MALICIOUS (1) campaign cataloged at 2026-05-13(2).
- The campaign has clearly malicious intent, like infostealers.
- This is just the date of creating the catalog entry. It may not reflect the date of creation of the campaign itself.
2025-06-old-trickery¶
Package contains code to install a backdoor - and additionally to a user-controlled backdoor, it also installs the second, with own C2 server. It's not automatically activated. Once started, it can execute commands from C2 and exfiltrate data.
Abuse categories¶
backdoor
Campaign uses backdoor.
files_exfiltration
Campaign uses files_exfiltration.
peristence_autorun
Campaign uses peristence_autorun.
remote_commands
The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.
remote_script
Downloads and executes a remote malicious script.
References¶
Referenced resources may include blog posts about the campaign, malware analysis, sandbox reports, or other relevant information.
IoCs & related URLs¶
URLs with payloads, characteristic domains, C&C IPs, repositories with malicious code, etc.
-
hxxps://github.com/cipher234/socioware/raw/main/config.pyw -
hxxps://github.com/cipher234/socioware/raw/main/socio_req -
hxxps://github.com/socioware1/trickery/raw/refs/heads/main/archive/trickery.rar