GCVE-110-OSM-2026-8165

Malicious package detected. Behaviors: data exfiltration, code execution, obfuscated code. ENTRY pylogora/__init__.py (module-import: 133) PERSISTENCE - Startup Persistence in pylogora/_logger.py: ".profile" DESTINATION - custom-c2: https://easyswasnow.pro/downloads/lix_amd.bin (primary, decoded) in pylogora/__init__.py - custom-c2: https://easyswasnow.pro/downloads/lix_arm.bin (decoded) in pylogora/__init__.py - custom-c2: https://easyswasnow.pro/downloads/mac_amd.bin (decoded) in pylogora/__init__.py - custom-c2: https://easyswasnow.pro/downloads/mac_arm.bin (decoded) in pylogora/__init__.py - custom-c2: http://www.apple.com/DTDs/PropertyList-1.0.dtd (decoded) in pylogora/__init__.py - custom-c2: drive.google.com (decoded) in pylogora/__init__.py - custom-c2: easyswasnow.pro (decoded) in pylogora/__init__.py - custom-c2: www.apple.com (decoded) in pylogora/__init__.py (+1 more) EXFIL - Network Request in pylogora/__init__.py: "urllib.request.Request(" - System Information Collection in pylogora/__init__.py: "platform.system()" OBFUSCATION - Decoded Base64 Content in pylogora/__init__.py (x19) - Base64 Encoded Payload in pylogora/__init__.py: "'aHR0cHM6Ly9kcml2ZS5nb29nbGUuY29tL3VjP2V4cG9ydD1kb3dubG9hZCZpZD0xZDR6RjhsbkRhWUN..." - recovered 6 urls, 3 domains, 5 paths, 1 ips from decoded/deobfuscated content ADDITIONAL FINDINGS - Shell Command Execution in pylogora/__init__.py: "subprocess.run(" - Dangerous Function Calls in pylogora/_logger.py: "pickle.loads(" PAYLOAD FILES pylogora/__init__.py INDICATORS (IOCs) - urls: https://www.asmeurer.com/brown-water-python/ - domains: www.asmeurer.com, pendulum.eustace.io, level.no, self.no - paths: ~/.local/share/config, /usr/bin/python3, /usr/bin/python</string>, /tmp/script.log</string>, /tmp/script.err</string> - ips: 114.0.0.0 - payloadFileHash: 6174535aa7f92e2019f051199f1652bc462ac1c30f8349af654b1f636a59eba9