← Back to Pulse Feed
PULSE DETAIL
PULSE NAME
Malicious PyPI Package Embeds Multi-Layer Encrypted Backdoor to Steal Users’ Cryptocurrency Information — HelixGuard
WHITE CyberHunter_NL 2026-05-11 Modified: 2026-05-11
51
IOCs
HIGH VOLUME
pypi packagesteal userscryptocurrencyinformationhelixguardaptmalwaremalware descriptionsmalware technologiesoceanlotuspythonsupply-chain attacktargeted attackszichatbotpypizulipwindows versionlinuxpython scriptwindowsrest apisdropperorganization
Indicators of Compromise (51)
All FileHash-MD5 FileHash-SHA1 FileHash-SHA256 email
TYPEINDICATORDESCRIPTIONCREATED
FileHash-MD5 02f4701559fc40067e69bb426776a54f — 2026-05-11
FileHash-MD5 0a5a06fa2e74a57fd5ed8e85f04a483a — 2026-05-11
FileHash-MD5 1995682d600e329b7833003a01609252 — 2026-05-11
FileHash-MD5 22538214a3c917ff3b13a9e2035ca521 — 2026-05-11
FileHash-MD5 38b75af6cbdb60127decd59140d10640 — 2026-05-11
FileHash-MD5 454b85dc32dc8023cd2be04e4501f16a — 2026-05-11
FileHash-MD5 48be833b0b0ca1ad3cf99c66dc89c3f4 — 2026-05-11
FileHash-MD5 5152410aeef667ffaf42d40746af4d84 — 2026-05-11
FileHash-MD5 5598baa59c716590d8841c6312d8349e — 2026-05-11
FileHash-MD5 652f4da6c467838957de19eed40d39da — 2026-05-11
FileHash-MD5 968782b4feb4236858e3253f77ecf4b0 — 2026-05-11
FileHash-MD5 a26019b68ef060e593b8651262cbd0f6 — 2026-05-11
FileHash-MD5 b55b6e364be44f27e3fecdce5ad69eca — 2026-05-11
FileHash-MD5 ba2f1868f2af9e191ebf47a5fab5cbab — 2026-05-11
FileHash-MD5 c33782c94c29dd268a42cbe03542bca5 — 2026-05-11
FileHash-MD5 e200f2f6a2120286f9056743bc94a49d — 2026-05-11
FileHash-MD5 e4a0ad38fd18a0e11199d1c52751908b — 2026-05-11
FileHash-MD5 fce65c540d8186d9506e2f84c38a57c4 — 2026-05-11
FileHash-SHA1 05391e972db01ed9d55b202b9ae3feec700eabf5 SHA1 of ba2f1868f2af9e191ebf47a5fab5cbab 2026-05-11
FileHash-SHA1 06adabcb962b5cf5d9fb63542518a5b80b5a9ad4 SHA1 of 454b85dc32dc8023cd2be04e4501f16a 2026-05-11
FileHash-SHA1 1760fa80380a0b582236f255ea837b6969a41c51 SHA1 of 652f4da6c467838957de19eed40d39da 2026-05-11
FileHash-SHA1 1c0a5b35c003ac3182c589c6e014a42678a0647f SHA1 of 1995682d600e329b7833003a01609252 2026-05-11
FileHash-SHA1 4cc73a4a49431e4e028c44e9541f80e4eb58cfcb SHA1 of e200f2f6a2120286f9056743bc94a49d 2026-05-11
FileHash-SHA1 6083b1c3cdfc5dbc27010cc38d3d66c6ddcf0347 SHA1 of 22538214a3c917ff3b13a9e2035ca521 2026-05-11
FileHash-SHA1 67b2e7eb4255f6b990f1bd9917ea54228af2c6a1 SHA1 of 968782b4feb4236858e3253f77ecf4b0 2026-05-11
FileHash-SHA1 6a8d20cf325b766e69f6133b3a7325034b76948c SHA1 of c33782c94c29dd268a42cbe03542bca5 2026-05-11
FileHash-SHA1 8a4a444761ca8836e6022af4a0e86a2be031aaa6 SHA1 of 38b75af6cbdb60127decd59140d10640 2026-05-11
FileHash-SHA1 8c5f7f59b83a7d15d7f80e1b2678d570dbf62e8e SHA1 of fce65c540d8186d9506e2f84c38a57c4 2026-05-11
FileHash-SHA1 93708b635f11f182d5541274d0ac7b7d5baf3795 SHA1 of 5598baa59c716590d8841c6312d8349e 2026-05-11
