MalDet · Static Security Report
This repository shows clear signs of malicious intent rather than just poor coding practices. The most serious issue is that the code contains active cryptocurrency mining tools and reverse shells, which are designed to steal money or control other computers, not just cause temporary errors. While there are some standard security warnings about using insecure file permissions and FTP protocols, these are common mistakes in many projects and do not indicate that the entire system is unsafe. The presence of known malware evasion techniques like checking for debuggers before running code further confirms that this is a botnet or mining farm rather than a legitimate application. You should not use this repository as it poses a high risk of financial loss and data theft if accessed by an attacker.
Written by a language model running locally on the scanning machine, from the findings in this report. The risk levels above and below were decided by the scoring model, not by this summary.
MalDet scores two different questions separately, because they call for different responses: code can be badly written without being hostile, and hostile code is not always badly written.
| Detector | Looks for | High | Medium | Low | Total |
|---|---|---|---|---|---|
| bandit | Insecure coding patterns in Python source | 72 | 104 | 79 | 255 |
| yara | Signatures of malicious behaviour in source files | 88 | 0 | 25 | 113 |
| clamav | Known malware signatures | 1 | 0 | 0 | 1 |
28 of 369 findings were rated more likely genuine than noise by the classifier.
Identical findings are grouped, so a single rule firing many times takes one row. Ordered worst first. “Seen” is how many times that finding occurred.
| Severity | Detector | Finding | Seen | Example location |
|---|---|---|---|---|
| high | clamav | ClamAV detected: Win.Coinminer.Generic-7151250-0 | 1 | /web-gui/buildyourownbotnet/modules/xmrig/xmrig_win32 |
| high | bandit | FTP-related functions are being called. FTP is considered insecure. Use SSH/SFTP/SCP or some other encrypted protocol. | 5 | /web-gui/buildyourownbotnet/modules/util.py:544 |
| high | bandit | A FTP-related module is being imported. FTP is considered insecure. Use SSH/SFTP/SCP or some other encrypted protocol. | 8 | /byob/modules/util.py:529 |
| high | yara | YARA rule matched: detect_reverse_shell — Reverse shell command patterns | 1 | /web-gui/docker-pyinstaller/entrypoint-linux.sh |
| high | yara | YARA rule matched: detect_crypto_miner — Cryptocurrency mining pool connection patterns | 12 | /.git/index |
| high | bandit | Starting a process with a shell, possible injection detected, security issue. | 24 | /web-gui/buildyourownbotnet/modules/process.py:128 |
| high | bandit | subprocess call with shell=True identified, security issue. | 35 | /byob/modules/persistence.py:115 |
| high | yara | YARA rule matched: detect_anti_analysis — Checks for a debugger, VM, or sandbox before continuing - a common malware evasion technique, essentially never present in ordinary application code | 3 | /byob/core/stagers.py |
| high | yara | YARA rule matched: detect_base64_exec — Encoded payload decoded and then executed | 9 | /byob/client.py |
| high | yara | YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone | 22 | /web-gui/buildyourownbotnet/core/stagers.py |
| high | yara | YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together | 31 | /web-gui/buildyourownbotnet/assets/js/codemirror/keymap/vim.js |
| high | yara | YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this | 10 | /web-gui/docker-pyinstaller/Dockerfile-py2-win32 |
| medium | bandit | Deserialization with the marshal module is possibly dangerous. | 6 | /web-gui/buildyourownbotnet/core/loader.py:166 |
| medium | bandit | Chmod setting a permissive mask 0o1411 on file (target). | 5 | /web-gui/buildyourownbotnet/modules/util.py:362 |
| medium | bandit | Chmod setting a permissive mask 0o1363 on file (mas). | 2 | /web-gui/buildyourownbotnet/modules/icloud.py:41 |
| medium | bandit | Use of weak MD5 hash for security. Consider usedforsecurity=False | 4 | /web-gui/buildyourownbotnet/core/dao.py:110 |
| medium | bandit | Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. | 20 | /web-gui/buildyourownbotnet/core/dummy_payload_for_testing.py:93 |
| medium | bandit | Possible SQL injection vector through string-based query construction. | 1 | /byob/core/database.py:242 |
| medium | bandit | Use of possibly insecure function - consider using safer ast.literal_eval. | 5 | /byob/core/payloads.py:330 |
| medium | bandit | Use of exec detected. | 16 | /byob/core/util.py:450 |
| medium | bandit | Possible binding to all interfaces. | 8 | /web-gui/buildyourownbotnet/server.py:123 |
| medium | bandit | Probable insecure usage of temp file/directory. | 31 | /web-gui/buildyourownbotnet/modules/util.py:549 |
| medium | bandit | Call to requests without timeout | 6 | /web-gui/buildyourownbotnet/modules/util.py:221 |
| low | bandit | Possible hardcoded password: 'helloworld' | 1 | /web-gui/buildyourownbotnet/config.py:10 |
| low | bandit | Starting a process without a shell. | 4 | /byob/core/payloads.py:599 |
| low | bandit | Starting a process with a shell: Seems safe, but may be changed in the future, consider rewriting without shell | 5 | /web-gui/buildyourownbotnet/core/dummy_payload_for_testing.py:684 |
| low | bandit | Consider possible security implications associated with the subprocess module. | 15 | /web-gui/buildyourownbotnet/api/payload/routes.py:2 |
| low | bandit | Starting a process with a partial executable path | 8 | /web-gui/buildyourownbotnet/api/payload/routes.py:37 |
| low | bandit | subprocess call - check for execution of untrusted input. | 15 | /web-gui/buildyourownbotnet/server.py:140 |
| low | yara | YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version | 25 | /web-gui/buildyourownbotnet/modules/util.py |
| low | bandit | Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. | 31 | /web-gui/buildyourownbotnet/client.py:377 |