Heavy obfuscation: Uses SomalifuscatorV2

Text editor confusion: Abuses UTF-16 Byte Order Marker

Encoding: Uses ROT-24 encoding

Anti-VM checks: Checks for VM (>4GB RAM) and employs anti-tampering methods

Stealer download: Fetches open-source KematianStealer from GitHub, patches C2 on the fly

Stealer behavior: Written in PowerShell, exfiltrates sensitive data, evades monitoring, maintains persistence