GCVE-110-OSM-2026-4738

APT malware detected: chai-max. Associated with threat actor(s): DPRK/Lazarus. Behaviors: data exfiltration, code execution, obfuscated code, install-time execution. Entrypoint: bin/kalamasha-tool.js (bin: bin/kalamasha-tool.js) Payload: main.js Secondary files: bin/kalamasha-tool.js Key findings: - Download Execute Delete Pattern in bin/build/uia_extract/base_library.zip: "EXEC�S_IRWXU�S_IRUSR�S_IWUSR�S_IXUSR�S_IRWXG�S_IRGRP�S_IWGRP�S_IXGRP�S_..." - Chai-Max Browser Data Theft in bin/chrome_cookies.ps1: "BraveSoftware\Brave-Browser\User Data" if (Test-Path $bravePath) { $..." - Stealth Background Process Spawning in bin/kalamasha-tool.js: "spawn(process.execPath, [__filename, '--background'], { detached: t..." - Download Execute Delete Pattern in bin/kalamasha-tool.js: "spawn. Aborting.`); try { if (fs.existsSync(killFileShared..." - Shell Command Execution in bin/kalamasha-tool.js: "require('child_process')" IOCs: - ipv4: 6.0.0.0 - ipv6: 6::, 5::, 1::, 2::, E:: (+2 more) - urls: http://schemas.micros - domains: oft.com, 8.ET, FL.tJ, 6.fm, door.Fr (+8 more) - emails: mal@lemburg.com, brian@sweetapp.com, sjoerd@acm.org, mhammond@skippinet.com.au, mark.russell@zen.co.uk (+1 more) - payloadFileHash: 5289eb025e9b6f593e7dfe13224c135d4e939f5bf346fe13640eb106f0437da3