Suspicious Pythonw Payload Execution (ModeloRAT)

Ethan Andrews@eandrews

•updated Feb 9, 2026•5•0•76

Detects the execution of specific Python scripts (modes.py, extentions.py, or udp.pyw) using the silent pythonw.exe interpreter. This activity is associated with the ModeloRAT malware, which is used in the CrashFix campaign, indicating potential persistence or execution of malicious payloads.