CryptoDrainEXE: analysis of a browser-wallet drainer

What we reviewed

We reviewed a pinned JavaScript snapshot of the GitLab project cryptodrainexe/cryptowalletdrainer. The source dates to 23 February 2025 and the manual audit to 12 October 2026. For this account, existing files were compared statically on 13 October.

The question is what this specific copy shows about wallet behaviour, data transmission and system completeness. No Windows executable was examined, no sample executed and no endpoint contacted.

Reference: ARTIFACT-MANIFEST.md, commit 233cd4e62536170ef67ac12e3ac8f218f1d10517; behaviour assessment in AUDIT-DE.md. The hash ledger below distinguishes the original from derived artifacts.

File relationships and analysis history

The first view shows selected references in the preserved HTML package. The second separates raw file, our tool, existing derived artifacts and report. Lines represent documented file relationships, not an executed wallet or C2 chain.

Original file: HTML metadata

The HTML snapshot places the project name in its title element. The browser file therefore labels itself a drainer; the name alone still does not establish behaviour. Only metadata is shown, not executable script setup.

1<html lang="en"><head></head><body>
2
3    <meta charset="UTF-8">
4    <meta name="viewport" content="width=device-width, initial-scale=1.0">
5    <title>CryptoDrainEXE Multi-chain Crypto Wallet Drainer</title>

What deobfuscation changed

The historical manifest records 3,295 string entries, 403 table rotations, 107 decoder aliases and 7,922 statically replaced calls. Subsequently, 1,722 string concatenations were folded and the normalized output syntax-checked with Terser 5.44.0. This work was not rerun here.

The original, decoder-replaced and normalized artifacts have different hashes. Some opaque variable names remain. The output is readable, not an executed program or verified deployment.

Original evidence: page title

The short original excerpt is displayed as text only. It was located exactly in the raw file and existing normalized output. The page title supplies the name in wallet-connection metadata. This demonstrates the transformation, not the malicious functionality of the whole sample.

'name':document[_0x24d3e8(0x483)]

name: document.title,

Original evidence: DOM element type

Normalized output shows the DOM identifiers actually used: style, div, web3-overlay and web3-modal. The comparison above establishes one string resolution; the longer genuine excerpt below shows its immediate UI context.

This is an excerpt from existing analysis output, not a rebuilt model UI. SHA-256: 02818c11a03deb783b45f89bfbc44409ae39ad7db7bbdc16edb251e30d27f42e.

'FxZSQ':_0x844b4c(0x579)

FxZSQ: "style",

1672        FxZSQ: "style",
1673        OujMT: "web3-style",
1674        iviYd: "div",
1675        kKYbd: "web3-overlay",
1676        wqNjF: "none",
1677        XEQTG: ".web3-overlay",
1678        uoEut: "click",
1679        luxzn: "web3-modal"

Our tool: reading escape sequences

This excerpt comes from our analysis tool, not the drainer. It validates individual escape sequences, returns a character and advances the read position. No eval, browser or network request.

It is not a complete JavaScript parser. It documents one helper step, not execution of the sample.

1function decodeEscape(text, index) {
2  const ch = text[index];
3  const simple = { n: "\n", r: "\r", t: "\t", b: "\b", f: "\f", v: "\v", "0": "\0" };
4  if (Object.hasOwn(simple, ch)) return [simple[ch], index + 1];
5  if (ch === "x") {
6    const hex = text.slice(index + 1, index + 3);
7    if (!/^[0-9a-f]{2}$/i.test(hex)) throw new Error(`invalid hex escape at ${index}`);
8    return [String.fromCharCode(Number.parseInt(hex, 16)), index + 3];
9  }
10  if (ch === "u") {
11    const hex = text.slice(index + 1, index + 5);
12    if (!/^[0-9a-f]{4}$/i.test(hex)) throw new Error(`invalid unicode escape at ${index}`);
13    return [String.fromCharCode(Number.parseInt(hex, 16)), index + 5];
14  }
15  if (ch === "\n") return ["", index + 1];
16  if (ch === "\r" && text[index + 1] === "\n") return ["", index + 2];
17  return [ch, index + 1];
18}

Analysis tool: reading a bounded string literal

This genuine tool excerpt reads characters between known quotation marks. Escapes are delegated to the separate helper. It evaluates no JavaScript; table markers and sample-specific decoder mappings are excluded.

44    const quote = text[i];
45    if (quote !== "\"" && quote !== "'") throw new Error(`unexpected token in string table at ${i}`);
46    i += 1;
47    let value = "";
48    while (i < text.length && text[i] !== quote) {
49      if (text[i] === "\\") {
50        const decoded = decodeEscape(text, i + 1);
51        value += decoded[0];
52        i = decoded[1];
53      } else {
54        value += text[i];
55        i += 1;
56      }
57    }
58    if (text[i] !== quote) throw new Error("unterminated string table item");

Analysis tool: folding string literals

This second tool excerpt joins recognised JSON string literals. The loop stops when no replacement occurs. It is the actual local processing step, not a rebuilt drainer model. The historical run and counts are recorded in the manifest; it was not rerun for this addition.

110const jsonString = '"(?:\\\\.|[^"\\\\])*"';
111const concatPattern = new RegExp(`(${jsonString})\\s*\\+\\s*(${jsonString})`, "g");
112let foldedConcats = 0;
113while (true) {
114  let round = 0;
115  output = output.replace(concatPattern, (_full, left, right) => {
116    round += 1;
117    foldedConcats += 1;
118    return JSON.stringify(JSON.parse(left) + JSON.parse(right));
119  });
120  if (round === 0) break;
121}

Wallet behaviour and data transmission

Static analysis documents value sorting by amount_usd (line 4445) and wallet/device telemetry including IP/location data and asset inventory (1938–2258). The code therefore prioritises assets by value and transmits information about the wallet and its environment.

Manual finding CR-01 describes the harmful mismatch: the page frames the action as verification or a claim while code requests broad permissions or direct asset transfers. The wallet branches are documented at 4678–5875; permission-related findings at 3525–3832 and 4529–4677. “Verification Error” appears as UI text at line 4816. The assessment relies on paths and context, not that word alone.

Telegram is a telemetry sink here, not evidence of a complete executing C2 server.

Addresses and services by role

The two configured target addresses below are separate from protocol addresses and services. Address and Receiver name the same value; chain configuration additionally specifies an execution-contract target. The manual audit statically traces the recipient/spender role into value-bearing paths.

Other wallet deep links, chain explorers, price and metadata services are referenced in the sample. They are not standalone malicious indicators. Public-IP lookup references api[.]ipify[.]org in normalized output, line 1950; the table presents representative services rather than every domain.

Why this is not a complete C2 reconstruction

In this copy, send_request is a local dispatcher (lines 1795–1858), not a complete HTTP C2 client. Forwarding certain signature data to an executing server is therefore incomplete. The original server source is missing.

Telegram is documented as a telemetry service; bot tokens and chat/user identifiers remain redacted. RPC endpoints and the declared metadata domain do not establish a complete operator backend.

What distinguishes this copy

String tables and opaque names are ordinary obfuscation. More informative is the combination of wallet-oriented behaviour, value sorting and telemetry with incomplete dependencies and missing server source.

This explains why a readable code copy and a fully observed system are not the same. It supports no claim about market position or actual victim losses.

Review limits

• No Windows executable analysis, sample execution or wallet signing.
• No on-chain verification of account type, ownership or losses.
• No credentials, request bodies or functioning drainer sequences published.