.. /.Pyzw

Executable
Script

Contributors:

mr.d0x

Description:

PYZW or Python Zipped Executable files are Python script files. They must be run by pythonw. By default Python is not installed on Windows. Usually, once Python is installed, .pyzw files are executed via the Pythonw interpreter upon being double clicked.

OS:

Windows
Mac
Linux

Recommendation:

Block the execution of PYZW files. Whitelist users/groups when required.

Resources:

https://www.cyborgsecurity.com/cyborg_labs/python-malware-on-the-rise/

File Samples: