MALICIOUS (1) campaign cataloged at 2025-03-27(2).
- The campaign has clearly malicious intent, like infostealers.
- This is just the date of creating the catalog entry. It may not reflect the date of creation of the campaign itself.
2025-03-conn-utils¶
Already during the installation, the file with slightly obfuscated code is loaded and starts exfiltrating information about the host. It especially targets information about additional indexes configured for pip. Data is exfiltrated using DNS queries
Abuse categories¶
exfiltration_generic
Campaign uses exfiltration_generic.
obfuscation
Campaign uses obfuscation.
IoCs & related URLs¶
URLs with payloads, characteristic domains, C&C IPs, repositories with malicious code, etc.
-
m.yubitusoft.com -
yubitusoft.com