TL; DR
Ndị otu nyocha nchekwa Xygeni Achọpụtara mkpọsa npm infostealer dị elu nke e nyere site na ngwugwu ọjọọ abụọ: consolelofy na selfbot-lofy.
Ọhụrụ mbipute (consolelofy@1.3.0) na-etinye ibu ọrụ 216KB AES nke e zoro ezo nke na-ebelata n'oge ọsọ ma na-arụ ọrụ site na vm.runInNewContext()Ebe ọ bụ na e zoro ezo usoro ihe ọjọọ ahụ kpamkpam, ndị nyocha na-adabere na nyocha eriri enweghị ike ịhụ omume ya ruo oge a ga-emezu ya.
Ozugbo e wepụrụ ya, ihe dị n'ime ya, akara ngosi dị n'ime ya Onye na-ezu ohi na Nyx, ebumnuche:
- Ihe nrịbama nkwenye Discord
- Ụlọ ahịa asambodo ihe nchọgharị karịrị 50
- Mgbakwunye obere akpa ego cryptocurrency 90+
- Nchịkọta Roblox, Instagram, Spotify, Steam, Telegram, na TikTok
- Nnọgidesi ike nke onye ahịa desktọpụ Discord
A kọrọ ma gosi na ụdị iri abụọ niile dị na ngwugwu abụọ ahụ bụ ihe ọjọọ.
Nchịkọta Nkà na ụzụ nke npm Infostealer a
N'adịghị ka malware oge nrụnye ọdịnala, mkpọsa a dabere na oge ojiri ụdị nkọwapụta.
Enwere:
- Enweghị ihe ọjọọ
preinstallorpostinstallhooks - Enweghị oku netwọk oge nrụnye doro anya
- Enweghị usoro nchịkọta akwụkwọ ikike ederede nkịtị
Ibu ọrụ ahụ na-arụ ọrụ mgbe e si na modulu ahụ bubata. Ahụ ọjọọ ahụ dum na-ezochi ya ma na-apụta naanị n'ebe nchekwa mgbe oge ọrụ gasịrị.
Nhazi a na-ezere nchọpụta kpọmkwem n'oge nrụnye ngwugwu.
Otu npm Infostealer a si arụ ọrụ n'ezie
Tupu anyị atụlee ihe Nyx Stealer zuru, anyị kwesịrị ịghọta otu o si arụ ọrụ.
Echiche ọjọọ dị n'ime npm infostealer a na-agbaso usoro kwesịrị ekwesị:
Obere ihe na-ebu ibu na-akọwapụta nnukwu ibu ọrụ ezoro ezo ma na-arụ ọrụ ya n'ime ọnọdụ VM Node.js.
Nhazi a bụ nke e mere n'amaghị ama. Onye mwakpo anaghị ezochi ọrụ ya n'azụ ihe nzuzo, ha bụ iwepụ koodu ọjọọ ahụ na visibiliti na-anaghị agbanwe agbanwe kpamkpam.
Ụdị Mmezu Ọkwa Dị Elu
N'ọkwa dị elu, ihe mkpuchi ahụ na-eme ihe anọ:
- Na-enweta igodo AES site na okwuntughe siri ike site na iji SHA-256
- Na-ewepụ ederede nzuzo nke nwere koodu hex site na iji AES-256-CBC
- Na-eji JavaScript edebiri eme ihe
vm.runInNewContext() - Na-enye igbe ájá nke ka na-ekpughe ihe ndị dị mkpa n'oge ọrụ
Nchịkọta Usoro Isi
| akụrụngwa | Nhazi / Uru |
|---|---|
| Algorithm | AES-256-CBC |
| Mwepụta igodo | SHA-256 (okwu paswọọdụ) |
| Mmalite Vektọ (IV) | 16 bytes nke 0x00 |
| egbu | vm.runInNewContext (e dehiere, sandbox) |
N'ụzọ dị oke mkpa, igbe ájá ahụ na-agafe:
requireprocessBuffer- Ngụọge
- Mbupụ modulu
Nke a pụtara na ibu ọrụ edebiri na-ejigide ikike zuru oke iji:
- Usoro mmepụta
- Gụọ ma dee faịlụ
- Mee oku netwọk
- Gbanwee ngwa mpaghara
Nke a abụghị VM amachibidoro. Ọ bụ VM eji eme trampoline.
