hello-bat-fwi9

{"schema_version":"1.7.4","id":"MAL-2026-18735","published":"2026-11-06T20:33:22Z","modified":"2026-11-08T10:13:03.555588678Z","summary":"Malicious code in hello-bat-fwi9 (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (7c6e2592290251692bc9a99a87bea6d2e945087b27bb872b2a8bbf8bd738a575)\nThe wheel ships a 2.5MB obfuscated hello.bat that is invoked by the package's advertised hello() function and by the hello-bat-fwi9 console_script. On Windows the batch launches a headless conhost, extracts a hidden CPython runtime to %LOCALAPPDATA%\\Programs\\Python3_iFvHdqxj via tar.exe -xf python.zip, and decodes base64 fragments to write a sitecustomize.py into that runtime's site directory so every subsequent interpreter start re-executes the payload. Decoded fragments assemble a Python script that calls the Task Scheduler COM API (Schedule.Service / RegisterTaskDefinition) with SYSTEM/S4U logon fallbacks to install persistent scheduled-task execution, and contain CLR-hosting strings. The batch contains multi-megabyte base64 blobs (one ~1.8MB), scrambled environment-variable names, and set/call goto control-flow obfuscation. The README and METADATA explicitly claim the file is a readable 5-line hello.bat with no persistence, scheduled task, network access, or hidden execution — the shipped artifact performs the opposite, making the declared purpose a cover story. Running the advertised API on Windows yields full-host code execution and persistent compromise of the installer's machine.\n\n## Source: kam193 (915b488501776e1dc1f9c551e0a52310fc6daa8a299b0638f6d5d7f615d1ad8b)\nThe package delivers an obfuscated .bat file delivering a RAT, with the help of its own Python runtime and PTH files. The code requires manually triggering the malicious action. This is most likely a continuation of the campaign 2026-11-filipt.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-11-hello-bat-fwi9\n\n\nReasons (based on the campaign):\n\n\n - obfuscation\n\n\n - rat\n\n\n - abuses-pth\n\n\n - malware\n","affected":[{"package":{"name":"hello-bat-fwi9","ecosystem":"PyPI"},"versions":["0.1.0","0.1.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"artifacts":["hello_bat_fwi9-0.1.1-py3-none-any.whl"],"path":"hello_bat_fwi9/hello.bat","sha256":"319c4294d90f4b81e35e41b95991a70ab026193ca52ceba278e5ca523ecb8f74","tlsh":"3ac533369e272ddc076c633db1ef090a3d8d8bc7a804d2e643ae52da61ad9418fdf415"},{"artifacts":["hello_bat_fwi9-0.1.1-py3-none-any.whl"],"path":"hello_bat_fwi9-0.1.1.dist-info/METADATA","sha256":"969127c732a877bc43f34c93d4df1fb8d4bc3edc9ee283d10e0e669d778a3a10","tlsh":"8691967f6112637dfd3d022629596ad4f31f900e2a360854b34dc29837b8d3cd5ea25d"}],"package_integrity":[{"filename":"hello_bat_fwi9-0.1.1-py3-none-any.whl","hashes":{"blake2b_256":"46db41f42a510c6d17543c1b84cb5d12971493cae2fc4ac1a82f4cd78f046220","md5":"30b4c17e3581ea11994a12c10c19af5b","sha256":"41b8789d8e74a0bdf0edcfb9b285e46fb54999866af3b7003a3477b3c2f4638c"}}]}}}],"references":[{"type":"EVIDENCE","url":"https://www.virustotal.com/gui/file/cac4edbef72bbcb23fe55258b4f4a941235a24bc688f701afbbb125370451223/detection"},{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/hello-bat-fwi9"},{"type":"PACKAGE","url":"https://pypi.org/project/hello-bat-fwi9/0.1.1/"}],"database_specific":{"iocs":{"domains":["r931vmql.free.tryportwarp.cc"]},"malicious-packages-origins":[{"id":"pypi/2026-11-hello-bat-fwi9/hello-bat-fwi9","import_time":"2026-11-06T21:10:24.246377794Z","modified_time":"2026-11-06T20:33:22.583976Z","sha256":"915b488501776e1dc1f9c551e0a52310fc6daa8a299b0638f6d5d7f615d1ad8b","source":"kam193","versions":["0.1.0","0.1.1"]},{"id":"IN-MAL-2026-022575","import_time":"2026-11-08T10:11:09.938455804Z","modified_time":"2026-11-08T09:42:07Z","sha256":"7c6e2592290251692bc9a99a87bea6d2e945087b27bb872b2a8bbf8bd738a575","source":"amazon-inspector","versions":["0.1.1"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}