GCVE-110-OSM-2026-11682

During import, package loads code disguised as ".wav" file. It performs extensive fingerprinting against sandboxes, and finally downloads and executes heavily obfuscated code. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-09-houdus Reasons (based on the campaign): - obfuscation - Downloads and executes a remote malicious script. - The package contains code to detect if it is running in a sandbox environment. Judge assessment: This is consistent with a Windows-targeted dropper/loader for an attacker-controlled payload: the disguised file `src/houdus/assests/ssd.wav` decodes `_b64` to `https://lamabdefs-sesaonion-ho.netlify.app/wobble.py`, then downloads it and executes it via `pythonw.exe`. The code performs sandbox/VM fingerprinting with `platform.system()`, `platform.machine()`, WMI queries, MAC/OUI checks, and registry probes before proceeding, which is classic anti-analysis behavior. It also suppresses output with `stdout=subprocess.DEVNULL` and self-deletes with `cmd /c ... del /f /q`, reinforcing stealth. Given the clear attacker model of a covert loader dropping and running remote malware, this should be treated as malicious. DESTINATION - 3 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Network Request in src/houdus/assests/ssd.wav: "urllib.request.Request(" - System Information Collection in src/houdus/assests/ssd.wav: "platform.system()" OBFUSCATION - Decoded Base64 Content in src/houdus/assests/ssd.wav - recovered 1 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Shell Command Execution in src/houdus/assests/ssd.wav: "subprocess.Popen(" - Silent Process Execution in src/houdus/assests/ssd.wav: "stdout=subprocess.DEVNULL" PAYLOAD FILES src/houdus/assests/ssd.wav