MALICIOUS (1) campaign cataloged at 2026-02-17(2).
- The campaign has clearly malicious intent, like infostealers.
- This is just the date of creating the catalog entry. It may not reflect the date of creation of the campaign itself.
2026-02-pywin-simple-gui¶
The package pretends to be a development helper but, in fact, downloads a remote executable. Dynamic analysis reveals actions like disabling Windows Defender and interest in cryptocurrencies as well as using Telegram as C2.
Abuse categories¶
crypto-related
Malicious activity is related to cryptocurrencies or blockchain, e.g. stealing crypto wallets.
impersonation
Campaign uses impersonation.
modify-system-without-consent
Campaign uses modify-system-without-consent.
remote_executable
Downloads and executes a remote executable.
References¶
Referenced resources may include blog posts about the campaign, malware analysis, sandbox reports, or other relevant information.
IoCs & related URLs¶
URLs with payloads, characteristic domains, C&C IPs, repositories with malicious code, etc.
-
hxxp://loejfrw2.ignorelist.com/opt/adm/lct/util32X.exe -
hxxp://loejfrw2.ignorelist.com/opt/adm/lct/Mont.txt -
loejfrw2.ignorelist.com