--- _-= Per source details. Do not edit below this line.=-_ ## Source: kam193 (94c533504ec9815f9ba159827d0c7516c779d03d31fc3ac897317fdbc14c2805) During import, package loads code disguised as ".wav" file. It performs extensive fingerprinting against sandboxes, and finally downloads and executes heavily obfuscated code. The remote code tries once more to avoid sandbox execution, establishes persistence via scheduled tasks and executes shellcode. Malicious code targets only Windows. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-09-houdus Reasons (based on the campaign): - obfuscation - Downloads and executes a remote malicious script. - The package contains code to detect if it is running in a sandbox environment. - persistence - shellcode