I reversed a Node.js malware and found the author
1–10 of 79 posts
Re: I reversed a Node.js malware and found the author
#2It's always PirateStealer, probably because it's open source so it's easy for people to pick up and use instead of exerting effort. Also, you can send a DELETE request to a Discord webhook without any auth, defusing the malware.
Re: I reversed a Node.js malware and found the author
#3Finding the author of most common malware isn't hard, skript kiddies really like their credit for reputation.
Re: I reversed a Node.js malware and found the author
#4Our discord got hit by the same shit, targeted at our game admins.
We are the largest open source multiplayer video game on github, so (compromised) discord friends sending admins messages about "games they made" with exes in them was more effective then it should have been until news and announcements went out.
Re: I reversed a Node.js malware and found the author
#5Finding the author of most common malware isn't hard, skript kiddies really like their credit for reputation.
They also found the person using the script with their discord api key
Re: I reversed a Node.js malware and found the author
#6Our discord got hit by the same shit, targeted at our game admins. We are the largest open source multiplayer video game on github, so (compromised) discord friends sending admins messages about "games they made" with exes in them was more effective then it should have been until news and announcements went out.
your admins are often underage and more liable to fall for these scams :)
Re: I reversed a Node.js malware and found the author
#7Finding the author of most common malware isn't hard, skript kiddies really like their credit for reputation.
Is it really fair to call someone a "skript kiddie" if they wrote the malware themselves that became "the most common malware" ?
Re: I reversed a Node.js malware and found the author
#8Finding the author of most common malware isn't hard, skript kiddies really like their credit for reputation.
Is it really fair to call someone a "skript kiddie" if they wrote the malware themselves that became "the most common malware" ?
You beat me to this. This malware is better than some of the work my colleagues can do, and they're being paid a lot of money. Even though it has bad intentions, it's still good software.
Credit where credit is due, I guess.
Re: I reversed a Node.js malware and found the author
#9It's always PirateStealer, probably because it's open source so it's easy for people to pick up and use instead of exerting effort. Also, you can send a DELETE request to a Discord webhook without any auth, defusing the malware.
I'm still glad the DELETE thing works, I've reported a few times these with a complete writeup to Discord and all I got was a ticket being auto-closed after a month and the webhooks+servers still being up. I personally no longer bother reporting, just straight delete the webhook to stop the spread. Makes you wonder what their security/support team is doing with all those tickets.
Re: I reversed a Node.js malware and found the author
#10Our discord got hit by the same shit, targeted at our game admins. We are the largest open source multiplayer video game on github, so (compromised) discord friends sending admins messages about "games they made" with exes in them was more effective then it should have been until news and announcements went out.
Which game? bzflag is the only one that comes to mind, but I am not a gamer.