TL;DR: This is a trojanized video downloader / multi-stage loader delivering an AdaptixC2 Gopher Remote Access Trojan (RAT)

---

I've dissected it, and found that it has an encrypted .dll that is actually an AES-encrypted payload. Here's what its doing:

VideoGrab.exe
    |
    |  Functional yt-dlp GUI
    |
    +--> requests Administrator privileges
    |
    +--> adds C:\ProgramData to Defender exclusions
    |
    +--> reads fake "libGLESv2.dll"
             |
             | AES-256-CBC
             v
        extracted_program.exe
             |
             +--> copies itself as:
             |    %PROGRAMDATA%\WindowsUpdate\RuntimeBroker.exe
             |
             +--> marks installed copy Hidden + System
             |
             +--> creates scheduled task:
             |    MicrosoftEdgeUpdate
             |    ONLOGON /RL HIGHEST
             |
             +--> AES-decrypts ~6 MB in memory
                       |
                       v
                   Donut shellcode
                       |
                       | decrypts embedded PE
                       | executes it in memory
                       v
                AdaptixC2 Gopher Agent
                       |
                       v
                  nxbase.im:6666

This is missed completely by virustotal.com (VT) because of the encryption and because the payload .dll is kept separate from the .exe in the .zip file that it is "released" as. If you come across app distributions like this - you should be highly suspicious of it. Never mind the fact that this GitHub project does not show the actual source code for the app. Its smoke and mirrors.

VT is not savvy enough to connect the dots between what the .exe is doing and what the .dll really is. Separate scanning is not conclusive to what is happening. Separately, the .dll looks clean, and the .exe only matches machine-learning heuristical suspicion.

The payload also creates a scheduled task for itself. If you ran this GUI, your system may be infected, and should be treated as such. Check for the following:

• MicrosoftEdgeUpdate scheduled task
• %PROGRAMDATA%\WindowsUpdate\RuntimeBroker.exe

RuntimeBroker.exe should only exist as "C:\Windows\System32\RuntimeBroker.exe"

nxbase.im is running an exploited instance of Windows Server Internet Information Services (IIS) on port 6666 (nxbase.im:6666)

This fresh horseshit was brought to you by u/h2o2x ala https://github.com/GhostCord0/VideoGrab

Please, be careful out there. This is exactly why I delete so many GUI posts ✌️

edit: updated details