mixdebrid
What this is: This is a fake “Code with Mosh” download that uses the legitimate Ren’Py visual novel engine as a shell/disguise. It is not a coding course or development project.
The malware structure:
| File | Purpose |
|---|
lnstaler.exe / lnstaler.py | The dropper — “installer” with letters shuffled to avoid obvious detection |
data/.hdB | Hidden config file (base64-encoded JSON) |
data/Utm6YVZPn7ff.Sm | Encrypted payload (2.2 MB) — decrypted at runtime with key zcaXm4 |
Decoded config reveals:
$$
{
“file_nm”: “Utm6YVZPn7ff.Sm”, // encrypted payload to unpack
“pasw”: “zcaXm4”, // decryption key (XOR cipher, visible in hex)
“exc_fl”: “B6MhgUdFA.exe”, // executable to drop and run
“snd_bx”: false, // sandbox detection flag (won’t run in a sandbox)
“pb_s”: “T_tb8_G1_29”, // likely a Pastebin ID for C2 config retrieval
“hash”: 1777546699
}
$$
