marius-benthin

mflux-streamlit@0.0.3
nhmpy@2.4.7
rsquests@2.34.3
rlask@3.1.7
rlask@3.1.6
rlask@3.1.5
rlask@3.1.4
spateo-release@1.1.2
dynamo-release@1.5.4
mrbios@0.1.2

marius-benthin

autotel-mcp@29.0.1
awaitly-visualizer@22.0.2
autotel-subscribers@31.1.4
awaitly-libsql@22.0.1
awaitly-postgres@23.0.1
awaitly-mongo@23.0.1
autotel-hono@0.4.26
autotel-vitest@0.4.26
autotel-sentry@0.5.13
autotel-audit@0.1.15

marius-benthin

Malware Analysis Report: juunfranbIanco.solidity-0.0.189.vsix

Verdict: MALICIOUS — Trojanized VS Code Extension with Multi-Stage Multi-Platform RAT

---

Executive Summary

This file is a sophisticated trojanized VS Code extension impersonating the legitimate juanblanco.solidity Solidity extension. The publisher name juunfranbIanco contains deliberate typosquatting variations ("juun" vs "juan", capital "I" vs "l") to deceive victims. Beyond providing real Solidity language support as cover, it deploys a cross-platform remote access trojan (RAT) named evjawbreaker that uses the Ethereum blockchain for command-and-control (C2).

marius-benthin

rule MacOS_MachO {
   condition:
         uint32(0)   == 0xfeedface // 32-bit, little-endian
      or uint32(0)   == 0xfeedfacf // 64-bit, little-endian
      or uint32be(0) == 0xfeedface // 32-bit, big-endian
      or uint32be(0) == 0xfeedfacf // 64-bit, big-endian
}

rule MacOS_FAT {
   condition: