Claim
Lure page
The visible web interface is the entry point into the reviewed wallet flow.
Detection focus
Correlate domain, script and loading relationships.
Supported by review evidenceMalware Analysis / Artefact: core-chain-v1.7.min.js · SHA-256 194ce39215a1…
XRP Flux Cast: analysis of the wallet controller
The claim interface, transaction authorizations and backend control in the archived XRPL controller. With code, C2 indicators and a separate assessment of the other cases.
- Scope
- Archived frontends, controllers and passive evidence in the Web3 corpus
- Method
- Independent research audit; not commissioned by the vendor
- Evidence
- Preserved JavaScript bundle; hash checked locally.
Finding
Findings separated by evidence class
No new execution; no proof of current deployment state
Analyst note
What the evidence actually supports.
The wallet prompt is not the interesting part; the data reaching it is. This analysis therefore starts with the preserved bundle and follows the path to the signing boundary.
- Artefact
- core-chain-v1.7.min.js
- SHA-256
194ce39215a160ed33b4748accdb6c5e792ba96b1d6199d7d2edb7352cc13c2f- Analysis basis
- Preserved JavaScript bundle; hash checked locally.
Malware / Evidence Atlas
Lure page → Effect
The analysis path for this report. Every node shows what is supported, where detection can start and where the claim stops.
5flow nodes
1detection artefacts
1rule formats
Claim
Wallet request
The client requests a wallet connection; a request alone does not establish approval.
Detection focus
Join unexpected provider calls with origin context.
Supported by review evidenceClaim
Transaction build
Static logic prepares an action whose meaning depends on parameters and the target system.
Detection focus
Compare methods, destinations and displayed purpose.
Supported by review evidenceClaim
Signing boundary
Only user approval crosses the signing boundary; this report separates preparation from execution.
Detection focus
Prioritise wallet warnings and simulation mismatches.
Bounded or unresolvedClaim
Effect
An observed or reconstructed action is assessed only within the documented case.
Detection focus
Correlate on-chain effects separately from frontend telemetry.
Bounded or unresolvedConfig Surface
Configuration fingerprint
Review pivots derived from the report — not a live configuration or universal family indicator.
01
Provider boundarywallet API
core
02
Approval pathrequest → sign
support
03
Destination rolecontext-bound
boundary
04
Chain effectseparate proof
boundary
Detection Pack
Defensive artefacts
Source, validation and limits accompany every rule.
SemgrepOpen rule +
Defensive model
rules:
- id: remote-wallet-transaction-signing
languages: [javascript, typescript]
severity: WARNING
message: Review wallet signing where transaction data originates in a remote response
patterns:
- pattern-inside: |
$R = await fetch(...);
...
$TX = await $R.json();
...
- pattern-either:
- pattern: $W.signAndSubmit($TX)
- pattern: $W.sign($TX)
Review scope and sample
The review examined the archived XRP Flux Cast controller from the Web3 corpus dated 11 October 2026. Its SHA-256 was recomputed locally and matches the historical audit. No sample was executed and no C2 or ledger query performed.
Files and checksums
- core-chain-v1.7.min.js
194ce39215a160ed33b4748accdb6c5e792ba96b1d6199d7d2edb7352cc13c2fPreserved original bundle
- core-chain-v1.7.pretty.js
a99df897c7aed2289b27ca934b4bb9e230cd4f0be790806c527d97421a56e02fFormatted derivative
- core-chain-v1.7.strings-folded.js
0131abf01187f995d4577bb58866b11ae90768212b7624706faf1759e9388c2dDerivative with folded strings
- tools/deobfuscate-xrpl.mjs
96694272da2415664f9b0948c55c87b3f2fb7441a663c6fd464ad761d7eb0b74Our archived tool for static preparation
Files and documented analysis path
The first view shows stored references; the second reconstructs the documented workflow. No step was rerun.
Files and documented analysis path
The first view shows stored references; the second reconstructs the documented workflow. No step was rerun.
A file reference does not establish runtime behaviour. Recorded processing is not a new execution.
