asterisk rat

KTibow · Jun 2, 2024 · 354f075 · 354f075
1 parent e74725d
commit 354f075
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/src/lib/analysis/runAnalysis.ts b/src/lib/analysis/runAnalysis.ts
@@ -40,6 +40,7 @@ const prescan = (zip: JSZip & JSZip.JSZipObject, files: string[], state: Analysi
     { name: "Kodeine", pattern: "a/b/c/d" },
     { name: "Yoink", pattern: "net/jodah/typetools" },
     { name: "CustomPayload Normal", pattern: "me/custompayload/normal" },
+    { name: "Asterisk", pattern: "me/ghosty/notarat" },
     { name: "SBFT", pattern: "com/sbft" },
     { name: "MacroMod", pattern: "com/macromod" },
     { name: "Quanity", pattern: "com/quantiy" },
@@ -75,6 +76,9 @@ const scan = (file: string, contents: string, state: Analysis) => {
       initialFind: { searchString: "branchlock", isRegex: true },
     };
   }
+  if (contents.includes("Sta* ckT*ra")) {
+    state.obfuscation["Obfuscator Asterisk"] = { file };
+  }
   if (
     contents.includes("nothing_to_see_here") ||
     contents.includes("thisIsAInsaneEncryptionMethod") ||