Suspicious Python Runtime Staging

Aaron Beardslee@abeardslee

•updated Mar 3, 2026•2•0•59

Detects the download and staging of an official Python embedded runtime zip file from python.org into suspicious user-writable directories like %TEMP% or %LOCALAPPDATA%, followed by its extraction. This is a key staging technique used by malware like VOID#GEIST to ensure its scripts can execute regardless of the victim's environment.