MAL-2026-10868

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (e8a87642ea3c7a291704b2306a242bb496048571efcafb63835055f0871aed19)

Importing the nero package triggers nero/__init__.py to load nero.main, whose top-level code runs a _guard() routine before executing a hidden payload. _guard() performs anti-debug checks (sys.gettrace, sys.settrace(None), _getframe().f_trace), timing checks, and substring matching against sandbox/VM indicators (sandbox, virtualbox, vmware, qemu, wine, hyperv, xen) in PATH, the Python executable path, and processor identifiers. It then base64-decodes a ~110KB blob, decrypts it with a custom RC4-like keystream cipher keyed by the string Cxdgs, and passes the plaintext to exec(). The decrypted code is opaque and only reachable on machines that pass the anti-analysis gauntlet. The combination of import-time exec of a custom-encrypted blob with dedicated anti-VM and anti-debug evasion is inconsistent with the package's stated 'account generator' purpose and matches the shape of hostile install/import-time code execution against the installer's host.

Source: kam193 (458a2993d1a429a687102ddfca3f9fc0c91f72373b07ccad6ff83fb56add7e58)

Obfuscated code is used to abuse systems of garena[.]com for mass account generation, bypassing their security systems.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-07-neroteam-v1

Reasons (based on the campaign):

• obfuscation

• abusing-3rd-api

• The package contains code to detect if it is running in a sandbox environment.