fetch-data-api-syncapi

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: kam193 (dda63ba0d0dbd4ddf1d89523cacf89d51ffc9a25891e38cb49a9e424721fba9d)
The package contains code to download and start a malicious executable. It's masqueraded using name similar to Windows services. In analyzed versions, the code was not automatically started, suggesting it's just a part of a campaign.  Based on the dynamic analysis, the executable is likely an infostealer.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2026-04-fetch-data-api-syncapi


Reasons (based on the campaign):


 - Downloads and executes a remote executable.


 - malware

Compromised versions (3)

• 0.1.0
• 0.1.1
• 0.1.2

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.