SourceToolDerivedEvidenceMissingVerified referenceRecordedUnresolved
File references
Evidenced paths and existing derivatives; backend remains unresolved.
index.html
Captured HTML; script reference at line 262.
- File
- cases/xrp-flux-cast/evidence/raw/http/index.html
- SHA-256
- 3126e34907a0743b1b364436aaeb94af177ed77ff6753e1923db13e20ffbf1d3
- Location
- 262
- index.html → core-chain-v1.7.min.jsScript reference · Verified reference
index.html:262 names the relative bundle path. A reference does not establish execution.
core-chain-v1.7.min.js
Preserved original bundle; hash checked locally.
- File
- cases/xrp-flux-cast/evidence/raw/http/core-chain-v1.7.min.js
- SHA-256
- 194ce39215a160ed33b4748accdb6c5e792ba96b1d6199d7d2edb7352cc13c2f
- Location
- 1
- index.html → core-chain-v1.7.min.jsScript reference · Verified reference
index.html:262 names the relative bundle path. A reference does not establish execution.
- core-chain-v1.7.min.js → deobfuscate-xrpl.mjsText input · Verified reference
Tool:11–16 names the input and readFile.
deobfuscate-xrpl.mjs
Reads the specified bundle as text.
- File
- tools/deobfuscate-xrpl.mjs
- SHA-256
- 96694272da2415664f9b0948c55c87b3f2fb7441a663c6fd464ad761d7eb0b74
- Location
- 11–16
- core-chain-v1.7.min.js → deobfuscate-xrpl.mjsText input · Verified reference
Tool:11–16 names the input and readFile.
- deobfuscate-xrpl.mjs → pretty.jsFormatted output · Recorded
Tool:27–36 and56 document preparation/output; not rerun today.
- deobfuscate-xrpl.mjs → strings-folded.jsFolded output · Recorded
Tool:40–60 documents folding and output; archived file exists.
pretty.js
Formatted derivative, not raw code.
- File
- cases/xrp-flux-cast/analysis/core-chain-v1.7.pretty.js
- SHA-256
- a99df897c7aed2289b27ca934b4bb9e230cd4f0be790806c527d97421a56e02f
- Location
- 1
- deobfuscate-xrpl.mjs → pretty.jsFormatted output · Recorded
Tool:27–36 and56 document preparation/output; not rerun today.
strings-folded.js
Archived derivative with constant string folding.
- File
- cases/xrp-flux-cast/analysis/core-chain-v1.7.strings-folded.js
- SHA-256
- 0131abf01187f995d4577bb58866b11ae90768212b7624706faf1759e9388c2d
- Location
- 1
- deobfuscate-xrpl.mjs → strings-folded.jsFolded output · Recorded
Tool:40–60 documents folding and output; archived file exists.
- strings-folded.js → AdresslistenExtraction and checks · Recorded
Tool:94–115 documents validation/outputs; both stored lists are empty.
- strings-folded.js → AUDIT.mdFinding reference · Verified reference
AUDIT.md:29 names the folded artifact with a line reference.
- strings-folded.js → Backend-ImplementierungDynamic dependency · Unresolved
Client evidence establishes neither server code nor specific runtime responses.
Adresslisten
Classic XRP and hex-address lists are empty; both files were checked.
- File
- cases/xrp-flux-cast/analysis/xrpl-classic-addresses.txt
- SHA-256
- 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
- Location
- 1
- strings-folded.js → AdresslistenExtraction and checks · Recorded
Tool:94–115 documents validation/outputs; both stored lists are empty.
AUDIT.md
Historical controller audit with artifact and finding references.
- File
- cases/xrp-flux-cast/AUDIT.md
- SHA-256
- cb1295f1a9567225ada2e11bf523d8f5d52212486eef066e345ce6d5abeaae0c
- Location
- 9–19
- strings-folded.js → AUDIT.mdFinding reference · Verified reference
AUDIT.md:29 names the folded artifact with a line reference.
Backend-Implementierung
Actual server implementation is not evidenced by the bundle. An existing clean-room model does not replace it.
- strings-folded.js → Backend-ImplementierungDynamic dependency · Unresolved
Client evidence establishes neither server code nor specific runtime responses.
