Hrmm....thinking a whitehat has taken control ;)

Ultimately #asyncrat and #hvnc:

mathewhvnc.twilightparadox\.com
kjhvnc.duckdns\.org
rtasyn.duckdns\.org
asyncyam.twilightparadox\.com

Big zips appear to be a #python #stealer

Same

Additional details:

But it's not though. Not really.