Synthèse
The plain-crypto-js package serves as a payload delivery vehicle. The core component, SILKBELL, setup.js (SHA256: e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09), dynamically checks the target system's operating system upon execution to deliver platform-specific payloads. The script uses a custom XOR and Base64-based string obfuscation routine to conceal the command-and-control (C2 or C&C) URL and host OS execution commands. To evade static analysis, it dynamically loads fs, os
The plain-crypto-js package serves as a payload delivery vehicle. The core component, SILKBELL, setup. js (SHA256: e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09), dynamically checks the target system's operating system upon execution to deliver platform-specific payloads. The script uses a custom XOR and Base64-based string obfuscation routine to conceal the command-and-control (C2 or C&C) URL and host OS execution commands. To evade static analysis, it dynamically loads fs, os, and execSync.
After successfully dropping the secondary payload, setup. js attempts to delete itself and revert the modified package. json to hide forensic traces of the postinstall hook. Operating System-Specific Execution Paths Depending on the identified platform, the dropper executes the following routines. The dropper actively hunts for the native powershell.
exe binary. To evade detection, it copies the legitimate executable to %PROGRAMDATA%\wt. exe. It then downloads a PowerShell script via curl using the POST body packages. npm.
org/product1 and saves it to the user's AppData Temp directory (e. g. , %TEMP%\6202033. ps1). The payload is executed using a copied Windows Terminal executable with hidden and execution policy bypass flags.