Chocapikk/malware_analysis_react2shell

GitHubRepository PoCWriteup

PoC files

11 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A technical analysis report detailing a supply chain attack where a CVE-2025-55182 scanner was backdoored to download and execute HTA malware from py-installer.cc. The report describes the backdoor code, malware behavior, IOCs, and detection rules, but contains no executable exploit or scanner code.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence is a README.md analysis report describing a backdoor in a separate repository (niha0wa/React2shell-scanner). The reviewed artifact itself contains no executable code, no backdoor, and no deceptive payload. The report documents malicious behavior in an external tool but does not perform any harmful actions.

ClassificationWriteup
Model confidence100%
AuthenticationNot required
LanguagesMarkdown
Target softwarereact-server-dom-webpackreact-server-dom-turbopackreact-server-dom-parcelReact2shell-scanner
Attack typessupply chain attackbackdoorinformation stealercryptocurrency wallet stealer
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a README.md containing a detailed technical analysis report. It describes backdoor code and malware behavior but does not include any executable exploit or scanner code. The report itself is a writeup.

README.md:1-765

Requirements

  • Victim must clone and execute the backdoored React2shell-scanner repository.README.md:5

Observed behavior

  • The report describes a backdoor function _initialize_runtime_environment() that executes mshta.exe with a remote URL upon import.README.md:79-93
  • The report analyzes a multi-stage HTA malware that collects system information, targets cryptocurrency wallets, and propagates via USB.README.md:129-358
  • The report provides YARA and Sigma detection rules for the backdoor and malware.README.md:549-576
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Documentation
README.md analysis reportThe artifact is a text report describing a backdoor in an external repository. It contains no executable code or instructions to run a PoC.README.md:1-765
Review boundaries

What the analysis did not establish

  • Only the README.md file was provided; 10 other files in the repository were omitted.
  • The analysis is based solely on the report's claims; no executable code was inspected or executed.
  • Only the README.md file was provided; 10 other files in the repository were omitted from the evidence packet. The analysis scope confirms no executable source was identified in the artifact.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1