stellarfixer@1.0.0

Analysis

stellarfixer@1.0.0 is a trojanized package that drops and executes the XWorm V7.0 remote access trojan (RAT) on Windows systems. The postinstall script (postinstall.js) runs the bundled PE binary bin/stellarfn.exe, which is a full-featured .NET RAT. Capabilities include: Telegram bot API C2 channel (api[.]telegram[.]org), keylogging via Windows hooks, screen capture, webcam capture via avicap32.dll, USB worm propagation to removable drives, persistence via scheduled tasks (schtasks.exe /create /sc minute /mo 1) and HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key, Windows Defender exclusion via Add-MpPreference, DDoS (SYN flood), hosts file hijacking (%drivers%\etc\hosts), system information theft (CPU, GPU, RAM, OS version, antivirus products), and remote plugin download/execution. The binary also sets the process as critical (RtlSetProcessIsCritical) to cause a BSOD if terminated.