@endrift@social.treehouse.systems
Post #1705126
2026-04-16 06:45 UTC
It's a doubly-obfuscated Python program that I think is being used in the current Discord credential stealing campaign. It installs itself into AppData/Roaming/Google/Runtime/CLRHost/[hex garbage]/ and names the Python binary as ls_crashpad_handler.exe. The malicious script names itself node_modules.asar to attempt to blend in. It's a base85-encoded Python program which itself is a base64-encoded zlib compressed Python program that contains the actual Python program.
Replies (1)
-
@endrift@social.treehouse.systems 2026-04-16 06:47
The program itself is heavily Windows-specific to a degree I don't understand. It appears to inject a block of machine code (I see a nop sled at the beginning of the bytestring) into something but I'm out of my depth here. SHA-256 of the file is e86c0415e102c0e72265f7145b472e85e537135866e33e8d865d536f6e569c1c and I've uploaded it to VirusTotal: https://www.virustotal.com/gui/file/e86c0415e102c0e72265f7145b472e85e537135866e33e8d865d536f6e569c1c