trigger-x-x

discovered 2026-07-14

NuGet DotnetTool downloader ("generic trigger-bot") published under operator pepegit666. Assembly trigger.dll, release tag "trigpanel". Wraps gtaobus.pyc with pyarmor_runtime_015050; falls back to a hardcoded authenticated HTTP proxy for Google Sheets when direct access fails. On run it masquerades with a colored Russian console, sets AWS-style env vars, DoH-resolves GitHub hosts, and fetches the shared second-stage pepesoft.exe (Hugging Face -> GitHub Releases -> dormant BitTorrent). The payload writes host telemetry/inventory to Google Sheets and enforces an HWID/UUID ban-list kill switch. Only the amazing-x-x@7.7.8 version was explicitly disclosed; other package versions were not enumerated in the source.

Threat types

data exfiltration
c2 agent

Malicious versions

unspecified

Campaigns

Pepesoftattributed-to

Indicators

Read the full analysis

APIThreat Intel Feed API · Confirmed malicious packages, campaigns and IOCs, piped into your stackExplore the API