Synthèse
The fourth module contains two separate capabilities: Windows dropper functionality and a clipboard stealer. The dropper component is Windows-only and downloads three second-stage binaries via curl from file.rightwidth[.]dev, each disguised as a .txt file, then renamed to .exe before execution. The C2 server was unavailable at the time of analysis, so the payloads could not be retrieved. Based on their naming convention, they may relate to additional discovery or enumeration capabilities, but th
The fourth module contains two separate capabilities: Windows dropper functionality and a clipboard stealer. The dropper component is Windows-only and downloads three second-stage binaries via curl from file. rightwidth[. ]dev, each disguised as a . txt file, then renamed to .
exe before execution. The C2 server was unavailable at the time of analysis, so the payloads could not be retrieved. Based on their naming convention, they may relate to additional discovery or enumeration capabilities, but this is unconfirmed. hostService. txt -> hostService.
exe printSvc. txt -> printSvc. exe dhcpSvc. txt -> dhcpSvc. exe The clipboard functionality is only available on macOS and Windows.
The malware polls every 500ms for new clipboard content, exfiltrating any changes to the C2 server (rightwidth[. ]dev) via POST requests using endpoint (/api/service/makelog/). For macOS devices, pbpaste is used to retrieve the clipboard contents from victim machines. const getClipboard = async () => { try { if (os. platform() === "darwin") { return execSync("pbpaste", { encoding: "utf8" }).
trim(); } if (os. platform() === "win32") { return execSync("powershell -NoProfile -NonInteractive Get-Clipboard", { encoding: "utf8", windowsHide: true, }). trim(); } // Linux: no implementation — returns null every poll, loop is a no-op return null; } catch (_) { return null; } }; On Windows, a new PowerShell process is spawned every 500ms via Get-Clipboard to retrieve the current clipboard contents.