In September 2021 Black Lotus Labs (BLL) posted a blog entry discussing a payload loader that was:

  • written in Python
  • compiled to an ELF exe using PyInstaller in Debian in WSL
  • and "injected into a running process using Windows API calls"

BLL states they were able to develop a proof of concept. However, a post from 2015 on Stack Exchange states it's not possible to make calls to the Windows API because of the pico process architecture (I think that's what they meant).

What approaches can be used to develop such a proof-of-concept, or be of use to develop mitigations or detections.

1 Answer 1


While I am happy to accept other answers in case mine is wrong, I just came up with this answer by visiting the WSL website and watching seeing the video.

While I expect to do more research into the differences between WSL and WSL2, the video states WSL gives developers the ability to communicate with Windows processes using AF Unix sockets, and that an application can be running in both a Linux process and a Windows process at the same time.

I guess a lot has happened since 2015 :).

  • 1
    WSL allows interop between Windows and Linux applications through an AF_UNIX socket. This is just standard networking, it doesn't run an application as two processes at the same time. That doesn't make any sense. ctype is just a normalized wrapper around loading modules, resolving symbols, and calling functions. Under Linux, no DLL will load or be resolved. The same is true for WSL(2). That malware simply spawned Windows subprocesses. WSL uses the path to determine if it's running a Windows or Linux application. Nov 4, 2023 at 17:36
  • 1
    You can see in that blog post that one variant is using powershell while the other is using another compiled Python process. That article also clearly states: "The variant written in Python that does not utilize any Windows API appeared to be the earliest iteration of the loader file". So it's just a Python script the spawn other processes. Nov 4, 2023 at 17:36
  • Thanks @MargaretBloom I probably missed that note about the Python script.
    – Rick
    Nov 6, 2023 at 16:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .