New KEKW malware infects open source Python Wheel files

The KEKW malware employs a malicious function known as system_information() to gather a wide range of system-related data from infected machines.

Python PYPI

The Python Package Index (PyPI) is a prominent hub for numerous software packages designed for the Python programming language. However, its popularity has made it a prime target for malicious actors seeking to exploit its widespread user base.  

The malware is capable of can stealing sensitive information from compromised systems and performing clipper activities that allow it to hijack cryptocurrency transactions.

In the past, CRIL has encountered many cases where attackers used PyPI packages to distribute malware payloads, and the frequency of infostealers spreading via malicious PyPI packages has also increased.

KEKW malware

KEKW malware terminates its execution if it identifies pre-defined blacklisted hard-coded strings such as the username, computer name, system IP address, or hardware ID. It also checks for security-related processes running on the system.

The KEKW malware employs a malicious function known as system_information() to gather a wide range of system-related data from infected machines.

This function can extract the login username, computer name, Windows product key and version, RAM capacity, HWID, IP address, geographic location, Google Maps information, and other sensitive data. 

As CRIL says ,the following packages were observed spreading KEKW malware:

• pythonsqlitetool-1.0.0
• pipsqlpackageV2-1.0.0
• pipfontingaddonsV2-1.0.0
• pythoncryptoaddition-1.0.0
• pipcoloringsextV1-1.0.0
• syssqlitemods-1.0.0
• syscryptographymodsV2-1.0.0
• syscoloringspkg-1.0.0
• syssqlite2toolsV2-1.0.0
• pythoncolorlibV1-1.0.0
• pythoncryptolibV2-1.0.0
• pythonsqlite2toolsV1-1.0.0
• pycolourkits-1.0.0
• pythoncolouringslibV2-3.0.0
• pythoncolouringslibV2-3.0.2
• pythoncolouringslibV2-3.0.1
• pythoncolouringslibV2-1.0.0
• pysqlite3pkgV2-1.0.0
• pyapicolorv2-0.0.1

By collecting this information, the malware can understand the infected system comprehensively, enabling it to carry out further malicious activities such as financial fraud. 

Recommendation

Updating the software frequently and using reputable antivirus software to ensure maximum protection against cyber threats is essential.

IOCs