vtranalytic

{"schema_version":"1.7.4","id":"MAL-2026-11156","published":"2026-07-28T13:42:28Z","modified":"2026-08-05T13:10:45.638097725Z","summary":"Malicious code in vtranalytic (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (897fa80f1d8a55ff480d6c7e7a71200ac31530a9f5d928389545b597c7b45903)\nThe package implements a full remote-administration toolkit controlled through a Telegram bot. It polls the Telegram Bot API at https://api.telegram.org/bot<token>/... and dispatches inbound messages to handlers that execute arbitrary system commands via subprocess.run (documented in the README as a `run` command that executes any system command), create OS users, change sudo/RDP privileges, and upload/download arbitrary files on the host. A BotFinder routine walks /, /home, /root, /etc, /var/www, /opt, /tmp, /usr/local, and Windows drives, reading.py/.json/.conf/.cfg/.env/.ini files and regex-extracting Telegram bot tokens (pattern `[0-9]+:[A-Za-z0-9_-]+`) along with `token`/`api_token`/`webhook` context. Additional bot commands (`getpasswords`, `getsshkeys`, `rdp`, `rdpall`, `findbot`, `getallbots`) return the harvested SSH keys, saved credentials, and other operators' bot tokens back over the Telegram channel. Any host on which this package runs is fully controllable by whoever holds the bot token, and installer-side secrets are exfiltrated to that operator. Package metadata lists a placeholder author (`Umar <umar@example.com>`) and a non-existent GitHub slug, consistent with anonymous publication of a RAT under a data-analytics-sounding name.\n","affected":[{"package":{"name":"vtranalytic","ecosystem":"PyPI"},"versions":["9.0.1","9.0.4"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"vtranalytic/vtranalytic.py","sha256":"e02e402bd389c7fe56c476c13264633990f580253315577e06163a0876ab20a4","tlsh":"67e284a2cc68380742b2d65d4946e4a2f2216343525a8c13fdbc95bc1f30767b6f6abd"}],"package_integrity":[{"filename":"vtranalytic-9.0.1-py3-none-any.whl","hashes":{"blake2b_256":"4d6f6c662de9bc7c219ffa5f53dd39ee439571cb7a295f2addd88f08cb048164","md5":"a36bb51112b583f89c99c786eedc2a67","sha256":"b19a86859bc10931a8ae41e24262623e50e51eff462759145af7cef5f23c1681"}},{"filename":"vtranalytic-9.0.1.tar.gz","hashes":{"blake2b_256":"852f9239824f5bfd71fa3912d9695fa167a9f335ca891334ef8145c35ca7392a","md5":"8ed64f110e085230f7276fb7ed6d2524","sha256":"edfcab06e3ce6d1ca1323b4e1fdb25188a331700725d3e60966937d088b5f838"}}]}}}],"references":[{"type":"PACKAGE","url":"https://pypi.org/project/vtranalytic/9.0.1/"},{"type":"PACKAGE","url":"https://pypi.org/project/vtranalytic/9.0.4/"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-010962","import_time":"2026-07-28T14:20:01.586361715Z","modified_time":"2026-07-28T13:42:28Z","sha256":"ebce016051a9e9cb604067185042ce49c7426aa1ac01aa606e430c4d1120eec7","source":"amazon-inspector","versions":["9.0.1"]},{"id":"IN-MAL-2026-014791","import_time":"2026-08-05T13:08:46.780490226Z","modified_time":"2026-08-05T12:51:51Z","sha256":"897fa80f1d8a55ff480d6c7e7a71200ac31530a9f5d928389545b597c7b45903","source":"amazon-inspector","versions":["9.0.4"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}