Here is the most complete source code of this malware I can find. its malware known as piratestealer: https://github.com/teddybearsz/shitasssrcdonttouchitpleasepleaseplease/tree/ddc994942e2c0a79fc5d5e54d4a0e158fa0e5d51/src/
So in a gist, PirateStealer (written in node.js and compiled with nexe) is an evolution of ksgrabber (written in C#) which was made by Stanley-GF on GitHub https://github.com/masamesa/KSGrabber-MalwareAnalysis (see https://github.com/masamesa/KSGrabber-MalwareAnalysis/issues/1)
Take a look at the twitter links here:
and the flowchart below.
PirateStealer was made by Stanley-GF, bytixo, Minehacker765, and syndrvme on GitHub.
A LOT of the endpoints supporting this were taken down. https://stealer.re/ seems to be back up after going down for a bit, so they probably have updated their
/injection endpoint which loads in JS that gets bundled into discord (and/or betterDIscord)'s
I have submitted abuse reports to AWS, an ISP (congent) that had a CIDR block in poland https://bgp.he.net/ip/188.8.131.52, that was hosting this file at the path
A domain name primefa.xyz that was being queried for during runtime which resolved to the IP mentioned above, but is no longer as ICANN put the domain on hold after reports to the .xyz TLD in Las Vegas.
Stanley leads on more than he puts out. His GitHub profile claims he is 13 and regrets making the malware, but from screenshots obtained by a friend of mine, he was working on getting his endpoints back up when they were taken down due to abuse reports.
On stealer.re you can input a webhook and a
.ico file, and it will build you an EXE that you can use.
If you look at the webhooks that the /injection payload sends, and then make a GET request to it without any parameters, it will show you this
How did you manage to find the url vmro? Join: https://discord.gg/NmatMp9K5V and I gib u party vmro!