Since I’m interested in malicious Python scripts, I found multiple samples that rely on existing libraries. The most-known repository is probably pypi.org[1] that reports, as of today, 567,478 projects! Malware developers are like regular developers: They don’t want to reinvent the wheel and make their shopping across existing libraries to expand their scripts capabilities.

I compiled a list of libraries that are often used by malicious scripts. Warning! These libraries are NOT malicious, they are also used for totally legit purposes. Like many Windows API calls, they are just (ab)used by developers. Here is my top list:

If not available on the victim's computer, these modules can be easily installed using a few lines of code:

import time
from sys import executable

required_modules = [ "module1", "module2", "moduleN" ]
for m in required_modules:
    try:
        import m
    except:
        subprocess.Popen(f"\"{executable}\" -m pip install {m} --quiet", shell=True)
        time.sleep(3)

If you discover more Python libraries sometimes used for malicious reasons, please share! I'd like to keep this list up-to-date!

[1] https://pypi.org/
[2] https://learn.microsoft.com/en-us/windows/win32/perfctrs/using-the-pdh-functions-to-consume-counter-data

Xavier Mertens (@xme)
Xameco
Senior ISC Handler - Freelance Cyber Security Consultant
PGP Key