Timeline for Decompile a NodeJS compiled program maybe by NEXE
Current License: CC BY-SA 4.0
16 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jan 17, 2022 at 4:09 | history | protected | CommunityBot | ||
| Dec 16, 2021 at 3:01 | history | tweeted | twitter.com/StackReverseEng/status/1471314421796556808 | ||
| Dec 15, 2021 at 7:04 | comment | added | Alice | @JosephNguyen see the answer below | |
| Dec 15, 2021 at 7:03 | answer | added | Alice | timeline score: 4 | |
| Dec 8, 2021 at 21:08 | comment | added | Alice | happened to me. with this video and steam early access page youtube.com/watch?v=paLz989FWjo | |
| Dec 8, 2021 at 18:58 | comment | added | Alice | I got my account back. talk to me on discord emu#6969 if you want more info | |
| Dec 8, 2021 at 4:12 | comment | added | drhayes | I think I just got hit by something very similar, wrapped NodeJS binary from the account of someone I know. I'm new to reverse engineering too -- I can see the JS code in there via a hex editor but was wondering if there was a more sophisticated way to look at this thing. Ghidra seems promising, just don't know how to use it yet. | |
| Nov 12, 2021 at 22:11 | comment | added | user39531 | Has any progress been made on this? I have an incident that matches the same behavior and characteristics described above. Please let me know if I can be of any assistance. Discord: joseph5etr#7719 | |
| Nov 12, 2021 at 8:21 | comment | added | cloudberry | @John_H_Smith, how's your progress with Ghidra? After digging through the ASCII dump, I may have found out the the Author's first name and the name of his project. Although that doesn't give much information. Some global NPM packages were pointing to files on his Desktop. | |
| Nov 10, 2021 at 20:04 | history | edited | 0xC0000022L♦ | CC BY-SA 4.0 |
added 14 characters in body
|
| S Nov 10, 2021 at 20:02 | history | suggested | MarianD | CC BY-SA 4.0 |
Formatting, some fixes.
|
| Nov 10, 2021 at 11:14 | comment | added | John_H_Smith | Same here - decompiling with Ghidra worked. | |
| Nov 9, 2021 at 10:58 | comment | added | cloudberry |
I've also been investigating the same thing. Coincidentally, I also got my discord account hacked on November 3 (the same day you posted this question) by a wrapped NodeJS Windows executable. Just to be transparent, the malicious file that I ran was called HerosHour. I ran the .exe through a hex dump and saved just the human-readable ASCII text to a file. This does give you all of the JS code, but it also includes all of the NodeJS framework, as well as any dependencies. It's quite hard to read, but the source is definitely in there. Would you like to collaborate with me?
|
|
| Nov 3, 2021 at 16:05 | review | Suggested edits | |||
| S Nov 10, 2021 at 20:02 | |||||
| S Nov 3, 2021 at 1:34 | review | First questions | |||
| Nov 3, 2021 at 16:05 | |||||
| S Nov 3, 2021 at 1:34 | history | asked | suiram | CC BY-SA 4.0 |