syswatch

{"schema_version":"1.7.4","id":"MAL-2026-15811","published":"2026-09-01T21:27:36Z","modified":"2026-09-02T02:46:18.215867515Z","summary":"Malicious code in syswatch (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (740c9125f18d68081f742b3316d07c54727fb4aab5555a398c0c04e31ba9bb54)\nImporting syswatch starts a background thread that, on Windows, fetches a JSON manifest from https://github-repo.up.railway.app/vbv_a8F3kL92xQ/manifest.json, downloads the executable referenced by manifest.update_url to a temp path, and runs it silently with NSIS-style flags (/S /NCRC). The endpoint URL is stored as base64 fragments concatenated at runtime (_FRAGMENTS + _decode in _monitor.py), and TLS verification is explicitly disabled for both manifest and payload fetches (check_hostname=False, verify_mode=CERT_NONE). After execution the code launches a ServiceHelperUtility.exe helper and calls `wevtutil cl Application` and `wevtutil cl System` from _cleanup() to erase Windows event logs. The host github-repo.up.railway.app is a Railway-hosted lookalike of GitHub, not a GitHub-owned domain. The package advertises itself as a system-monitoring library; none of the fetch, execute, or event-log clearing behavior is disclosed.\n\n## Source: kam193 (e01fd8b85a9d6bdfbefb70261f49496f8a6c224d98da6400ef0ca06f18404d27)\nDuring import, malicious code is started in the background. On Windows, it downloads and installs a malicious executable, and disguises it as a system utility. After installation, the code attempts to cover its tracks by cleaning logs and removing downloaded files. The installed executable is a heavily obfuscated malware with multiple sandbox evasion techniques, finally running an infostealer identifying itself as \"Snow Stealer\". It collects at least browser data and modifies cryptowallet applications.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-08-envprovision\n\n\nReasons (based on the campaign):\n\n\n - infostealer\n\n\n - Downloads and executes a remote executable.\n\n\n - obfuscation\n\n\n - action-hidden-in-lib-usage\n\n\n - exfiltration-browser-data\n\n\n - The package contains code to detect if it is running in a sandbox environment.\n\n\n - exfiltration-crypto\n\n\n - malware\n\n\n - covering-tracks\n\n\n - persistence\n","affected":[{"package":{"name":"syswatch","ecosystem":"PyPI"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"src/syswatch/__init__.py","sha256":"41c014b825f35800e609f6ca971c149ce73ddfc96ab5ba813268c63b199dcd68","tlsh":"20014c73bc47547b04f8b86d205892b0e73b15173e118919b968f7386f3545065a623e"},{"path":"src/syswatch/_monitor.py","sha256":"6c974b8f00d0606e4e0a2d1c9caea1ec2703196169c1cdb8ee514ce948075e0b","tlsh":"f16112ba4c8fe0528172920d5c198416d32782571faa0415bcec47275ff9e36acfc9be"},{"path":"src/syswatch/_process.py","sha256":"d2a869a9f845973a1ce17772522cb076ee1a5000f20be996ba3026db4131c9da","tlsh":"34210661ed1f50019ab2806f65269492dadb0b43d786487778fdca707f3a071d1a1d2f"}],"package_integrity":[{"filename":"syswatch-1.0.0-py3-none-any.whl","hashes":{"blake2b_256":"9943467f81a8ac9db54e16e5e19d9a7c58f9d9b90b8cf0b32511dfd7ed854f73","md5":"8409f7478e1f7026425de1702363694a","sha256":"003525e4be1a7dc9bb18be3fa7e58323ab713ac698e154e48810208aa9293652"}},{"filename":"syswatch-1.0.0.tar.gz","hashes":{"blake2b_256":"f76b0bf6a6de42bc0ffbf017812943766c19e86390644da2fbae82dc60a950e7","md5":"8d4ad1127a7b0222d254d8c1f5eda866","sha256":"2cbc5bf99eb4ed68ef6897081bf7be95307acdbc10c9d669fcfaa9c41b3591af"}}]}}}],"references":[{"type":"EVIDENCE","url":"https://www.virustotal.com/gui/file/d49fa53949d9350ee34c4e1279ee72e6fafc294ae338825f66c33c7f188b878c/details"},{"type":"WEB","url":"https://www.virustotal.com/gui/file-analysis/MGQ3ZGViMWFhYzU0YjY3ODllZWI1ZGJkMDY4Nzk3NGM6MTc4NzUxODgyOQ=="},{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/syswatch"},{"type":"PACKAGE","url":"https://pypi.org/project/syswatch/1.0.0/"}],"database_specific":{"iocs":{"domains":["env-metadata.up.railway.app","ivahook.online"],"urls":["https://env-metadata.up.railway.app/vbv_a8F3kL92xQ/manifest.json","https://env-metadata.up.railway.app/vbv_a8F3kL92xQ/appsetupw.exe","https://energy-total.up.railway.app/vbv_a8F3kL92xQ/manifest.json"]},"malicious-packages-origins":[{"id":"pypi/2026-08-envprovision/syswatch","import_time":"2026-09-01T21:38:05.941832763Z","modified_time":"2026-09-01T21:27:36.579439Z","sha256":"863ff540be3399380239a471217fc84175f06c66bedc0fc0f89901fbaae46a38","source":"kam193","versions":["1.0.0"]},{"id":"pypi/2026-08-envprovision/syswatch","import_time":"2026-09-01T22:15:54.378683915Z","modified_time":"2026-09-01T21:27:36.579439Z","sha256":"e01fd8b85a9d6bdfbefb70261f49496f8a6c224d98da6400ef0ca06f18404d27","source":"kam193","versions":["1.0.0"]},{"id":"IN-MAL-2026-019321","import_time":"2026-09-02T02:44:33.373128806Z","modified_time":"2026-09-02T02:19:16Z","sha256":"740c9125f18d68081f742b3316d07c54727fb4aab5555a398c0c04e31ba9bb54","source":"amazon-inspector","versions":["1.0.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"ANALYST"}]}