Can malware infect more than one operating system?

Question

Is it possible for malware to be written in a low-level language such as C or C++ and do the following:

1. Infect a single operating system (such as Windows)
2. Detect other machines on the same network
3. Determine other machines operating systems
4. If the operating system is the same (Windows) attempt a similar attack
5. If the operating system is different (OSX or Linux) use quine or download a small attack module to attack the different operating system

TL;DR: Can a C or C++ virus attack multiple operating systems?

Here is a recent article of what I am talking about: http://thehackernews.com/2016/09/cross-platform-malware.html

Answer 1

Short answer: certainly. Remember that once your system is compromised (step 1 in your question), and attacker can perform downloads and run ARBITRARY code. A common approach is "fingerprint and drop", wherein the malware determines the characteristics of your system, and downloads appropriate payloads to execute the attack.

An example of a worm which runs on Windows but is designed to attack another system would be Stuxnet.

An example of malware which fingerprints and drops would be any exploit kit (for example, Angler) that uses drive by downloads.

Answer 2

I recently reviewed a student's homework assignment that was written in Python, that:

• Creates a new temporary directory/folder
• Does some stuff in that folder
• Moves the output file to the parent directory/folder
• Deletes the temporary folder

Well at least thats what he thought it did. It actually deletes whatever the current directory is, including the output file.

I gave him an 8/10. -5 points for accidentally deleting the current directory and not having suitable tests. +3 for making it cross-system compatible.

EDIT: Oh, i didn't see the bit about the malware having to be C and C++. Since Python is compiled at runtime, I think the answer still stands though. It's an irrelevant distinction regardless. The Python/Java could have downloaded whatever pre-compiled binary it needed for whatever system it was on, and run that, if the malware really had to be C. Else it could have been a polyglot of Python/C that compiled itself.