Hostile 92% python Download

zencleaner 1.0.4

Browser credential theft and C2

“ZenCleaner - type 'zencleaner' in your terminal to open a localhost web UI that actually cleans your PC.”

Host identity reported to a Discord webhookPython wevtutil event-log clear
SHA-256df2061d82f8b90c0c8ac83fee4229b0f226b1e3efdf51fc52f5ed3f2fb9a9b3b
URLhttps://files.pythonhosted.org/packages/81/bb/c16a23d9acc6233f0feb66731d6c97c4ae7db1336f8882cbd438560b2c7b/zencleaner-1.0.4-py3-none-any.whl
MaleculeK₃(AmLiTe)O₁₃(Eu₂AlEr₃I₂As₃C₄Ca₅Co₂Dy₃LaP₃SXe)H₁₀(Os₁₇Cm₂₂Cr₂Db₁₆DsF₁₅MgPo₁₄TiU₅)Md₃(In₂₀Pa₄)

Also flagged by osm (Malicious package detected. Behaviors: data exfiltration, code execution.) +2 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.