MSI installer contains three malicious JavaScript files (install.js, sched.js, sucesso.js) that prepare the Python environment for the next stage loader.

The sched.js script adds persistence by creating a Scheduled Task and a Startup link, and sucesso.js is responsible for reporting the status to the C2.

Meanwhile, the install.js script performs the following tasks:

Check for Internet connection (using google.com)
Create %APPDATA%\\\\extensions folder
Download password-protected archives such as python32.rar/python64.rar and unrar.exe to that extensions folder
Write the path of the newly created extensions folder to HKEY_CURRENT_USER\\Software\\Python\\Config\\Path
Performs some basic system profiling
Execute unrar.exe command with the password specified as an argument to unpack python32.rar/python64.rar
Connect to C2 and download 32bit and 64bit __init__.py scripts along with two enc