OVERVIEW On 2026-05-22, SANS Internet Storm Center handler Xavier Mertens published a static analysis of an obfuscated Node.js stealer uploaded to VirusTotal as 'extracted-decoded.js' (SHA256 049300aa5dd774d6c984779a0570f59610399c71864b5d5c2605906db46ddeb9). The sample failed to execute in a sandbox, so analysis is static-only. The wrapper is obfuscated with obfuscator.io-style techniques — a long array of small Base64-encoded strings indexed by low-level arithmetic decoder functions — but the three malicious payloads themselves are embedded in plain text after wrapper deobfuscation.

CROSS-PLATFORM TARGETING The stealer is engineered to operate across Windows (via WSL paths of the form '/mnt/c/Users/${windowsUsername}/AppData/Local'), macOS, and Linux from a single Node.js codebase. The use of WSL-rooted paths to read native Windows browser profiles is notable: it allows the stealer to harvest Windows credentials from a Linux runtime, sidestepping detection tooling that assumes a Windows process context for Chromium User Data access.

PAYLOAD 1 — BROWSER CREDENTIAL STEALER The first payload enumerates Chromium 'User Data' directories for 13 browsers: Chrome, Brave, AVG Browser, Microsoft Edge, Opera, Opera GX, Vivaldi, Kiwi Browser, Yandex Browser, Iridium, Comodo Dragon, SRWare Iron, and Chromium itself. After reading Local State / Login Data / Cookies / Web Data SQLite stores, the harvested credentials are exfiltrated to the C2 on TCP port 8085. The same module additionally enumerates Chromium extension directories for a long list of crypto-wallet extension IDs ('wps' array), including MetaMask (nkbihfbeogaeaoehlefnkodbefgpgknn), Phantom (fhkbkphfeanlhnlffkpologfoccekhic), Trust Wallet (nphplpgoakhhjchkkhmiggakijnkhfnd), Coinbase Wallet, TronLink, Ronin, Binance Chain Wallet, Coin98, Argent, Keplr, Solflare, MEW CX, SafePal, Guarda, and ~25 additional wallet extension IDs.

PAYLOAD 2 — RECURSIVE SENSITIVE-FILE EXFILTRATION The second payload is a recursive filesystem scanner that searches the victim host for files matching a SENSITIVE_FILE_PATTERNS list of ~170 entries. The patterns cluster into four families: (a) cryptocurrency artifacts — 'metamask', 'phantom', 'bitcoin', 'ethereum', 'wallet', 'ledger', 'trezor', 'electrum', 'mycelium', 'blockchain', 'rabby', 'solflare', 'keplr', 'argent', 'martian', 'petra', 'okx'; (b) cryptographic key material — '.pem', '.p12', '.pfx', '.jks', '.keys', '.p8', '.p7b', '.cer', '.crt', 'id_rsa', 'id_dsa', 'id_ecdsa', 'id_ed25519', 'seed', 'mnemonic', 'passphrase', 'bip39', 'bip44', 'privatekey', 'private_key', 'privkey'; (c) general secrets and credentials — 'password', 'credential', 'token', 'access_token', 'refresh_token', 'api_key', 'api_secret', 'secret', 'masterkey', 'masterpassword', '.env'; (d) document and database extensions — '.db', '.sqlite', '.sqlite3', '.sql', '.mdb', '.doc', '.docx', '.pdf', '.xls', '.xlsx', '.txt', '.json', '.csv', '.xml', '.log', '.bak'. Matching files are uploaded via HTTP POST to hxxp://216.126.225.243:8086/upload using the Axios NPM package and multipart/form-data.

PAYLOAD 3 — WEBSOCKET REVERSE SHELL The third payload opens a WebSocket connection to the C2 on TCP port 8087 implementing reverse-shell capabilities. On first connection, the malware POSTs a host fingerprint to hxxp://216.126.225.243:8087/api/notify containing fields { 'ukey': 504, 't': 5, 'host': '504_<hostname>', 'os': '<type> <release>', 'username': '<username>', 'timestamp': <unix_ts> }. The 'ukey' value 504 likely identifies the campaign or operator. Subsequent traffic is encrypted using HMAC-SHA256 with a hard-coded key 'SuperStr0ngSecret@)@^' — the key is plain text in the binary, allowing defenders to decrypt captured traffic.

C2 INFRASTRUCTURE AND ATTRIBUTION OVERLAP All three modules communicate with a single IP — 216.126.225.243 — on three different ports (8085/8086/8087). Xavier Mertens explicitly notes in the SANS write-up that this IP is 'known as a DPRK OtterCookie C2', citing Socket.dev's research on the North Korean 'Contagious Interview' npm-attack campaign. The SANS analysis itself stops short of formally attributing this specific sample to the DPRK operators; the linkage is via shared C2 infrastructure rather than malware family overlap. Defenders should treat 216.126.225.243 as a high-confidence DPRK-linked C2 endpoint and treat the sample as plausibly tied to the OtterCookie cluster, while keeping the formal attribution as an open question pending dynamic analysis.

DELIVERY VECTOR The SANS write-up does not establish a delivery vector; the sample was retrieved from VirusTotal. Given the Node.js / Axios runtime and the documented Socket.dev research on the same C2 (which describes 197 malicious npm packages used as a North Korean delivery channel), the most plausible delivery pathway is via a poisoned npm package executed by a victim developer — consistent with the 'Contagious Interview' fake-recruiter / fake-coding-challenge social engineering pattern. This delivery vector is hypothesized, not confirmed by the SANS source.

DETECTION POSTURE Because the sample failed to run in a sandbox, network-IOC-driven detection is constrained to the single C2 IP and the three exfil ports. Static / behavioral hooks are stronger: (i) the literal string 'SuperStr0ngSecret@)@^' is high-fidelity if ever observed in process memory or filesystem artifacts; (ii) any Node.js / Axios process making outbound POSTs to /upload and /api/notify on the same host with ports 8085/8086/8087 in close succession is highly anomalous; (iii) WSL-resident processes touching '/mnt/c/Users/<u>/AppData/Local/<chromium-browser>/User Data' are an unusual cross-volume access pattern worth flagging in EDR.