GCVE-110-OSM-2026-12857

During installation, the code downloads a malicious executable from a remote location. The malicious action is triggered only on specific hosts. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-09-caracas4check Reasons (based on the campaign): - obfuscation - targetted-attack - Downloads and executes a remote executable. - The package overrides the install command in setup.py to execute malicious code during installation. ENTRY setup.py (install-hook: install/develop/build override present) EXFIL - Network Request in caracas4check/client.py: "requests.post(" - DNS Lookup in caracas4check/client.py: "socket.getaddrinfo(" OBFUSCATION - Base64 Encoded Payload in c4c_boot.py: ""ccc68589c44e485eaaebd4308727ca4e7f8f4b5a13cc3f6189aef9675b61decce6fcfa85da4a0b0..." - Base64 Encoded Payload in setup.py: ""ccc68589c44e485eaaebd4308727ca4e7f8f4b5a13cc3f6189aef9675b61decce6fcfa85da4a0b0..." ADDITIONAL FINDINGS - Tunneling Service Usage in caracas4check/example.py: ".onion/" PAYLOAD FILES caracas4check/client.py