hello-bat-fwi9

Source: amazon-inspector (7c6e2592290251692bc9a99a87bea6d2e945087b27bb872b2a8bbf8bd738a575)
The wheel ships a 2.5MB obfuscated hello.bat that is invoked by the package's advertised hello() function and by the hello-bat-fwi9 console_script. On Windows the batch launches a headless conhost, extracts a hidden CPython runtime to %LOCALAPPDATA%\Programs\Python3_iFvHdqxj via tar.exe -xf python.zip, and decodes base64 fragments to write a sitecustomize.py into that runtime's site directory so every subsequent interpreter start re-executes the payload. Decoded fragments assemble a Python script that calls the Task Scheduler COM API (Schedule.Service / RegisterTaskDefinition) with SYSTEM/S4U logon fallbacks to install persistent scheduled-task execution, and contain CLR-hosting strings. The batch contains multi-megabyte base64 blobs (one ~1.8MB), scrambled environment-variable names, and set/call goto control-flow obfuscation. The README and METADATA explicitly claim the file is a readable 5-line hello.bat with no persistence, scheduled task, network access, or hidden execution — the shipped artifact performs the opposite, making the declared purpose a cover story. Running the advertised API on Windows yields full-host code execution and persistent compromise of the installer's machine.

Source: kam193 (915b488501776e1dc1f9c551e0a52310fc6daa8a299b0638f6d5d7f615d1ad8b)
The package delivers an obfuscated .bat file delivering a RAT, with the help of its own Python runtime and PTH files. The code requires manually triggering the malicious action. This is most likely a continuation of the campaign 2026-11-filipt.

---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-11-hello-bat-fwi9

Reasons (based on the campaign):

- obfuscation

- rat

- abuses-pth

- malware