5

I recently got idiotly scammed one of my discord account but kept the malware in case.

Curious, I would love today to break into the executable to fetch any information about the scammer.

I decompiled the program using IDA, and found out it was a NodeJS program. However, I still can't find the actual code of the scammer that took my token... I am sure he is calling a webhook, connecting to a bot or something that leave his token in it.

I can see in IDA multiple calls to a folder named .nexe/ which looks to me like the name of the compiler used: nexe.

Does anyone have tips to decompile a NodeJS application? I'm barely new in the reverse engineering, so if anybody could let me tips to decompile it...

I don't know if nexe obfuscates the code, if there is better decompiler apps for NodeJS executable.

Improve this question
8
  • 1
    I've also been investigating the same thing. Coincidentally, I also got my discord account hacked on November 3 (the same day you posted this question) by a wrapped NodeJS Windows executable. Just to be transparent, the malicious file that I ran was called HerosHour. I ran the .exe through a hex dump and saved just the human-readable ASCII text to a file. This does give you all of the JS code, but it also includes all of the NodeJS framework, as well as any dependencies. It's quite hard to read, but the source is definitely in there. Would you like to collaborate with me?
    – cloudberry
    Commented Nov 9, 2021 at 10:58
  • Same here - decompiling with Ghidra worked.
    – John_H_Smith
    Commented Nov 10, 2021 at 11:14
  • @John_H_Smith, how's your progress with Ghidra? After digging through the ASCII dump, I may have found out the the Author's first name and the name of his project. Although that doesn't give much information. Some global NPM packages were pointing to files on his Desktop.
    – cloudberry
    Commented Nov 12, 2021 at 8:21
  • Has any progress been made on this? I have an incident that matches the same behavior and characteristics described above. Please let me know if I can be of any assistance. Discord: joseph5etr#7719
    – user39531
    Commented Nov 12, 2021 at 22:11
  • I think I just got hit by something very similar, wrapped NodeJS binary from the account of someone I know. I'm new to reverse engineering too -- I can see the JS code in there via a hex editor but was wondering if there was a more sophisticated way to look at this thing. Ghidra seems promising, just don't know how to use it yet.
    – drhayes
    Commented Dec 8, 2021 at 4:12

1 Answer 1

Reset to default
4

Here is the most complete source code of this malware I can find. its malware known as piratestealer: https://github.com/teddybearsz/shitasssrcdonttouchitpleasepleaseplease/tree/ddc994942e2c0a79fc5d5e54d4a0e158fa0e5d51/src/

So in a gist, PirateStealer (written in node.js and compiled with nexe) is an evolution of ksgrabber (written in C#) which was made by Stanley-GF on GitHub https://github.com/masamesa/KSGrabber-MalwareAnalysis (see https://github.com/masamesa/KSGrabber-MalwareAnalysis/issues/1)

Take a look at the twitter links here:

https://twitter.com/MasaMesa_/status/1435179217248034819 https://twitter.com/MasaMesa_/status/1469617216261926916 and the flowchart below.

PirateStealer was made by Stanley-GF, bytixo, Minehacker765, and syndrvme on GitHub.

A LOT of the endpoints supporting this were taken down. https://stealer.re/ seems to be back up after going down for a bit, so they probably have updated their /injection endpoint which loads in JS that gets bundled into discord (and/or betterDIscord)'s .asar file.

I have submitted abuse reports to AWS, an ISP (congent) that had a CIDR block in poland https://bgp.he.net/ip/95.214.54.208, that was hosting this file at the path /injection https://gist.github.com/AskAlice/2fe11591adc820d038529e7c0908d0fd

A domain name primefa.xyz that was being queried for during runtime which resolved to the IP mentioned above, but is no longer as ICANN put the domain on hold after reports to the .xyz TLD in Las Vegas.

https://github.com/stanley-gf/piratestealer

Stanley leads on more than he puts out. His GitHub profile claims he is 13 and regrets making the malware, but from screenshots obtained by a friend of mine, he was working on getting his endpoints back up when they were taken down due to abuse reports.

On stealer.re you can input a webhook and a .ico file, and it will build you an EXE that you can use.

If you look at the webhooks that the /injection payload sends, and then make a GET request to it without any parameters, it will show you this

https://p9iprsfdr7.execute-api.us-east-2.amazonaws.com/default/EmailChanged

How did you manage to find the url vmro? Join: https://discord.gg/NmatMp9K5V and I gib u party vmro!

enter image description here

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.