analyzing-supply-chain-malware-artifacts

name	analyzing-supply-chain-malware-artifacts
description	Investigate supply chain attack artifacts including trojanized software updates, compromised build pipelines, and sideloaded dependencies to identify intrusion vectors and scope of compromise. Use when working with analyzing supply chain malware artifacts.
domain	cybersecurity
subdomain	malware-analysis
tags	["supply-chain","malware-analysis","trojanized-software","solarwinds","3cx","dependency-confusion","software-integrity"]
version	1.0
author	oyi77
license	Apache-2.0
atlas_techniques	["AML.T0010","AML.T0104"]
nist_ai_rmf	["GOVERN-5.2","MAP-1.6","MANAGE-2.2"]
d3fend_techniques	["Platform Hardening","Hardware Component Inventory","Restore Object","Electromagnetic Radiation Hardening","RF Shielding"]
nist_csf	["DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01"]

Analyzing Supply Chain Malware Artifacts

Overview

Supply chain attacks compromise legitimate software distribution channels to deliver malware through trusted update mechanisms. Notable examples include SolarWinds SUNBURST (2020, affecting 18,000+ customers), 3CX SmoothOperator (2023, a cascading supply chain attack originating from Trading Technologies), and numerous npm/PyPI package poisoning campaigns. Analysis involves comparing trojanized binaries against legitimate versions, identifying injected code in build artifacts, examining code signing anomalies, and tracing the infection chain from initial compromise through payload delivery. As of 2025, supply chain attacks account for 30% of all breaches, a 100% increase from prior years.

When to Use

Trigger phrases:

• "analyzing supply chain malware artifacts"

• "Investigate supply chain attack artifacts including trojanized software updates,"

• When investigating security incidents that require analyzing supply chain malware artifacts

• When building detection rules or threat hunting queries for this domain

• When SOC analysts need structured procedures for this analysis type

• When validating security monitoring coverage for related attack techniques

Prerequisites

• Python 3.9+ with pefile, ssdeep, hashlib
• Binary diff tools (BinDiff, Diaphora)
• Code signing verification tools (sigcheck, codesign)
• Software composition analysis (SCA) tools
• Access to legitimate software versions for comparison
• Package repository monitoring (npm, PyPI, NuGet)

Workflow

1. Isolate the sample — ensure the malware is in a sandboxed environment with no network access
2. Record file metadata — hash the sample and note file type, size, and compile timestamp
3. Static analysis — examine strings, imports, and disassembled code without execution
4. Dynamic analysis — execute in a monitored sandbox and record behavior (file, registry, network)
5. Document IOCs — extract indicators of compromise and write the analysis report

Step 1: Binary Comparison Analysis

#!/usr/bin/env python3
"""Compare trojanized binary against legitimate version."""
 hashlib
 pefile
 sys
 json


 ():
    
    legit_pe = pefile.PE(legitimate_path)
    suspect_pe = pefile.PE(suspect_path)

    report = {: [], : [], : []}

    
    legit_sections = {s.Name.rstrip().decode(): {
        : s.SizeOfRawData,
        : s.get_entropy(),
        : s.Characteristics,
    }  s  legit_pe.sections}

    suspect_sections = {s.Name.rstrip().decode(): {
        : s.SizeOfRawData,
        : s.get_entropy(),
        : s.Characteristics,
    }  s  suspect_pe.sections}

    
     name, props  suspect_sections.items():
         name   legit_sections:
            report[].append({
                : name, : ,
                : props[], : (props[], ),
            })
         (props[] - legit_sections[name][]) > :
            report[].append({
                : name, : ,
                : legit_sections[name][],
                : props[],
            })

    
    legit_imports = ()
     (legit_pe, ):
         entry  legit_pe.DIRECTORY_ENTRY_IMPORT:
             imp  entry.imports:
                 imp.name:
                    legit_imports.add()

    suspect_imports = ()
     (suspect_pe, ):
         entry  suspect_pe.DIRECTORY_ENTRY_IMPORT:
             imp  entry.imports:
                 imp.name:
                    suspect_imports.add()

    new_imports = suspect_imports - legit_imports
     new_imports:
        report[] = (new_imports)

    
    report[] = (legit_pe.OPTIONAL_HEADER.DATA_DIRECTORY[].Size)
    report[] = (suspect_pe.OPTIONAL_HEADER.DATA_DIRECTORY[].Size)

     report


 ():
    
    hashes = {}
     (filepath, )  f:
        data = f.read()
     algo  [, , ]:
        h = hashlib.new(algo)
        h.update(data)
        hashes[algo] = h.hexdigest()
     hashes


 __name__ == :
     (sys.argv) < :
        ()
        sys.exit()
    report = compare_pe_files(sys.argv[], sys.argv[])
    (json.dumps(report, indent=))