This repository does not provide runnable malware, loaders, or instructions for execution or reconstruction. All obfuscated lua files are intentionally left intact for independent deobfuscation/reverse engineering. No deobfuscation or modification have been performed. The names of the files have been renamed to their respective SHA-256 Hash. Their extension have been left intact as found. All analysis should be performed in isolated environments.
Repository pages that hosted SmartLoader/StealC variants are preserved via third-party archival services after they have been reported, for the purposes of analysis and attribution. Live malware is excluded from the archival process. External archival links are provided for reference only.