Potentially Suspicious PyInstaller Executable

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects execution of potentially suspicious PyInstaller executables that have been packaged with python code which may include malicious payloads. PyInstaller is a popular tool for packaging Python applications into standalone executables, but it can also be used by adversaries to wrap and obfuscate malicious python code into a single executable file.

Internal Research

2026-01-27 00:00:00

None

5f4f7248-2fff-4b91-8976-af7e7a1bbb6e

attack.execution attack.t1204.002 attack.defense-evasion attack.t1027

Nextron Sigma feed only (private)