← Back to Pulse Feed
PULSE DETAIL
PULSE NAME
Analysis of Malicious Checker Packages on PyPI: Probing TikTok and Instagram
WHITE Lazarus PetrP.73 2025-05-19 Modified: 2025-06-18
49
IOCs
MEDIUM VOLUME
This comprehensive report from Socket.dev examines the emergence of malicious checker packages on PyPI that target TikTok and Instagram. The analysis uncovers the sophisticated tactics, techniques, and procedures (TTPs) employed by cybercriminals to exploit these platforms.
instagramtiktokpypi packageapissocket threatmarchcsrf tokenpypitiktok accountresearch teamukraineaprilcyberandroidtelegramdarklazarustiktok api
MITRE ATT&CK & Malware Families
ATT&CK TECHNIQUES
MALWARE FAMILIES
TikTok API
Indicators of Compromise (43 / 49 total)
All FileHash-SHA256 domain email hostname
TYPEINDICATORDESCRIPTIONCREATED
FileHash-SHA256 009f03b18280bb343b0862d663f31ac80c5fb30dfae9e273e43c63f13a9f31c0 — 2025-05-19
FileHash-SHA256 0d067c2f86cac2c17d655631c9cec2402012fb0a329bcafb3b1f4c0bb56b1f1f — 2025-05-19
FileHash-SHA256 8ca96ca267e30c02cf90888d91eeff09627f0e3fd2bd9df472278c9a6c022cbb — 2025-05-19
FileHash-SHA256 234e744ebf2e187b0203b9cb732c9a35eaec8cf01bd7caa106bcfe15d4793e36 — 2025-05-19
FileHash-SHA256 2eb48afccf09005d93b0f2ee4d4a94cd39c92236f961f5ed741fef1062c45e59 — 2025-05-19
FileHash-SHA256 31166738585182383964ec351be95fa98eac8e0ecfdd372f9f486df70ee1a9aa — 2025-05-19
FileHash-SHA256 4064258a0d908311814652653f89e2a8de3885f6e535c4a157962a3962d5f49f — 2025-05-19
FileHash-SHA256 5463a7a38b4e1750112388b76c62b07c701756a68b8ad4c38865a731bff85397 — 2025-05-19
FileHash-SHA256 6081f5adfc6799e4a08cc993d9b29bdce87bdf749af0c10a4dbcef087f04efbd — 2025-05-19
FileHash-SHA256 67db8e698b703f2f37a6833600d8f86348f3b288d770bcc134a102e2f75718c1 — 2025-05-19
FileHash-SHA256 6faab57427b3f466e7bd0f6f438de7dc6102e3e4c940935307f1b6747616532f — 2025-05-19
FileHash-SHA256 7a493f73d96ebb00a08826e15b48c01c1d809a1d760ff597120e5c8257315968 — 2025-05-19
FileHash-SHA256 82e52dcc14ac4a45b81b2dff64eb4e2746b889abd8c754f396293806c1430f33 — 2025-05-19
FileHash-SHA256 92a3d711d4aa3ae1d1382e0f3cd98882fc54dc652566a1a9d6cc1a555f597b4c — 2025-05-19
FileHash-SHA256 a0d991805036a997aa6a3946eb2ab946bac14f0973d106d37ce8c596cb5c4c9c — 2025-05-19
FileHash-SHA256 adc428cb00dd77905a8edd2af15fcef8a3652e96b3991b0a73b9fd1b75b7092c — 2025-05-19
FileHash-SHA256 bf3a5a7412726a2c0d1fd0f26958a0f202be071afb6a4e1846903b6d40aedc4c — 2025-05-19
FileHash-SHA256 dd5f47a121c2598a9e651df61af0562db6ff67789125ee040c567e08d217824e — 2025-05-19
