Discord Malware Analysis

• bbystealer

  1 12 10.0 JavaScript

  Discontinued bbystealer is the new modern discord token grabber & token stealer, with discord password & token even when it changes. Terms Educational purpose only. Reselling is forbidden. You can use the source code if you keep credits (in embed + in markdown), it has to be open-source. We are NOT responsible of anything you do with our software.

Apparently this is a modified version of a quite popular pirate stealer, but while I was excited to grab the webhook URL and play with the attacker that paid for this NodeJS script, I found out they actually route it through two URLs. I'm not yet exactly sure if they request this API to call a webhook URL, or if they pass the webook to the API. Nonetheless, I should be able to directly invoke it myself...

• node-dpapi

  1 4 10.0 C++

  Node native module to encrypt/decrypt data. On Windows, it uses DPAPI

the data is encrypted with this pretty sure https://github.com/bradhugh/node-dpapi

• SurveyJS

  surveyjs.io sponsored

  Open-Source JSON Form Builder to Create Dynamic Forms Right in Your App. With SurveyJS form UI libraries, you can build and style forms in a fully-integrated drag & drop form builder, render them in your JS app, and store form submission data in any backend, inc. PHP, ASP.NET Core, and Node.js.

  

• pkg-unpacker

  1 35 10.0 JavaScript

  Unpack any pkg application

It is a node.js application which was turned into an exe file using the tool pkg. I would try something like this to unpack it: https://github.com/LockBlock-dev/pkg-unpacker

Suggest a related project