Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I reversed a Node.js malware and found the author

medium.com

Post reply on HN
Print view View original

31–40 of 79 posts

Re: I reversed a Node.js malware and found the author

#31

Post by raverbashing »

Fabricio20 wrote: post #9
easrng wrote: post #2

It's always PirateStealer, probably because it's open source so it's easy for people to pick up and use instead of exerting effort. Also, you can send a DELETE request to a Discord webhook without any auth, defusing the malware.

I'm still glad the DELETE thing works, I've reported a few times these with a complete writeup to Discord and all I got was a ticket being auto-closed after a month and the webhooks+servers still being up. I personally no longer bother reporting, just straight delete the webhook to stop the spread. Makes you wonder what their security/support team is doing with all those tickets.

Discord's fraud and malware response is too simplistic to work

Somebody using my email for a discord acct without verification? Sure, go ahead (but I got the "verify your account" emails)

Then I "forget" the acct password, bam, account locked.

Which is fine by me, since I don't use that email with discord, still...

Re: I reversed a Node.js malware and found the author

#34

Post by smorgusofborg »

Mashimo wrote: post #33
b_u_n_n_y wrote: post #32

Excuse my ignorance, but what does this particular malware do? Control computer? See what the were typing?

* Discord Credit Card Stealing * Discord Login Stealing

I didn't really get that comment in the OP. There's not an API that gives you your entire stored credit card information? Right?

Re: I reversed a Node.js malware and found the author

#35

Post by suzzer99 »

vmception wrote: post #26
grepfru_it wrote: post #15

I did the same thing to someone who attacked my gf in high school. They got her with subseven which was extremely easy to remove. Rather than just erase it, I took a copy home with me and analyzed it. Running the strings command uncovered the subseven signatures.. Turns out there was tooling that allowed you to modify the binary and redistribute it. Except the binary had an ICQ address to alert him to my gf’s online…

I used to just DDOS people’s AIM and messengers if they crossed me, as a phantom curse attached to them and they had no idea the cause. I would chat with them as normal at the same time, chuckling to myself as they kept falling offline following a barrage of emoticons and requests from my army of chat bots that made their process run out of memory. Eventually I’d bore of it. Or have one of the chatbots tell them not…

Way way back in the day, my friend wrote a program that would format the user's Commodore 5 1/4" floppy disk (usually the one that also ran their BBS) if they just tried to load it. They didn't even have to run it.

If someone screwed us, we'd create a new identity and upload a file named after a hot new pirated game to their BBS. Then sit back and watch the BBS go offline for a while.

Re: I reversed a Node.js malware and found the author

#37

Post by Handytinge »

woodruffw wrote: post #16

The closed issues on the program in question are very endearing[1]. Skiddie culture has survived all these years! [1]: https://github.com/Stanley-GF/PirateStealer/issues?q=is%3Ais...

Open one complaining about the project being "stolen"[1], goodness!

It really hasn't changed.

https://github.com/Stanley-GF/PirateStealer/issues/53

Re: I reversed a Node.js malware and found the author

#38

Post by smorgusofborg »

hankman86 wrote: post #18

Why did you redact the identity of the scammer? Please name and shame them! These people need to be called out and it seems like you’ve got irrefutable proof.

> it seems like you’ve got irrefutable proof.

Or is that irrefutable proof of who was one of their victims?

Re: I reversed a Node.js malware and found the author

#39

Post by tisryno »

Interesting article, but this type of malware has been spreading for months now. PirateStealer is definitely the most popular but it's been shutdown a few times by a discord group who are targeting this type of malware.

One of the tools they've built is https://sketchy.tel/ which can decompile piratestealer/extrack/bby.rip and more and shuts down the Webhook automatically.

There's a lot of other things we do in this community but I can't disclose it because we never know who's reading our messages and if they get found out the malware creators will adapt to stop us.

Re: I reversed a Node.js malware and found the author

#40

Post by lolvmception »

vmception wrote: post #26
grepfru_it wrote: post #15

I did the same thing to someone who attacked my gf in high school. They got her with subseven which was extremely easy to remove. Rather than just erase it, I took a copy home with me and analyzed it. Running the strings command uncovered the subseven signatures.. Turns out there was tooling that allowed you to modify the binary and redistribute it. Except the binary had an ICQ address to alert him to my gf’s online…

I used to just DDOS people’s AIM and messengers if they crossed me, as a phantom curse attached to them and they had no idea the cause. I would chat with them as normal at the same time, chuckling to myself as they kept falling offline following a barrage of emoticons and requests from my army of chat bots that made their process run out of memory. Eventually I’d bore of it. Or have one of the chatbots tell them not…

No post body was provided.
Post reply on HN