Staged payload delivery
Named by 2 kept items in this workspace.
Search every workspace for Staged payload delivery. It matches the name as written, so it can find other things that share it.
The items that name it 2
obfuscated loader (setup.cjs) fetches and writes a second-stage payload to a randomly named file in temp directory and executes it
Fetching a second-stage payload at runtime from an external URL (not embedded in the tarball) rather than shipping the full malware in the package
All techniques in this workspace.