updateuuid4

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: kam193 (2c45f904631a26aae94cafeeac5ea0f7efe0fc5d4f46dea48da17dcb766111d5)
The package, with an innocent looking name, has as the only functionality reporting to a Telegram channel given username and password. The functionality is in the "HeadersUpdate" class, that also looks like attempting to look innocent. The code does nothing more than reporting given credentials through a bot using the name "hitlercute_bot".


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2025-02-updateuuid4


Reasons (based on the campaign):


 - infostealer

Compromised versions (1)

• 0.1.2

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.