Skip to content

MALICIOUS (1) campaign cataloged at 2026-11-06(2).

  1. The campaign has clearly malicious intent, like infostealers.
  2. This is just the date of creating the catalog entry. It may not reflect the date of creation of the campaign itself.

2026-11-hello-bat-fwi9

The package delivers an obfuscated .bat file delivering a RAT, with the help of its own Python runtime and PTH files. The code requires manually triggering the malicious action. This is most likely a continuation of the campaign 2026-11-filipt.

Abuse categories

RAT

Malicious activity is typical for Remote Access Trojans (RATs).

abuses-pth

The package uses .pth files, sitecustomize or usercustomize modules to execute malicious code during Python startup, even without importing the package code manually.

malware

Package contains or installs known malware.

obfuscation

Code uses obfuscation techniques to hide its true purpose.

References

Referenced resources may include blog posts about the campaign, malware analysis, sandbox reports, or other relevant information.

URLs with payloads, characteristic domains, C&C IPs, repositories with malicious code, etc.

  • r931vmql.free.tryportwarp.cc

Packages in the campaign

campaign:2026-11-hello-bat-fwi9