I am learning about how malwares work and I read that a lot of them are written in assembly or C to keep the binary size as small as possible.

In an example C++ source code, authors decided to remain mostly with C libraries to avoid the overhead and keep it light.

  • Why is having a very light binary such an advantage for a malware ?
  • Does using low level languages like ASM and C help keep it more stealthy ?
  • 3
    It does not have to be small, but if it is the chance of beeing detected is smaller because it needs less resources and less time to become active. It often uses lowlevel functions of the OS to hide itself, that’s easier done in system languages. The part which actually loads/drops payload often needs to be extremely small and restricted „shellcode“ which is generally created in assembler (or with a toolkit which uses handoptimized templates)
    – eckes
    Mar 30 '19 at 22:25
  • Antivirus tends to have a hard time with small binaries, for one.
    – forest
    Mar 30 '19 at 22:54

a lot of them are written in assembly or C to keep the binary size as small as possible.

It's not about the size, but about external dependency.

Malware is usually written in Assembly or C to minimize external dependency. If a malware is written, let's say, in .Net Framework 4.6.2, and the victim runs Windows XP, it will not work. This is why authors remain mostly with C libraries, as they are usually installed on every computer they want to infect.

A small executable written in Assembly will load and execute way faster than a large executable made with ElectronJS, for example. This maximizes the amount of time the malware can be run without the user detecting something amiss. A large malware consuming lots of memory will stand out if the user goes to Task Manager and looks at the resource consumption.

It will demand way less infrastructure from the C&C servers, so the attackers can rent a cheap hosting server and infect a lot of users, or compromise another server to host the malware. A small size means the owner of the compromised server will not detect the infection for a longer time. A large, 100MB malware being sent to thousands of users will alarm anyone taking care of the server.

  • 2
    Not only that, but minimizing dependencies makes heuristics detection harder.
    – forest
    Apr 30 '19 at 17:32

Exploitation via malware often happens in two phases: 1) delivery, and 2) execution. For example, a victim downloads a malicious attachment from an email (delivery) after which the malware activates itself (execution). During execution, the malware communicates with its Command and Control (C&C) server, which provides instructions to the malware on what to do, but also receives back information about its status and the victim.

For malware delivery via email, it is important that the malware is not too large in size because else the email client won't send it. When contacting the C&C server, the malware downloads the rest of the code (which can be bigger).

So to answer your two questions:

  • It makes it easier to deliver the malware to the victim.
  • No, not necessarily. How malware gets detected is often independent of the language it is written in.
  • This answer doesnt doesn't cover much.There is more to it than attachment's of large size are not allowed in emails.
    – yeah_well
    Apr 30 '19 at 15:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.