Malicious Python Script with a "Best Before" Date, (Thu, Jun 6th)

When you buy some fresh food, it’s always a good idea to keep an eye on the best-before date. I found a funny piece of malicious Python script that implements the same technique. It will execute only before a specified date (Jun 10th in this case). The script purpose is classic: it will fetch a payload from a remote site, inject it in memory and start a new thread. Such payload are usually related to CobaltStike. I think that the …

case date food found funny good idea malicious piece purpose python python script script