@endrift@social.treehouse.systems
Post #1187085
2026-04-16 06:38 UTC
Fun fact: This is, in fact, a virus https://www.virustotal.com/gui/file/6c2a7b9e4acd8ade0057759ada5df709325952e6197718ec67b1427ca9081ced/detection
Replies (1)
-
@endrift@social.treehouse.systems 2026-04-16 06:45
It's a doubly-obfuscated Python program that I think is being used in the current Discord credential stealing campaign. It installs itself into AppData/Roaming/Google/Runtime/CLRHost/[hex garbage]/ and names the Python binary as ls_crashpad_handler.exe. The malicious script names itself node_modules.asar to attempt to blend in. It's a base85-encoded Python program which itself is a base64-encoded zlib compressed Python program that contains the actual Python program.