MALICIOUS (1) campaign cataloged at 2026-11-11(2).
- The campaign has clearly malicious intent, like infostealers.
- This is just the date of creating the catalog entry. It may not reflect the date of creation of the campaign itself.
2026-11-aurum-pay¶
When using the library, it silently executes remote commands and installs the next-stage payload. On linux, the payload is a binary. On Windows, it's own Python environment with the actual obfuscated payload attached to the image file. Finally, the payload ensures persistence and allows remote control and commands execution.
Abuse categories¶
RAT
Malicious activity is typical for Remote Access Trojans (RATs).
action-hidden-in-lib-usage
The malicious action is hidden in the code and starts when user interacts with it (e.g. during class initialization or by exfiltrating given credentials).
obfuscation
Code uses obfuscation techniques to hide its true purpose.
persistence
Campaign uses persistence.
remote_executable
Downloads and executes a remote executable.
remote_script
Downloads and executes a remote malicious script.
References¶
Referenced resources may include blog posts about the campaign, malware analysis, sandbox reports, or other relevant information.
IoCs & related URLs¶
URLs with payloads, characteristic domains, C&C IPs, repositories with malicious code, etc.
-
aurum-casino.com -
hxxps://aurum-casino.com/sdk/ping -
hxxps://www.dropbox.com/scl/fi/ovn8wxlle1eev6fapq8kv/rcmd-agent?rlkey=mzlx4zi0peodkv8vwdv4tr0v7&st=vv80smtk&dl=1 -
hxxps://www.dropbox.com/scl/fi/matkw0atxpw24psgn19b8/py.zip?rlkey=w751am7kt5lwi0tmqubj3ozve&st=yafdtm4z&dl=1 -
hxxp://209.99.188.130:8447 -
209.99.188.130