New Polymorphic Python Malware Repeatedly Mutate its Appearance at Every Execution Time

A newly identified Python-based remote access trojan (RAT), exhibiting significant polymorphic behavior, has been observed to alter its code signature with each execution.

Initially detected on VirusTotal, the sample, named nirorat.py , achieved a detection score of just 26/100, despite possessing comprehensive RAT capabilities.

The malware appears to utilize Python’s introspection and code-modification features to bypass signature-based detection by continuously modifying key code sections.

Internet Storm Center analysts identified the threat by correlating function names such as selfmodifyingwrapper , decryptandexecute , and polymorphcode in the source code.

These functions facilitate the malware’s evasion tactics by extracting its own code from memory, applying randomized XOR-based packing, and injecting junk snippets prior to execution. This dynamic mutation ensures each execution is unique, complicating detection by static scanners.

The RAT is primarily distributed via phishing emails containing seemingly benign Python scripts, as well as through compromised network shares. During execution, it unpacks itself entirely in memory, avoiding disk artifacts.

Persistence is maintained by appending a copy of the mutated script to startup folders with randomized filenames. The low VirusTotal detection score indicates that traditional file-hash signatures are largely ineffective against this threat.

The RAT employs two primary mechanisms for detection evasion: self-modification and junk-code insertion.

At runtime, the selfmodifyingwrapper function retrieves a target routine’s source using Python’s inspect module, encodes it through XOR with a random key, and then reconstructs it in memory before execution.

This approach closely simulates a packer’s behavior without leaving a packed file footprint on disk.

def selfmodifyingwrapper(func): code = inspect.getsource(func).encode() key = random.randint(1,255) packed = bytes(b ^ key for b in code) unpacked = bytes(b ^ key for b in packed) codeobj = marshal.loads(zlib.decompress(unpacked)) exec(codeobj)

Additionally, the polymorphcode function injects random junk elements—such as unused functions, shuffled variable names, and no-op loops—into core routines.

By combining variable renaming and random snippet insertion, the malware generates a virtually unique source at each run, undermining both static signature and heuristic detection approaches.

Due to these advanced evasion strategies, defenders are advised to rely on behavioral analysis and real-time monitoring rather than traditional signature-based tools.

Based on reporting by Cyber Security News.