XWorm - PyInstaller Suspicious Extraction

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•2

Detects PyInstaller unpacking dropping highly randomized compiled Python bytecode (.pyc) indicative of hidden malware loaders. Specifically looks for .pyc files with 20 or more alphanumeric characters in their name, created in a temporary folder path matching the pattern '_MEI[0-9]+'.