MALICIOUS (1) campaign cataloged at 2025-06-03(2).
- The campaign has clearly malicious intent, like infostealers.
- This is just the date of creating the catalog entry. It may not reflect the date of creation of the campaign itself.
2025-05-pyobfuscation¶
During installation, an executable is downloaded and started. It's been identified to contain Brute Ratel C4 components
Abuse categories¶
malware
Campaign uses malware.
obfuscation
Campaign uses obfuscation.
remote_executable
Downloads and executes a remote executable.
IoCs & related URLs¶
URLs with payloads, characteristic domains, C&C IPs, repositories with malicious code, etc.
hxxps://raw.githubusercontent.com/aydendev0/cd4afc0d20c6/refs/heads/main/llama