url

http://45.137.198.133/$/1

discovered 2026-09-30

Python infostealer build 260924 (lock file tmp7A863DD1.tmp). Exfiltrates to {_target}/u/e and /u/f with Telegram sendDocument fallback.

Campaigns