FileHash-SHA256 e139d1fab24cc6af64b128efe3925b186bf546f974d8c4fde45582d4c1417ebe — 2025-05-19
FileHash-SHA256 e412fecfc97f6767e6afef28d2a4ea6a976e936f2aba7657af63df0934fe8fcb — 2025-05-19
FileHash-SHA256 e8afc53cc2e860a3a93f3c1288012705db9ab350b69dd7ce1c6ab2a9167a7184 — 2025-05-19
FileHash-SHA256 ee66c923738d8c55e0ebb989d91953509bbc6efbd8c27e9f615e94434f9ec87c — 2025-05-19
FileHash-SHA256 f82b69e0e7d2d765f500cfd757ea394619c8cc3f16c028ce3bf5eb5a5817fd43 — 2025-05-19
FileHash-SHA256 0420369af9dab57e2151e486b10fa2ba5b43e57277ef7b6723428a1cd30745a7 — 2025-05-19
FileHash-SHA256 0c4eab6d9e1e88e4b13741d3c7c7e7feb39bae5f29c76e727e623f82af967613 — 2025-05-19
FileHash-SHA256 0e3013dbf493e0858cd8e9db810f16e33e8a9c5644ad3fa1b6016e6a7d379e58 — 2025-05-19
FileHash-SHA256 2ac08858463b52c06da21f26cc776d18dfa5d819177237ceaf07278baedfc2f2 — 2025-05-19
FileHash-SHA256 2e43d7d459606cd88353e9cb2a603d139f16b8fcd40915dc52dcbb6edd48df49 — 2025-05-19
FileHash-SHA256 3fc911d5efecf7a28f16c32b25dadc91ea9501069a7c25fa86f441e32fc36669 — 2025-05-19
FileHash-SHA256 4039ae0d0fdd31e5e85eff22eb61d3e4121dddf7d6ac3037f99e046e07050dee — 2025-05-19
FileHash-SHA256 4575b6eb61f93d4e3ce1691ca1906a819cf77e3b622b4d9cb737d22a6112e7ff — 2025-05-19
FileHash-SHA256 4bc6798b37505f5a2a2cd0e130a421b00c7f11d7ef1554415146863255809690 — 2025-05-19
FileHash-SHA256 63cad77f17b7f08e35af57c053a251a9cd2ddc0db37077bb8729400e4bf810ff — 2025-05-19
FileHash-SHA256 6f955a3c025d135eebf3d0ed34954929529d4b463b00ad03c2e32318f31ef7d4 — 2025-05-19
FileHash-SHA256 798c882d8bc5c3e47aed29fff83b16d39f67024728b1c37a09e04eb30a3f204b — 2025-05-19
FileHash-SHA256 7a9e7a751455b50fd457044e2e654eccf2931f0b55cfc43788da873690a1b7e9 — 2025-05-19
FileHash-SHA256 8ed3acd2561c22e383a67d02fa8f86016ddbe53c73e0df1ddb9b99e89a9fd0d3 — 2025-05-19
FileHash-SHA256 9e7892799d9c7594c83e57f84d475c2e4ed8620ef19fb306bc8c300f870f75fe — 2025-05-19
FileHash-SHA256 abdb070793c36b12c481935dd66d37f32ce3e352f9b30896a4c8af5daeb6fb8e — 2025-05-19
FileHash-SHA256 b042256dee8e2f606abc53033698735266b941b02e2312a62a2e6eb583513a06 — 2025-05-19
FileHash-SHA256 c3556e1c514ddf7261f27af74d010659706937acbc1571dbb345f8dad230c95a — 2025-05-19
FileHash-SHA256 f146e0524607d110968a46203711aaf77624d37f05013d8410f5ccccd2a5473f — 2025-05-19
FileHash-SHA256 f16508ece351b60568834d6143ec015d93a1046cefd042f5b4f2a4e017ef0d87 — 2025-05-19
References (1)
↗ https://socket.dev/blog/malicious-checker-packages-on-pypi-probe-tiktok-and-instagram