VULNpocalypse
MediumEcosystem changeMonitoring

Armorsteal Python malware kit steals data and mines crypto, Seqrite reports

Seqrite reports Armorsteal, a Python kit that steals data and mines crypto on Windows; check for its scheduled tasks and Defender exclusions.

Published
Exploitation
Yes, Seqrite reports analysing one infected Windows machine running the kit

What happened

Seqrite Labs reports that it analysed an infected Windows machine and found a complete Python malware kit, which it identifies as Armorsteal, in C:\Windows\SystemHealth\Update Seqrite. According to Seqrite, the kit ships with its own portable copy of Python 3.11, and every malicious script was protected with the trial version of PyArmor, which Seqrite says it decrypted because trial builds ship the key inside the bundled runtime. These findings come from one vendor’s analysis of one machine. Seqrite does not state how many systems are infected, and no independent verification is provided in the sources.

Seqrite says Zscaler ThreatLabz wrote about Armorsteal on 22 October 2026 and an independent researcher described an older build in June 2026. Seqrite says the build it found is newer than both Seqrite.

Infection route. Seqrite says it did not see the first step on the machine it analysed. Citing Zscaler, Seqrite reports that victims searching for tools like Chocolatey or the Microsoft Activation Scripts land on fake pages that ask them to paste a PowerShell command. According to that account, the command installs the real tool and drops the kit Seqrite.

Components, as described by Seqrite Seqrite:

  • Persistence: SysCheck2 starts the controller (SysMon.py) at each user logon through a headless conhost.exe. SysCheckX starts the miner manager (xm_handler.py) as SYSTEM 45 seconds after boot. SysHeal ran the controller once as SYSTEM on 27 September 2026.
  • Controller and backdoor (SysMon.py): Seqrite says it builds a victim ID from the motherboard serial and tries 11 command-and-control domains in priority order. It quits with a fake “Memory is insufficient” error if ipinfo.io reports a Google, Amazon, Microsoft or Azure network. It sends a host profile, downloads spy and stealer packages checked against hard-coded SHA-256 hashes, and every 60 seconds fetches code that it runs only if signed with the attacker’s RSA-2048 key.
  • Miner manager (xm_handler.py): According to Seqrite, it downloads xmrig-v4-3333.zip into xmrig-v2\ and adds C:\Windows as an excluded path and xmrig.exe as an excluded process in Defender. It kills the miner while any of 20 monitoring tools, such as Task Manager, Process Explorer or Wireshark, is open, and backs off reinstalling for up to 6 hours if xmrig.exe is removed. Seqrite says the coin and wallet for this build are not confirmed because the zip was gone. It considers Monero most likely because the older build mined Monero.
  • Spy module (basrq.py): Seqrite reports keylogging with window titles, uploaded every minute. The module swaps copied crypto addresses for nine attacker addresses covering Bitcoin, Litecoin, Ethereum, Tron, XRP, Dogecoin, TON, Solana and Monero, and takes in-memory screenshots when server-supplied keywords appear. Seqrite also describes scripts that show fake Exodus, MetaMask and Phantom notifications, which it says the operator most likely triggers through the backdoor.
  • Stealer (got.py): Seqrite says the Infame package runs got.py, which calls six helper modules. The available source text is truncated, so what this stealer collects is not confirmed here.

Attribution of the operators is not confirmed in the sources.

Am I affected?

According to Seqrite’s analysis, look for these indicators Seqrite:

  • Scheduled tasks named SysCheck2, SysCheckX or SysHeal pointing to C:\Windows\SystemHealth\Update.
  • Files such as SysMon.py, xm_handler.py, basrq.py, got.py, machine_id.txt, pyarmor_runtime.pyd, or a xmrig-v2 folder containing WinRing0x64.sys.
  • A Defender exclusion for the path C:\Windows or the process xmrig.exe.
  • Network traffic to any of these domains, listed by Seqrite in priority order: pymons[.]is, pur[.]st, workerstats[.]net, niceer[.]net, plaineagle[.]xyz, univalley[.]top, datamons[.]org, supertrap[.]net, icedhatch[.]top, icedhatch[.]xyz, icedout[.]top.

Seqrite notes that the keylogger’s key names are mostly French, but says this does not limit who can be infected.

What to do now

  1. Check Windows hosts for the scheduled tasks, folder and files listed above. If you find them, isolate the machine before cleanup.
  2. Review Defender exclusions and remove any C:\Windows path exclusion or xmrig.exe process exclusion. Seqrite says this exclusion remains after the malware is cleaned up Seqrite.
  3. Block all 11 domains, not only datamons[.]org. Seqrite says that domain is seventh on the failover list, so blocking it alone does very little Seqrite.
  4. On an infected machine, treat anything typed or copied as exposed, because Seqrite reports keystroke and clipboard capture. Change passwords from a clean device, and check the recipient address of any crypto transfer made from the machine.
  5. Do not paste PowerShell commands from download pages for tools such as Chocolatey or the Microsoft Activation Scripts. Seqrite, citing Zscaler, reports that this is how the kit is delivered.

Sources