Historical analysis path
Archived preparation and assessment, no fresh execution.
Archivierte Aufnahme
The case report documents the October 2026 capture. No new capture was made.
- File
- cases/xrp-flux-cast/REPORT.md
- SHA-256
- 2fa163aad5dc2e2e8e33e9fea3e1686b829f16b57ebaf7357eccb07796b69118
- Location
- 16–23
- Archivierte Aufnahme → FormatierungDocumented step · Recorded
Tool path binds the archived bundle input.
Formatierung
First documented parse/print pass without compression.
- File
- tools/deobfuscate-xrpl.mjs
- SHA-256
- 96694272da2415664f9b0948c55c87b3f2fb7441a663c6fd464ad761d7eb0b74
- Location
- 26–36
- Archivierte Aufnahme → FormatierungDocumented step · Recorded
Tool path binds the archived bundle input.
- Formatierung → StringfaltungSecond pass · Recorded
Tool records two separate transform calls.
Stringfaltung
Conservative options; actual property pairs checked in derivatives.
- File
- tools/deobfuscate-xrpl.mjs
- SHA-256
- 96694272da2415664f9b0948c55c87b3f2fb7441a663c6fd464ad761d7eb0b74
- Location
- 38–54
- Formatierung → StringfaltungSecond pass · Recorded
Tool records two separate transform calls.
- Stringfaltung → Historisches AuditManual assessment · Recorded
AUDIT.md references the derived controller artifact.
- Stringfaltung → Adress-GegenprüfungCheck extraction · Recorded
Tool records address validation after folding.
Historisches Audit
Controller findings supported classification; harmless property pairs alone did not.
- File
- cases/xrp-flux-cast/AUDIT.md
- SHA-256
- cb1295f1a9567225ada2e11bf523d8f5d52212486eef066e345ce6d5abeaae0c
- Location
- 9–41
- Stringfaltung → Historisches AuditManual assessment · Recorded
AUDIT.md references the derived controller artifact.
- Historisches Audit → Neue LaufzeitprüfungCurrent state unresolved · Unresolved
The current task covered static archive review only.
Adress-Gegenprüfung
Checksum validation and empty outputs; not proof of absent runtime values.
- File
- tools/deobfuscate-xrpl.mjs
- SHA-256
- 96694272da2415664f9b0948c55c87b3f2fb7441a663c6fd464ad761d7eb0b74
- Location
- 94–115
- Stringfaltung → Adress-GegenprüfungCheck extraction · Recorded
Tool records address validation after folding.
Neue Laufzeitprüfung
Not performed. Another case’s historical session remains separate.
- Historisches Audit → Neue LaufzeitprüfungCurrent state unresolved · Unresolved
The current task covered static archive review only.
Limit: References do not establish runtime behaviour. “Recorded” edges describe documented steps; “unresolved” marks missing current or server-side evidence.
Formatting and folding constant strings
core-chain-v1.7.min.js is the preserved original bundle. core-chain-v1.7.pretty.js is a formatted derivative, not the raw original. The strings-folded.js derivative contains folded constant strings. The following pairs were matched locally in both derivatives; they are actual excerpts, not invented models. The actual preparation uses a conservative Terser pass: default compression is disabled while literal evaluation and property normalization are explicitly enabled. The excerpt shows that archived configuration.
const folded = await transform({
compress: {
defaults: false,
evaluate: true,
computed_props: true,
properties: true,
},
mangle: false,
format: {
beautify: true,
comments: true,
keep_quoted_props: true,
quote_style: 1,
},
});Read the code
Line numbers refer to this excerpt. Choose a note to highlight its range.
Checking the parser result
The actual wrapper passes source already read as text to Terser. If output code is absent, preparation stops with an error. This excerpt was read only; the pipeline was not rerun.
tools/deobfuscate-xrpl.mjs · Lines 20–24
Show file hash
SHA-256 96694272da2415664f9b0948c55c87b3f2fb7441a663c6fd464ad761d7eb0b74async function transform(options) {
const result = await minify(source, options);
if (!result.code) throw new Error('Terser returned no code');
return result.code;
}Read the code
Original source-file lines. Choose a note to highlight its range.
