The structure of the archive looked very similar to the sample I was analyzing. The securelist article [1] also describes the same malware techniques and steal

The structure of the archive looked very similar to the sample I was analyzing. The securelist article [1] also describes the same malware techniques and stealer behaviors, just in a way more undetailed manner than the original reddit post. [1] https://securelist.com/gitvenom-campaign/115694/ https://securelist.com/gitvenom-campaign/115694/ edit: update my grandparent comment with the reddit links. It was on /r/netsec and /r/hacking and not on /r/cybersecurity where the author posted it first :D