osinthell@1.9.5

Analysis

osinthell@1.9.5 is a destructive wiper targeting Windows systems. The package exports a `sorgu()` function that triggers 26 modules performing: MBR wipe (writes zeros to \\.\PhysicalDrive0), deletion of C:\ and System32 files, termination of critical processes (explorer.exe, dwm.exe, csrss.exe, winlogon.exe), fork bombs spawning hundreds of detached cmd/powershell/node processes, memory exhaustion via large buffer allocations, disk fill with 100MB files, deletion of boot files (boot.ini, bootmgr), deletion of SAM and SECURITY registry hives, corruption of the hosts file to block google[.]com/discord[.]com/github[.]com/youtube[.]com/reddit[.]com/microsoft[.]com/windows[.]com, disabling boot recovery via bcdedit, formatting C:, truncating all files on C:\ through F:\, deleting Program Files and Users directories, overwriting pagefile.sys and hiberfil.sys, spawning infinite ping loops, and forced system shutdown. Also includes full-screen image defacement via PowerShell/mshta/Internet Explorer/VBScript using a bundled image file. No lifecycle hooks — the payload runs only when the exported function is called.