MAL-2026-3246

-= Per source details. Do not edit below this line.=-

Source: kam193 (251972769752a77d15c86627fe078560c49ce79a47bcc4542128386eb5362342)

If run as a module, the code runs code to silently control the device via Telegram bot (execute commands, exfiltrate files).

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-05-system-update-tool

Reasons (based on the campaign):

• rat

• The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.

• files-exfiltration

• peristence-autorun

• persistence

• impersonation