-= Per source details. Do not edit below this line.=-
Malicious packages campaign targeting developers, payload is hidden using Steganography, exfiltrate host information
{ "iocs": { "urls": [ "https://pastebin.com/raw/TwHdexDC", "https://canary.discord.com/api/webhooks/1153431050517762059/MAkfrB4n1Gz6qe7W8ffWTZF92yfN3D_FWPFFaK_FBgDQWB1ZYfbKHa61X_8L6GK175r0", "https://canary.discord.com/api/webhooks/1155235432406196334/3eFtMXnG2laJjInzO_kAzLbW6ebMgbrrwmAcRtZyOfqnyCh-twTT9pSumcKr5QJvbGEZ", "https://canary.discord.com/api/webhooks/1152716297474424913/z6-hvrQNeyL0m1Mm34JLYj1VVB67sVEXogqJzGCkxYgMFCgCWhQaR07ruMBck1dJAi9g", "https://canary.discord.com/api/webhooks/1152648911371120681/JlL5FnwmY6nP6RaZxmQ7NI9MGR6HARmAekaPqPDdVTq9K3RJ68Lcd7cz16l9u6eZH9c3", "https://discord.com/api/webhooks/1103033150558457876/22oUF1rkDTdxz-iq-2EOR4aVXwDr5vFIeE9zWlitIbYSG2E3XhF8KQIzuo1uXy_bOcos", "http://51.178.25.148:8081/upload", "http://51.178.25.148:8081/dl/runtime", "http://51.178.25.148:8081/uploader", "http://51.178.25.148:8081/gethw", "http://51.178.25.148:8081/dl/system", "http://51.178.25.148:8081/getip", "http://51.178.25.148:8081/dl/uwu", "http://51.178.25.148:8081/rooter", "http://51.178.25.148:8081/dl/sys86", "http://51.178.25.148:8081/dl/gamesdk" ], "ips": [ "51.178.25.148" ] }, "malicious-packages-origins": [ { "sha256": "5dff2bd9da92b93b22c32e611a7d510147596aa9a8e0f566cb9e5b25dc8a45d3", "import_time": "2023-11-22T12:35:48.825717893Z", "source": "checkmarx", "ranges": [ { "events": [ { "introduced": "0" } ], "type": "ECOSYSTEM" } ], "modified_time": "2023-10-15T10:12:58Z" }, { "sha256": "e5333281299a44e515d68e6c92ab609b00aad23dc2d24094cce930b2af3975d2", "import_time": "2024-06-28T02:50:08.029817472Z", "versions": [ "1.0.0" ], "id": "RLMA-2024-04503", "source": "reversing-labs", "modified_time": "2024-06-25T13:40:07Z" } ] }