Alchemyst0x

{
  "recommendations": [
    // Shell scripting (Langauge/Syntax, Utilities, Integration)
    "bmalehorn.shell-syntax",
    "foxundermoon.shell-format",
    "jeff-hykin.better-shellscript-syntax",
    "mads-hartmann.bash-ide-vscode",
    "mkhl.shfmt",
    "remisa.shellman",
    "rpinski.shebang-snippets",

Alchemyst0x

,0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94
Any,__class__,__delattr__,__dict__,__dir__,__doc__,__eq__,__format__,__ge__,__getattribute__,__getstate__,__gt__,__hash__,__init__,__init_subclass__,__le__,__lt__,__module__,__ne__,__new__,__reduce__,__reduce_ex__,__repr__,__setattr__,__sizeof__,__str__,__subclasshook__,__weakref__,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
MethodCall,__abstractmethods__,__annotations__,__class__,__class_getitem__,__class_vars__,__copy__,__deepcopy__,__delattr__,__dict__,__dir__,__doc__,__eq__,__fields_set__,__format__,__ge__,__get_pydantic_core_schema__,__get_pydantic_json_schema__,__getattr__,__getattribute__,__getstate__,__gt__,__hash__,__init__,__init_subclass__,__iter__,__le__,__lt__,__module__,__ne__,__new__,__pretty__,__pri

Alchemyst0x

iso_time() { date -u +"%Y-%m-%dT%H:%M:%S%z" |
  sed 's/\(.*\)\([+-]\)\([0-9]\{2\}\)\([0-9]\{2\}\)$/\1\2\3:\4/'; }

Alchemyst0x

// Found here:
// https://gist.github.com/jbrit/9a6525d086411a0fcffea202f368e780#file-initial-obfuscated-iife-js
// All I did was clean this up a bit more, follow the IP addresses that are in the file, downloaded two separate payloads
// and then ran one of them through Cyberchef to get the resulting python script in the other file.
// Just needed to do Reverse by char -> Base64 decode -> Zlib inflate -> Find + replace `exec(_)(b'` and `'))` 
// about ~30-40 times.

const fs = require("fs");
const os = require("os");
const path = require("path");

Alchemyst0x

# ----------------------------------- Linux ------------------------------------
.directory
.fuse_hidden*
.nfs*
.Trash-*
*~

# ----------------------------------- macOS ------------------------------------
._*
.apdisk

Alchemyst0x

#!/usr/bin/env python3

import re
import requests
import json

# example of how to properly load the addresses
addresses = [
    "0x8e66f051a2b93d25857f203454aa14e81099a1c4",
    "0x51264688eff18df8614ad4497d2a95d05ad63dfa",

Alchemyst0x

Original Tweet containing MEGA link by poster

VirusTotal scan of ZIP archive direct from original MEGA link - No detections

IPFS CID hash: bafybeid3bt23ojmxggjeyhegsl252i4niwpi6zhcrzphtromoseonzngaq

IPFS URL: ipfs://bafybeid3bt23ojmxggjeyhegsl252i4niwpi6zhcrzphtromoseonzngaq

IPFS URL via public gateway (ipfs.io)