cryptostock@1.0.0

Analysis

cryptostock@1.0.0 ships a crypto-drainer and C2 implant in its main entry (index.js). On require it registers the host with a command-and-control server at hxxps://badai[.]run[.]place (endpoints /register.php, /cekapppiapi.php?uid=, /fallback.php) using AES-256-ECB-encrypted communications, polls the C2 for shell commands and executes them via child_process, and exfiltrates the output. It scans the filesystem for private keys and wallets — /root/.ssh, /home/*/.ssh, /opt/wallet-keys, /etc/ssl/private, /.ethereum/keystore, /var/lib/ethereum/keystore, /mnt/crypto/wallets, matching .pem, .key, UTC--*, and keystore files — and reads the ETH_PRIVATE_KEY environment variable. Recovered Ethereum private keys are used to sweep any non-zero balances to the drain address 0w4d2d55 via an Infura provider.