MALICIOUS (1) campaign cataloged at 2024-10-13(2).

1. The campaign has clearly malicious intent, like infostealers.
2. This is just the date of creating the catalog entry. It may not reflect the date of creation of the campaign itself.

2024-10-discordmessager

During installation, a remote, highly obfuscated script is downloaded and executed.

Abuse categories

dependency-confusion

An attempt to exploit dependency confusion

obfuscation

Code uses obfuscation techniques to hide its true purpose.

IoCs & related URLs

URLs with payloads, characteristic domains, C&C IPs, repositories with malicious code, etc.

• hxxps://www.dropbox.com/scl/fi/vckgtlr6pq92uspoj3bku/634364.pyw?rlkey=w2st1zif9lbd4oxz44utimsuv&st=ptdwmi5d&dl=1

Packages in the campaign

campaign:2024-10-discordmessager

• discordmessager
• robloxrequestsss