Someone have sent a Discord token stealer and out of curiosity, I would like to decompile it, just to get some info about the attacker.
Judging by folders created in my user directory, multiple references to directory named .nexe I'm pretty sure that it was compiled using nexe, and it does something on GitHub (maybe download config), sends the token via Discord webhook feature (uses an npm package for that), deletes login info, and quits Discord so the user is logged out.
I've tried to view requests that this malware makes with Wireshark, and sevral other programs but it's HTTPS so it's encrypted.
Can anyone help me with decompiling this malware or at least decrypting traffic between it and GitHub/Discord?