First pass without compression
Before string folding, the tool produces a readable derivative without compression or additional identifier mangling. That explains pretty.js: formatted source, not a raw capture or an already fully deobfuscated application.
tools/deobfuscate-xrpl.mjs · Lines 27–36
Show file hash
SHA-256 96694272da2415664f9b0948c55c87b3f2fb7441a663c6fd464ad761d7eb0b74const pretty = await transform({
compress: false,
mangle: false,
format: {
beautify: true,
comments: true,
keep_quoted_props: true,
quote_style: 1,
},
});Read the code
Original source-file lines. Choose a note to highlight its range.
Making the title property readable
The fragments resolve to the property name title. This excerpt demonstrates string obfuscation and its resolution, not the controller’s malicious behaviour. Surrounding control flow is intentionally omitted.
Archived excerpt and checked string resolution
Source artifact · hash of the full file, not the excerpt
- File
- core-chain-v1.7.pretty.js
- SHA-256
- a99df897c7aed2289b27ca934b4bb9e230cd4f0be790806c527d97421a56e02f
- Location
- Line 5246 · formatted derivative
document['ti' + 'tl' + 'e']document.titleReconstruction file and its own checksum
- Reconstruction file
- core-chain-v1.7.strings-folded.js
- SHA-256
- 0131abf01187f995d4577bb58866b11ae90768212b7624706faf1759e9388c2d
- Reconstruction location
- Line 5024
Text view · no execution · original remains unchanged
Identify literals
The brackets contain constant string literals only. The formatted derivative preserves the original string concealment.
Fold strings
Joining these literals produces title. A dynamic expression would instead remain unresolved.
Read the property
The existing analysis artifact shows document.title. The notation becomes readable; the object property stays the same.
Limit: No sample execution. Property resolution alone does not establish malicious behaviour.
A second property resolution
readyState is likewise written as short literals in the formatted artifact. It is directly readable in the folded artifact. Only the constant string was checked; no sample expression was executed.
Archived excerpt and checked string resolution
Source artifact · hash of the full file, not the excerpt
- File
- core-chain-v1.7.pretty.js
- SHA-256
- a99df897c7aed2289b27ca934b4bb9e230cd4f0be790806c527d97421a56e02f
- Location
- Line 42512 · formatted derivative
document['re' + 'ad' + 'yS' + 'ta' + 'te']document.readyStateReconstruction file and its own checksum
- Reconstruction file
- core-chain-v1.7.strings-folded.js
- SHA-256
- 0131abf01187f995d4577bb58866b11ae90768212b7624706faf1759e9388c2d
- Reconstruction location
- Line 40362
Text view · no execution · original remains unchanged
Identify literals
The brackets contain constant string literals only. The formatted derivative preserves the original string concealment.
Fold strings
Joining these literals produces readyState. A dynamic expression would instead remain unresolved.
Read the property
The existing analysis artifact shows document.readyState. The notation becomes readable; the object property stays the same.
Limit: No sample execution. Property resolution alone does not establish malicious behaviour.
Why the case was classified as a drainer
The interface promised an XRP airdrop claim. Historical controller evidence instead showed genuine XRPL transactions for signing and submission through wallet interfaces, while the page described the request as a generic “message”. Instructions came from the backend without local checks of recipient, amount or transaction type. This is the concrete discrepancy supporting classification: not merely proof of a claim, but approval of a potentially value-bearing transaction. Static evidence alone cannot determine the transaction type returned for a particular user. Recorded in REPORT.md lines 3–15 and AUDIT.md lines 9–13, 29 and 47–59; controller region core-chain-v1.7.strings-folded.js from line 40576. The audit does not claim a flaw in XRPL or legitimate wallet products.
Backend and sample fingerprint
AUDIT.md line 63 records the hardcoded backend domain. IOCS.md also identifies the captured frontend and bundle hash. The table separates those roles: a hash identifies identical bytes; a domain records an infrastructure relationship. Neither alone establishes an operator identity or current activity.
