Someone have sent a Discord token stealer and out of curiosity, I would like to decompile it, just to get some info about the attacker.

Judging by folders created in my user directory, multiple references to directory named .nexe I'm pretty sure that it was compiled using nexe, and it does something on GitHub (maybe download config), sends the token via Discord webhook feature (uses an npm package for that), deletes login info, and quits Discord so the user is logged out.

I've tried to view requests that this malware makes with Wireshark, and sevral other programs but it's HTTPS so it's encrypted.

Can anyone help me with decompiling this malware or at least decrypting traffic between it and GitHub/Discord?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.