MALICIOUS (1) campaign cataloged at 2024-10-30(2).

1. The campaign has clearly malicious intent, like infostealers.
2. This is just the date of creating the catalog entry. It may not reflect the date of creation of the campaign itself.

2024-10-hmac2

The package contains obfuscated code that exfiltrate basic data, and then executes commands delivered from remote server

Abuse categories

basic_exfiltration

The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.

dependency-confusion

An attempt to exploit dependency confusion

exfiltration_generic

Campaign uses exfiltration_generic.

obfuscation

Code uses obfuscation techniques to hide its true purpose.

IoCs & related URLs

URLs with payloads, characteristic domains, C&C IPs, repositories with malicious code, etc.

• 38.54.57.42

Packages in the campaign

campaign:2024-10-hmac2

• hmac2