What it does (high level)

If MetaMask (or another EIP-1193 provider) is present: it hooks window.ethereum.request/send/sendAsync and silently rewrites outgoing transactions so money/approvals go to the attacker.
If no Ethereum wallet is present: it rewrites HTTP responses (both fetch and XMLHttpRequest) to replace any crypto address it sees on the page with one of the attacker’s addresses (BTC, ETH, TRON, LTC, BCH, Solana, etc.).
It keeps counters and exposes window.stealthProxyControl so the operator can check whether the interceptor is active.

The moving pieces (with effects)

Entry / gating

checkethereumw() calls ethereum.request({method:"eth_accounts"}).
- If accounts exist ⇒ runs runmask() (the wallet hook) and sets a flag neth=1.
- In all cases it calls newdlocal() once (the network-response rewriter).

HTTP response rewriter (newdlocal)

Overrides window.fetch and patches XMLHttpRequest so every response is run through _0x19ca67().
_0x19ca67() → _0x20669a() scans strings/JSON with regexes for addresses of:
- Ethereum, Bitcoin (legacy + bech32), Tron, BCH, Litecoin (P2PKH + bech32), Solana (several prefixes).
For any detected address not in its baked-in allowlist, it replaces it with the “closest looking” attacker address using a Levenshtein distance function.
- This “nearest look-alike” trick makes replacements harder to spot at a glance.
Special case: Ethereum addresses aren’t replaced if neth==1 (i.e., when a wallet is present), because the wallet hook below is a stronger attack path.

Wallet hook (runmask)

Wraps provider methods and mutates request params before they’re sent:
- eth_sendTransaction
  - If value is non-zero, it forces to = 0xFc4a4858bafef54D1b1d7697bfb5c52F4c166976 (attacker).
  - If data is present, it inspects function selectors and rewrites payloads:
    - 0x095ea7b3 (ERC-20 approve(address,uint256))
      → sets spender = attacker and value = 0xffff…ffff (max allowance).
    - 0xd505accf (EIP-2612 permit signature)
      → rewrites spender = attacker and value = max while preserving the rest (deadline, sig).
    - 0xa9059cbb (ERC-20 transfer(address,uint256))
      → forces to = attacker.
    - 0x23b872dd (ERC-20 transferFrom(address,address,uint256))
      → forces the recipient to attacker.
    - It also logs known DEX router addresses (Uniswap v2/v3, Pancake, 1inch, Sushi), but that’s just noise/telemetry.
- solana_signTransaction / solana_signAndSendTransaction
  - Iterates instructions/keys and replaces every pubkey it finds with a constant 19111111111111111111111111111111 (malicious redirection / breakage).
Exposes stealthProxyControl with:
- isActive(), getInterceptCount(), getOriginalMethods(), forceShield()—handy for the operator, suspicious on a site.

Indicators of compromise (IoCs)

Primary ETH receiver: 0xFc4a4858bafef54D1b1d7697bfb5c52F4c166976
Huge hard-coded address lists for: ETH, BTC (1… + bc1…), TRON (T…), BCH (bitcoincash:), LTC (ltc1…, L…/M…), Solana (various prefixes).
Global names/patterns you can grep for in your codebase:
- stealthProxyControl, runmask, newdlocal, checkethereumw, neth, loval, rund
- Function selectors: 0x095ea7b3, 0xd505accf, 0xa9059cbb, 0x23b872dd
- The long address arrays and the constant Solana pubkey 19111111111111111111111111111111.

Network-layer replacement poisons any page content or API payload before your app sees it.
Wallet-layer hooking corrupts transactions at the last moment—even if your UI shows the right info—by mutating the provider call arguments preflight.
Levenshtein “nearest match” helps the swapped addresses look plausible.