Github hosted loader

Threat Intel
,
1

Last Updated: 2026-06-12T10:01:30Z

What’s Happening

During some research into reversing tools for Aspyr apps I found 2 suspicious looking github repos that are trying to squat the legitimate repo GitHub - Dhamp1r/AspyrArchiveTool: Tool for packing/unpacking Aspyr Android OBB · GitHub

The squatting repos have a download link in the LLM generated README that points to a zip in the repo, not the releases tab. Zip contains a .bat, .exe, and .txt, it appears the .exe is some kind of python(?) interpreter and the .txt is an obfuscated script.

Git history indicates the base repos were forked, but via a git clone due to the lack of network details in github.

Appears to have some sort of blockchain communication through drpc.

Both repos have the zip that’s pointed to by the README, but it also has seemingly older versions of the zips which I’ve not dug into.

Actions

Not sure if there’s unique things to look for so I’ll just list some IOCs

https://github.com/AhmedHossam151/AspyrArchiveTool
https://github.com/TECHNO-SOUQ/AspyrArchiveTool

#C2
httX://85.137.52[.]21/api/NTE3YjdjNWU1NjYzNjU2YTA1N2Y= - POST
polygon.drpc[.]org

# Containing zips
3ab69a44b408daef297fedf161b4c5a1 - Aspyr-Archive-Tool-steamboatman.zip
e711b9eb13cae7f601cd5a5d72d162cf - Aspyr-Tool-Archive-1.6.zip

# Payloads
icon.txt - c39d15fde2aa5c656e27af7f432fa62e
bytecode.txt - 61b31acc14f126f5ce3692a52e374952

# Loaders 
Launcher.cmd - f75c409d173730b3b1e2c084ed0913d7
reinit.exe - 182354a4d7e1e3a2b326ef173da0a2f2
gcm.exe - 4b4e5b23962b294bc3699ffccc85b7c2
Launcher.cmd - cf304da0c9eadcdbe38ebe7e5d005be5

Notes

2 Likes
2

Interesting behavior in the 2 accounts hosting the mirrored repos, both have only 2 repos, the malware hosted one and and a github pages repo. Both accounts have really busy git histories that aren’t present in either of their 2 repos, so possibly emulating activity to give the accounts legitimacy

image
image1320×869 74.2 KB

image
image1330×861 116 KB

Checking the stars, there is an account that has starred both repos, doesn’t necessarily mean anything but you know

image
image982×388 29.6 KB

image
image790×373 21.2 KB

3

Note that the polygon.drpc.org domain is not the C2 itself, but one of the endpoints you may see during EtherHiding. The contract appears to be 0x1823A9a0Ec8e0C25dD957D0841e3D41a4474bAdc. In the any.run example this resolved to the follow text: http://85.137.52.21. It appears the data is just hex-encoded, without further obfuscation or encryption. Using EtherHiding the actor can update the C2 domain using infrastructure that is resistant to takedown.

2 Likes