Researchers Uncover Obfuscated Malicious Code in PyPI Python Packages

Feb 10, 2023Ravie LakshmananSupply Chain / Software Security

Four different rogue packages in the Python Package Index
(PyPI) have been found to carry out a number of malicious
actions, including dropping malware, deleting the netstat utility,
and manipulating the SSH authorized_keys file.

The packages in question are aptx^[1], bingchilling2^[2], httops^[3], and tkint3rs^[4], all of which were
collectively downloaded about 450 times before they were taken
down. While aptx is an attempt to impersonate Qualcomm’s highly popular
audio codec^[5] of the same name, httops
and tkint3rs are typosquats of https and tkinter, respectively.

“Most of these packages had well thought out names, to purposely
confuse people,” Security researcher and journalist Ax Sharma
said^[6].

An analysis of the malicious code injected in the setup script
reveals the presence of an obfuscated Meterpreter payload^[7]
that’s disguised as “pip^[8],” a legitimate package
installer for Python, and can be leveraged to gain shell access to
the infected host.

Also undertaken are steps to remove the netstat^[9] command-line utility
that’s used for monitoring network configuration and activity as
well as modifying the .ssh/authorized_keys file^[10] to set up an SSH
backdoor for remote access.

“Now this is a sleek but real world example of damaging malware
that successfully made its way into the open source ecosystem,”
Sharma noted.

But in a sign that malware sneaking into the software
repositories are a recurring threat, Fortinet FortiGuard Labs
uncovered five different packages – web3-essential^[11], 3m-promo-gen-api^[12], ai-solver-gen^[13], hypixel-coins^[14], httpxrequesterv2^[15], and httpxrequester^[16] – that are engineered^[17] to harvest and exfiltrate^[18] sensitive
information.

The disclosures come as ReversingLabs sheds light on a malicious
npm module named aabquerys that’s designed to masquerade as the
legitimate abquery package to trick developers into downloading
it.

The obfuscated JavaScript code, for its part, comes with
capabilities to retrieve a second-stage executable from a remote
server, which, in turn, contains an Avast proxy binary (wsc_proxy.exe^[19]) that’s known to
vulnerable to DLL side-loading^[20] attacks.

This enables the threat actor to invoke a malicious library
that’s engineered to fetch a third-stage component, Demon.bin, from
a command-and-control (C2) server.

“Demon.bin is a malicious agent with typical RAT (remote access
trojan) functionalities that was generated using an open source,
post-exploitation, command-and-control framework named Havoc^[21],” ReversingLabs
researcher Lucija Valentić said^[22].

Furthermore, the author of aabquerys is said to have published
multiple versions of two other packages named aabquery and
nvm_jquery that are suspected to be early iterations of
aabquerys.

Havoc is far from the only C2 exploitation framework detected in
the wild, what with criminal actors leveraging custom suites such
as Manjusaka, Covenant, Merlin, and Empire in malware
campaigns.

The findings also underscore the growing^[23] risk^[24] of nefarious packages^[25] lurking in open source
repositories like npm and PyPi, which can have a severe impact on
the software supply chain.