HIGHLY_SUSPICIOUS (1) campaign cataloged at 2025-06-15(2).
- Packages that are likely malicious, but due to the obfuscation level, lack of time or clear indicators it's hard to say what exactly they do; the highest risk of false positives.
- This is just the date of creating the catalog entry. It may not reflect the date of creation of the campaign itself.
2025-06-dcrb¶
Included executable, which is run by a command, implements a Discord bot designed to control the computer (including executing arbitrary commands). While such things can be used in legitimate cases, this executable has an embedded bot credentials, so it will join the server controlled by the uploader
Abuse categories¶
remote_commands
The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.
References¶
Referenced resources may include blog posts about the campaign, malware analysis, sandbox reports, or other relevant information.