ModeloRAT WinPython Execution Chain

Kaung Khant Ko@kaungkhantko

•updated Jun 25, 2026•0•0•1

Detects a multi-stage execution chain where PowerShell is used to download or reference the portable WinPython environment (WPy64-31401), followed by the execution of pythonw.exe within that context, which is indicative of the ModeloRAT malware.