vtranalytic

MAL-2026-11156

Malicious code in vtranalytic (PyPI)

Details


---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (897fa80f1d8a55ff480d6c7e7a71200ac31530a9f5d928389545b597c7b45903)
The package implements a full remote-administration toolkit controlled through a Telegram bot. It polls the Telegram Bot API at https://api.telegram.org/bot<token>/... and dispatches inbound messages to handlers that execute arbitrary system commands via subprocess.run (documented in the README as a `run` command that executes any system command), create OS users, change sudo/RDP privileges, and upload/download arbitrary files on the host. A BotFinder routine walks /, /home, /root, /etc, /var/www, /opt, /tmp, /usr/local, and Windows drives, reading.py/.json/.conf/.cfg/.env/.ini files and regex-extracting Telegram bot tokens (pattern `[0-9]+:[A-Za-z0-9_-]+`) along with `token`/`api_token`/`webhook` context. Additional bot commands (`getpasswords`, `getsshkeys`, `rdp`, `rdpall`, `findbot`, `getallbots`) return the harvested SSH keys, saved credentials, and other operators' bot tokens back over the Telegram channel. Any host on which this package runs is fully controllable by whoever holds the bot token, and installer-side secrets are exfiltrated to that operator. Package metadata lists a placeholder author (`Umar <[email protected]>`) and a non-existent GitHub slug, consistent with anonymous publication of a RAT under a data-analytics-sounding name.

Compromised versions (2)

9.0.1
9.0.4

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.