GCVE-110-OSM-2026-8380

Malicious package detected. Behaviors: data exfiltration, code execution, network activity. DESTINATION - custom-c2: http://64.49.11.161:8000/share/543108b4-7da1-423f-924a-c514a590acc3/ (primary, plaintext) in clock/core.py - custom-c2: 64.49.11.161 (plaintext) in clock/core.py EXFIL - Network Request in clock/core.py: "requests.get(" - Suspicious Domain in clock/core.py: "http://64.49.11.161" ADDITIONAL FINDINGS - Shell Command Execution in clock/core.py: "subprocess.Popen(" PAYLOAD FILES clock/core.py INDICATORS (IOCs) - payloadFileHash: 439d4871d495235b53b684fb968efec6b13c3271c3a6f8bf5d6da5f89355f2eb