neroteam-v1

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (e8a87642ea3c7a291704b2306a242bb496048571efcafb63835055f0871aed19)
Importing the `nero` package triggers `nero/__init__.py` to load `nero.main`, whose top-level code runs a `_guard()` routine before executing a hidden payload. `_guard()` performs anti-debug checks (`sys.gettrace`, `sys.settrace(None)`, `_getframe().f_trace`), timing checks, and substring matching against sandbox/VM indicators (`sandbox`, `virtualbox`, `vmware`, `qemu`, `wine`, `hyperv`, `xen`) in PATH, the Python executable path, and processor identifiers. It then base64-decodes a ~110KB blob, decrypts it with a custom RC4-like keystream cipher keyed by the string `Cxdgs`, and passes the plaintext to `exec()`. The decrypted code is opaque and only reachable on machines that pass the anti-analysis gauntlet. The combination of import-time `exec` of a custom-encrypted blob with dedicated anti-VM and anti-debug evasion is inconsistent with the package's stated 'account generator' purpose and matches the shape of hostile install/import-time code execution against the installer's host.

## Source: kam193 (458a2993d1a429a687102ddfca3f9fc0c91f72373b07ccad6ff83fb56add7e58)
Obfuscated code is used to abuse systems of garena[.]com for mass account generation, bypassing their security systems.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2026-07-neroteam-v1


Reasons (based on the campaign):


 - obfuscation


 - abusing-3rd-api


 - The package contains code to detect if it is running in a sandbox environment.

Compromised versions (8)

• 1.0.0
• 1.0.1
• 1.0.2
• 1.0.3
• 1.0.4
• 1.0.5
• 1.0.6
• 1.0.7

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.