I reversed a Node.js malware and found the author (opens in new tab)

I had fun with people on forums trying to get others to download keyloggers and the like. A lot of these were the stereotypical "script kiddies" who didn't know how much personal data they were giving away or even how the tools they used worked. I distinctly remember a few "C:\Documents and Settings\<uncommon first and last name>\...", from which I could find and sometimes phone them (often their parents would answer), but I drew the line at doing anything physical --- they were all far away anyway.

The most interesting results include apologies; one kid's father registered on the forum to post one for his son. Spamming a keylogger's logs with the physical address of its owner and "I know where you live" tends to cause them to repent in fear pretty quickly.

I used to just DDOS people’s AIM and messengers if they crossed me, as a phantom curse attached to them and they had no idea the cause.

I would chat with them as normal at the same time, chuckling to myself as they kept falling offline following a barrage of emoticons and requests from my army of chat bots that made their process run out of memory.

Eventually I’d bore of it. Or have one of the chatbots tell them not to cross someone again. In your scenario I probably would have said it was the person he got the exploit from, instead of making a link to someone I care about.

I'm still glad the DELETE thing works, I've reported a few times these with a complete writeup to Discord and all I got was a ticket being auto-closed after a month and the webhooks+servers still being up. I personally no longer bother reporting, just straight delete the webhook to stop the spread. Makes you wonder what their security/support team is doing with all those tickets.

Yes, you can send a DELETE to a Discord Webhook, but these malware projects have clocked on in most situations and now forward Webhooks through their own domains.

For the example of PirateStealer, the kid who made it ran a website where you posted your webhook and it spat out an exe that hid your webhook behind the domain, they even sold "premium" copies with additional security but in reality once they put the webhook behind their own domains they were dual-hooking, so the information was actually sent to 2 webhooks instead of just the 1.

Most of the services to create this malware now hide it behind a domain rather than directly exposing the Webhook, so shutting it down isn't as easy.

Open one complaining about the project being "stolen"[1], goodness!

It really hasn't changed.

https://github.com/Stanley-GF/PirateStealer/issues/53

Is it really fair to call someone a "skript kiddie" if they wrote the malware themselves that became "the most common malware" ?

They also found the person using the script with their discord api key

The author of PirateStealer isn't the skiddie, the person running this instance of it is.

Yep: https://www.virustotal.com/

Malware detection relies on signatures and/or heuristics. Signatures won't work with a brand new malware that hasn't been seen before. Heuristics can also be defeated.

Antimalware is great for the low hanging fruit but don't expect it to detect something where the author has put effort into it.

Note that this post's malware is advertised with "Low Detections (0/64)".

Another one besides virustotal.com is: https://www.hybrid-analysis.com/

try virustotal.com

* Discord Credit Card Stealing * Discord Login Stealing

I don't know the specifics, but I'd assume not, Discord has made big steps recently in stopping this sort of malicious activity by adding the "Report Spam" feature as well as creating their own phishing link database to help detect spam in private messages.

Discord knows it's a big issue and I'd hope they've attempted to mitigate the malware but there's no way to stop the actual injection, so really all they can do is code shuffle frequently to make the injected code redundant, but that'd rely on doing releases frequently and hoping everyone updates just as frequently.

I don't know what the redirect was but given the article is behind the Medium paywall, if it was a t.co redirect, it was probably the submitter's way to let everyone skip the paywall.

your admins are often underage and more liable to fall for these scams :)

Which game? bzflag is the only one that comes to mind, but I am not a gamer.

These posts show up on every thread like this and it always strikes me as off. It's not that I think the scammer here deserves protection, but the impulse to "name and shame" makes me very uncomfortable.

I worry that supporting that impulse, even in cases like this, normalizes the use of internet lynch mobs to exact "justice" (for any subjective value of "justice" that can get enough steam).

Why are you so credulous to believe any random account on the internet?

Not saying the author is a liar. But it sounds like you want to go on a crusade for them after just finding out they exist.

> it seems like you’ve got irrefutable proof.

Or is that irrefutable proof of who was one of their victims?

Hey, I was not expecting a French speaker here :D Merci de ton commentaire ;) I'm just a beginner in malware analysis and I tried my best to give a starting point to people like me :)