Python-Packed Payload
Malware whose executable logic is written in Python, then distributed inside a PE via PyInstaller, py2exe, or cx_Freeze. The outer PE is a benign-language bootloader; the threat logic lives in compiled .pyc or .pyz archives hidden in the PE overlay.
Why it matters
Static analysis of the outer PE yields only standard Win32 imports and CPython API strings. Mining pools, C2 URLs, wallet addresses, and malicious logic are invisible until the overlay is extracted and the Python bytecode decompiled. Triage teams that stop at the import table will miss the threat entirely.
Variants
- PyInstaller onefile — most common. CFFI archive appended past PE sections, extracted to
%TEMP%\_MEI*. Observed in the coinminer Sep 2018 cluster and the pyinstaller-pyarmor-dropper family. - PyArmor obfuscation — Python source/bytecode encrypted by PyArmor, decrypted at runtime via
pyarmor_runtime.pyd. Blocks naive.pycdecompilation. - py2exe/cx_Freeze — older alternatives with similar overlay mechanics but different archive formats.
Cross-references
- pyinstaller-bootloader — the C stub that unpacks and runs the payload
- coinminer — family that frequently uses this distribution method
- pyinstaller-pyarmor-dropper — newer variant with runtime-encrypted C2