FileHash-SHA1 95ecfdbc7ea239d124ac3a42a522f920487eb1b7 SHA1 of 0a5a06fa2e74a57fd5ed8e85f04a483a 2026-05-11
FileHash-SHA1 9a7106fa55da528705207d2cf1125874db7670b6 SHA1 of b55b6e364be44f27e3fecdce5ad69eca 2026-05-11
FileHash-SHA1 aa4e6ea503d3fb448d9c81a15dde69082552d286 SHA1 of e4a0ad38fd18a0e11199d1c52751908b 2026-05-11
FileHash-SHA1 c7a2684ec7dc6484655e8dfe5b184341c416a3e0 SHA1 of 02f4701559fc40067e69bb426776a54f 2026-05-11
FileHash-SHA1 ccc71ba929add58ad89dff289295659b69ad43a5 SHA1 of 5152410aeef667ffaf42d40746af4d84 2026-05-11
FileHash-SHA256 08a75a092e9793b6d3eb473c246d3c5e4750cd525342276d8bf1ab7d1fe45112 SHA256 of 1995682d600e329b7833003a01609252 2026-05-11
FileHash-SHA256 1feaa9e376dd64942ce40ff7355f3220793ca69a4a4a610ecd39ad950c6b9ba4 SHA256 of 652f4da6c467838957de19eed40d39da 2026-05-11
FileHash-SHA256 2b5225816089467aacdcd201a44989a2f78491c29f6fad41b52731bfefc1b886 SHA256 of 02f4701559fc40067e69bb426776a54f 2026-05-11
FileHash-SHA256 41c405c2579a3f1639438f3ecf6deae8c4b37786c5454af1ff0010733b12e226 SHA256 of e4a0ad38fd18a0e11199d1c52751908b 2026-05-11
FileHash-SHA256 437a824e63975a350108e20881020ad288fb6343d4f61fff7d64811270219dea SHA256 of 5152410aeef667ffaf42d40746af4d84 2026-05-11
FileHash-SHA256 50d2fb75ef2bb56915e28595574663d8a1e0193e335e3e4f0ad2c0a4770fd787 SHA256 of 968782b4feb4236858e3253f77ecf4b0 2026-05-11
FileHash-SHA256 5a2f6156e23cd80ba97de54afc8325fe4b72deeed523e5bf06ba164900855ea2 SHA256 of e200f2f6a2120286f9056743bc94a49d 2026-05-11
FileHash-SHA256 68dfa75e916f4fb44a071851965493a324d331e37b791e21c45feba54aec23d8 SHA256 of 454b85dc32dc8023cd2be04e4501f16a 2026-05-11
FileHash-SHA256 8726a1d86c3928b99f78442ef8da5d443b23f7cf9ad9173b21303e5c7d0e5eb7 SHA256 of fce65c540d8186d9506e2f84c38a57c4 2026-05-11
FileHash-SHA256 b69c192e2361dd303ec6cb1062948a9c60152f94d1a975dd99b2ec404214c5f6 SHA256 of 22538214a3c917ff3b13a9e2035ca521 2026-05-11
FileHash-SHA256 be19d98b5449a052c03b189d9687543d619c8c1893f12709ef6bef6ff7657510 SHA256 of c33782c94c29dd268a42cbe03542bca5 2026-05-11
FileHash-SHA256 c00869f91cedc04838f46ca15e1f844439761db6c45b3a042e4a34aebc77b1bd SHA256 of b55b6e364be44f27e3fecdce5ad69eca 2026-05-11
FileHash-SHA256 c7e93e50f1f241e63e738925e4f8c7f8ee004506723c2b49ed0789100f4ce4ba SHA256 of ba2f1868f2af9e191ebf47a5fab5cbab 2026-05-11
FileHash-SHA256 cdc099d8ec7a6683b90b624856247a98d61dd173a127834ca8988c0a95d456ca SHA256 of 0a5a06fa2e74a57fd5ed8e85f04a483a 2026-05-11
FileHash-SHA256 d05d6b08078b3d153ab821cd4dd6b5f5bd390c007c6d01653f459c35b917b80c SHA256 of 38b75af6cbdb60127decd59140d10640 2026-05-11
FileHash-SHA256 f85f44ebdd341f22f0cbd408ee40f162d697fc48c3824c897b61980fa38a4d92 SHA256 of 5598baa59c716590d8841c6312d8349e 2026-05-11
email morian-bot@helper.zulipchat.com — 2026-05-11
References (2)
↗ https://helixguard.ai/blog/malicious-spellcheckers-2025-11-19/ ↗ https://securelist.com/oceanlotus-suspected-pypi-zichatbot-campaign/119603/