Indicators and attribution
Domains are deliberately defanged. The hash was recomputed locally.
xrpl-scanner[.]com- Role
- hardcoded C2/API base in preserved primary controller
- Evidence
- Historical evidence checked locally in the archive.
- Source
- IOCS.md · lines 10; AUDIT.md · lines 63
- Limit
- No operator attribution or proof of funds received.
x-flux-cast[.]pages[.]dev- Role
- captured frontend for primary confirmed sample
- Evidence
- Historical evidence checked locally in the archive.
- Source
- IOCS.md · lines 9
- Limit
- No operator attribution or proof of funds received.
loyalty-xprl[.]com- Role
- separately documented historical frontend
- Evidence
- Historical evidence checked locally in the archive.
- Source
- REPORT.md · lines 23
- Limit
- No operator attribution or proof of funds received.
194ce39215a160ed33b4748accdb6c5e792ba96b1d6199d7d2edb7352cc13c2f- Role
- exact preserved primary JavaScript sample
- Evidence
- Historical evidence checked locally in the archive.
- Source
- core-chain-v1.7.min.js · lines 1; AUDIT.md · lines 19
- Limit
- No operator attribution or proof of funds received.
No indicators in this category.
No static recipient address extracted
Both archived lists, xrpl-classic-addresses.txt and hex-addresses.txt, contain zero non-empty entries. IOCS.md and AUDIT.md likewise report no validated static XRP recipient in the primary sample. Negative extraction does not prove no address appears at runtime. Nor does it permit substituting an address from another case as this sample’s recipient.
Validating address candidates
Historical extraction of classic XRP addresses did not rely on regex alone. This function checks decoded format and embedded checksum. It does not prove a recipient role. The archived output list remains empty; dynamically supplied values are not excluded.
tools/deobfuscate-xrpl.mjs · Lines 94–102
Show file hash
SHA-256 96694272da2415664f9b0948c55c87b3f2fb7441a663c6fd464ad761d7eb0b74function isValidClassicAddress(value) {
const decoded = decodeRippleBase58(value);
if (!decoded || decoded.length !== 25 || decoded[0] !== 0) return false;
const payload = decoded.subarray(0, 21);
const expected = decoded.subarray(21);
const first = createHash('sha256').update(payload).digest();
const actual = createHash('sha256').update(first).digest().subarray(0, 4);
return actual.equals(expected);
}Read the code
Original source-file lines. Choose a note to highlight its range.
Loyalty and Shibnow have different evidence classes
The Loyalty report includes an earlier explicitly authorized controlled C2 session. It cannot be described as wholly static research; that session was not repeated now. Shibnow remained unconfirmed: the captured content was a challenge page without application logic. Shared infrastructure does not turn that candidate into a confirmed drainer.
Ecosystem context, not new cryptography
Confirmed deception was tailored to Web3 expectations and genuine wallet dialogs. Brand imitation, misleading claim copy and string obfuscation are familiar techniques, not evidence of technical novelty. The relevant distinction is the evidenced discrepancy between presentation and action. This material does not establish market share, success rate or common authorship.
Findings at a glance
- Bundle hash and derivatives are specifically mapped.
- C2 relationship is evidenced, operator identity is not.
- No static recipient address is validated in the primary sample.
Review limits
- Local archive review only, no fresh runtime test.
- No wallet, victim or transaction data from separate event traces.
- Negative address extraction does not exclude dynamic runtime values.
Context, not evidence
The Evidence Anchor at the start identifies the binary, file or revision actually used. These links provide context and reported observations; they do not substitute for local sample analysis.
XRPL · Secure Signing ↗Conclusion
Conclusion: classification supported, attribution limited
Historical controller evidence supports the primary case’s drainer classification. The local recheck confirms its hash and two actual string resolutions, not present-day activity. A static recipient remains unestablished; Shibnow remains a candidate.
Next steps
- Share IOCs with their role and evidence date.
- Keep runtime and attribution questions separate.
Basis of this judgmentArchive dated 11 October; local read-only check on 13 October 2026.
Archived frontends, controllers and passive evidence in the Web3 corpus
Archived frontends, controllers and passive evidence in the Web3 corpus