Skip to content

MALICIOUS (1) campaign cataloged at 2025-02-17(2).

  1. The campaign has clearly malicious intent, like infostealers.
  2. This is just the date of creating the catalog entry. It may not reflect the date of creation of the campaign itself.

2025-02-web3socket

web3socket: In the class there is a hidden code that loads a binary Python code from a remote location impersonating PyPI Github account web3node: The package is used to download and run remote code by other packages. Files darwin.py, gnu.py and win32.py contain code that adds executing remote code to the crontab as well as an attempt to escalate privileges. w3socket: It uses web3node to start remote code in config.py

Abuse categories

dependency-confusion

Campaign uses dependency-confusion.

impersonation

Campaign uses impersonation.

remote_script

Downloads and executes a remote malicious script.

References

Referenced resources may include blog posts about the campaign, malware analysis, sandbox reports, or other relevant information.

URLs with payloads, characteristic domains, C&C IPs, repositories with malicious code, etc.

  • hxxps://raw.githubusercontent.com/pypi-org/DynamicLibs/refs/heads/main/web3config.pyc

  • hxxps://github.com/pypi-org/web3sockcet

  • hxxps://saboreysecretos.com/wp-includes/assets/script-modules-packages.win.php?u=2

  • saboreysecretos.com

Packages in the campaign

campaign:2025-02-web3socket