Polymorphic Python Malware That Mutates Every Time It Runs

A newly spotted Python remote access trojan (RAT) on VirusTotal employs advanced polymorphic and self-modifying techniques, allowing it to alter its code signature on every execution and evade detection, according to VirusTotal submissions. Security researchers identified the sample as SHA256:7173e20e7ec217f6a1591f1fc9be6d0a4496d78615cc5ccdf7b9a3a37e3ecc3c, which scored 2/64 on VT.

The RAT features three distinct function names—self_modifying_wrapper(), decrypt_and_execute(), and polymorph_code()—indicative of on-the-fly mutation capability, and it uses Python’s introspection and serialization modules to mutate its appearance between samples. It wraps critical sections in a self-modifying layer that encrypts and decrypts code in memory via an XOR key, avoiding writing decrypted payloads to disk, and it inserts random junk code, renames variables, and shuffles functions to break detection.

IoCs include the SHA256, VirusTotal score, and indications of a polymorphic layer and an obfuscation module, with guidance to monitor debug.log for transformation entries and memory execution patterns.