I'm working on pentesting as part of Information Security course. Recently I have been in some Education Oriented Malware... But I have only developed in .NET oriented applications.

How is malware programmed this days and what languages are used for this? C? Java? .NET Programming? Python?

I'm especially interested in keyloggers.

closed as too broad by TildalWave, Deer Hunter, Matthew, LvB, Dog eat cat world Mar 3 '16 at 11:00

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    It depends. Malware for what? – Neil Smithline Mar 3 '16 at 0:32
  • Keyloggers - I have been working on that and other spying processes. Im not interested in ransomware, Just in keloggin and send info to server . For now that's all – NathanWay Mar 3 '16 at 0:33
  • 3
    Malware can be written in any language that can make system API calls. – wireghoul Mar 3 '16 at 0:50
  • Go, Ruby, C++, VBA, whatever suits the needs of the programmer. – schroeder Mar 3 '16 at 2:53
  • Depends on a lot of vectors: size, convenience, pre-build APIs etc. If size matters, go with Assembly/C/C++. Python has some excellent libraries you can use for offensive stuff. Ruby has the advantage of calling Metasploit API and a lot of post exploitation stuff. The new language-in-town is Powershell. It has the advantage of being signed by Microsoft! – void_in Mar 3 '16 at 5:38

The language a malware is written with is irrelevant. First, because at the end, it is all compiled into machine code and second because there is no language dedicated to write malware.

What makes a malware what it is, is its behaviour. Algorithms can be implemented in every language you are interested in.

Obviously, the malware has to be able to trigger the right functions where it is executed, so this might bias the choice of language a bit. You won't write with javascript if you need to get an executable file, but you can use it if your malware is web-based.

So the simplest answer to this would be "whatever floats your boat".

  • Thanks a lot for the answer.I'll user .NET 2.0 then. :) – NathanWay Mar 4 '16 at 0:11

Not the answer you're looking for? Browse other questions tagged or ask your own question.