maxload

{"modified":"2026-03-19T12:23:25Z","published":"2025-07-30T01:11:45Z","schema_version":"1.7.4","id":"MAL-2025-41701","summary":"Malicious code in maxload (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (09b392bd35def14bcd622e3863dec62ba92d26ef152cc81e657cb2c2194b93a8)\nRunning the module downloads, configure its startup and starts a remote executable. The exe is capable of sending files to a hardcoded Telegram channel, but this behavior seems not to be triggered during analysis\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2025-07-maxload\n\n\nReasons (based on the campaign):\n\n\n - Downloads and executes a remote executable.\n\n\n - peristence-autorun\n\n\n - A Telegram webhook is used to send collected data.\n","affected":[{"package":{"ecosystem":"PyPI","name":"maxload","purl":"pkg:pypi/maxload"},"versions":["1.0.1","1.1.1","1.0.0"]}],"references":[{"type":"EVIDENCE","url":"https://www.virustotal.com/gui/file/822a8d19b944ff44351cf34a07e59dffb838bb157f1b8cf5a47a22f28d4d9500/detection"},{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/maxload"}],"credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"]},{"name":"Kamil Mańkowski (kam193)","type":"REPORTER","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"]},{"name":"ReversingLabs","type":"FINDER","contact":["https://www.reversinglabs.com"]}],"database_specific":{"iocs":{"urls":["https://raw.githubusercontent.com/RootHarpy/RootHarpy/refs/heads/main/T.exe"]},"malicious-packages-origins":[{"source":"reversing-labs","sha256":"3e69501ecfd0090c520f83139f91ae01a23e03762102a35ba89e4f33529d2fab","import_time":"2025-08-29T06:41:47.305313558Z","id":"RLMA-2025-04196","modified_time":"2025-08-28T07:11:21Z","versions":["1.0.1","1.1.1"]},{"source":"kam193","sha256":"88935b76b4ded2fd46603849dd7e209b7e17dda08d278b09bfdd86d19dd60b66","import_time":"2025-12-02T22:30:55.326053173Z","id":"pypi/2025-07-maxload/maxload","modified_time":"2025-07-30T01:11:45.673964Z","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]},{"source":"kam193","sha256":"09b392bd35def14bcd622e3863dec62ba92d26ef152cc81e657cb2c2194b93a8","import_time":"2025-12-02T23:07:18.353880232Z","id":"pypi/2025-07-maxload/maxload","modified_time":"2025-07-30T01:11:45.673964Z","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]},{"source":"kam193","sha256":"7e293a4272004e92d4b4bbcc9d6d4c8a04bd28090c7800f1f3bafdce21be9d24","import_time":"2025-12-10T21:38:57.586402325Z","id":"pypi/2025-07-maxload/maxload","modified_time":"2025-07-30T01:11:45.673964Z","versions":["1.0.0","1.0.1","1.1.1"]},{"source":"reversing-labs","sha256":"281b953465938c810a514a4c83ef3c86482ad7bd6f3583bd9686879ff0d10c2b","import_time":"2026-03-19T12:20:02.450588414Z","id":"RLUA-2026-00501","modified_time":"2026-03-18T12:15:55Z","versions":["1.0.0"]}]}}