3

I am learning about how malwares work and I read that a lot of them are written in assembly or C to keep the binary size as small as possible.

In an example C++ source code, authors decided to remain mostly with C libraries to avoid the overhead and keep it light.

  • Why is having a very light binary such an advantage for a malware ?
  • Does using low level languages like ASM and C help keep it more stealthy ?
Improve this question
2
  • 3
    It does not have to be small, but if it is the chance of beeing detected is smaller because it needs less resources and less time to become active. It often uses lowlevel functions of the OS to hide itself, that’s easier done in system languages. The part which actually loads/drops payload often needs to be extremely small and restricted „shellcode“ which is generally created in assembler (or with a toolkit which uses handoptimized templates)
    – eckes
    Commented Mar 30, 2019 at 22:25
  • Antivirus tends to have a hard time with small binaries, for one.
    – forest
    Commented Mar 30, 2019 at 22:54

2 Answers 2

Reset to default
4

a lot of them are written in assembly or C to keep the binary size as small as possible.

It's not about the size, but about external dependency.

Malware is usually written in Assembly or C to minimize external dependency. If a malware is written, let's say, in .Net Framework 4.6.2, and the victim runs Windows XP, it will not work. This is why authors remain mostly with C libraries, as they are usually installed on every computer they want to infect.

A small executable written in Assembly will load and execute way faster than a large executable made with ElectronJS, for example. This maximizes the amount of time the malware can be run without the user detecting something amiss. A large malware consuming lots of memory will stand out if the user goes to Task Manager and looks at the resource consumption.

It will demand way less infrastructure from the C&C servers, so the attackers can rent a cheap hosting server and infect a lot of users, or compromise another server to host the malware. A small size means the owner of the compromised server will not detect the infection for a longer time. A large, 100MB malware being sent to thousands of users will alarm anyone taking care of the server.

Improve this answer
1
  • 2
    Not only that, but minimizing dependencies makes heuristics detection harder.
    – forest
    Commented Apr 30, 2019 at 17:32
-1

Exploitation via malware often happens in two phases: 1) delivery, and 2) execution. For example, a victim downloads a malicious attachment from an email (delivery) after which the malware activates itself (execution). During execution, the malware communicates with its Command and Control (C&C) server, which provides instructions to the malware on what to do, but also receives back information about its status and the victim.

For malware delivery via email, it is important that the malware is not too large in size because else the email client won't send it. When contacting the C&C server, the malware downloads the rest of the code (which can be bigger).

So to answer your two questions:

  • It makes it easier to deliver the malware to the victim.
  • No, not necessarily. How malware gets detected is often independent of the language it is written in.
Improve this answer
1
  • This answer doesnt doesn't cover much.There is more to it than attachment's of large size are not allowed in emails.
    – yeah_well
    Commented Apr 30, 2019 at 15:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .