> But you put the address in the malware anyway so what's the point for fetching from Gist and YouTube????

The ability to change it, dude. Have you never written a malware before?

Often a primary concern is the security response, so you want redundancy for the ability to work around enforcement action, such as website takedowns.

Hardcoding a scapegoat into the malware itself also buys you time, so that the first enforcement action is less likely to spend your backups right away.

> And to whoever made this: you probably spent weeks or shit ton of tokens on ChaCha20, AES-CTR, runtime API hashing, anti sandbox scoring, Chrome app bound encryption bypasses, just to make a shitty skid malware.

People have been making infostealers that support hundreds or thousands of different apps and corners of your computer for decades. Plenty of vendors pride themselves on it.

Meanwhile you used LLM to write a bunch of your article, and seemingly to do the RE too...