How anonymous-beta/sixerc works
SIXERC presents itself as a Windows session-harvesting tool. The sampled code indicates credential collection, service access, and outbound transfer, alongside anti-analysis and cleanup behavior. The README offers no further capability details, and several module implementations were not sampled; this is therefore a high-level component inventory, not a complete call map.
Main entry points: main.cpp Program Orchestration · sic.cpp M365 Service Access · ep.cpp Data Transfer · ksd.cpp Self-Destruct Operations
Components 13
Collection
- Program Orchestration
src/main.cpp - Browser Session Collection
src/modules/bps.cpp - Cryptographic Operations
src/core/crypto.cpp - Session Validation
src/modules/tvre.cpp
Service Access
- M365 Service Access
src/modules/sic.cpp - Microsoft 365 Services
Outbound Transfer
- Data Transfer
src/modules/ep.cpp - Configured Endpoints
Evasion and Cleanup
- Anti-Analysis Checks
src/anti/antidebug.cpp - Obfuscation Utilities
src/core/obfuscation.cpp - Persistence Operations
src/modules/ph.cpp - Self-Destruct Operations
src/modules/ksd.cpp
Other components
- Local Execution
Connections 10
- Local Execution → Program Orchestration: starts
- Program Orchestration → Anti-Analysis Checks: checks environment
- Program Orchestration → Browser Session Collection: requests collection
- Program Orchestration → Session Validation: requests validation
- Program Orchestration → M365 Service Access: requests enumeration
- M365 Service Access → Microsoft 365 Services: sends requests
- Program Orchestration → Data Transfer: requests transfer
- Data Transfer → Configured Endpoints: sends data
- Program Orchestration → Self-Destruct Operations: optional cleanup
- Self-Destruct Operations → Persistence Operations: removes persistence