chars)

anti-static/obfuscation/payload Python source extension basename

command-and-control/dropper open() function call

credential-access/browser base64 module import

fs/chmod chmod +x (make executable)

process/create Executes shell commands via Python

process/interpreter Python exec() built-in function

communications/http HTTPS protocol prefix

data/decode Calls base64.b64decode (Python)

fs/file Opens a file

os/sysinfo Python sys.platform conditional check

lang/encoded python code encoded in string

encoded-payload Encoded payload detected: base64

import imports base64

20 of 23 traits shown

SHA-256	359ac90df5619ebd25a635df5d86d40b8abe598368a4b05633ac71bf34158cd3
Filename	base64_payload2.py

Not seeing what you expected? Let us know