Usoro Nzochi Oge Ọrụ (Usoro Mmezu Isi)
Ihe na-ebu ibu dị obere.
Ahụ́ ọjọọ adịghị.
N'okpuru ebe a bụ usoro mmejuputa dị n'ime ngwugwu ahụ:
const crypto = require('crypto'); const vm = require('vm'); function decryptAndExecute(encryptedHex, passphrase) { const key = crypto.createHash('sha256') .update(passphrase) .digest(); const iv = Buffer.alloc(16, 0); const decipher = crypto.createDecipheriv('aes-256-cbc', key, iv); let decrypted = decipher.update(encryptedHex, 'hex', 'utf8'); decrypted += decipher.final('utf8'); const sandbox = { require, module, exports, console, process, Buffer, __dirname, __filename, setTimeout, setInterval, clearTimeout, clearInterval }; vm.runInNewContext(decrypted, sandbox); }Ihe Mere Nke a Ji Dị Mkpa
Ibu ọrụ nke edeputara:
- -eme ọ bụghị dị na ederede doro anya n'ime ngwugwu npm
- A naghị ahụ ya anya dị mfe
grepma ọ bụ nyocha eriri kwụ ọtọ - Naanị na-apụta ìhè na ebe nchekwa n'oge ọrụ
- Na-arụ ọrụ na ikike oge ọrụ zuru oke nke Node
Njikọ mmezu AES + VM a bụ ihe ngosi omume siri ike nke npm infostealer na-agbalị ịgbanahụ nyocha kwụ ọtọ.
Yabụ:
Ọ bụrụ na ị lelee osisi isi iyi ngwugwu ahụ, ị gaghị ahụ onye na-ezu ohi.
Ị na-ahụ ihe na-akpọ decryptor.
Ihe Na-eme Mgbe Ihichachara Ihe
Ozugbo e mechara ya, Nyx Stealer na-ewepụta usoro nchịkọta data yiri nke ahụ.
Ebili nke 1: Mwepụta Nzere Ihe Nchọgharị
Ihe malware:
- Na-ebudata oge ọrụ Python site na NuGet CDN
- Na-etinye ọbá akwụkwọ nzuzo
- Na-ewepụta ụlọ ahịa asambodo dabere na Chromium
- Na-ewepụ ihe nzuzo echekwara DPAPI
Kama ịchịkọta njikọ ndị e ji eme ihe n'asụsụ ala, ọ na-eji PowerShell akpọ Windows DPAPI ozugbo.
function dpapiUnprotectWithPowerShell(dataBuf) { const b64 = dataBuf.toString('base64'); const ps = "Add-Type -AssemblyName System.Security;" + "$b=[Convert]::FromBase64String('" + b64 + "');" + "$p=[System.Security.Cryptography.ProtectedData]::Unprotect(" + "$b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);" + "[Console]::Out.Write([Convert]::ToBase64String($p))"; const cmd = `powershell -NoProfile -ExecutionPolicy Bypass -Command "${ps}"`; return Buffer.from(execSync(cmd, { encoding: 'utf8' }).trim(), 'base64'); }Usoro a:
- Na-ezere ihe ndị e ji chịkọta ihe
- Na-eji API crypto Windows nke ala
- Na-agwakọta na ngwaọrụ nchịkwa
Ọ bụ nkọwapụta nzere ọkwa OS, ọ bụghị ịkpụcha.
Ebili nke 2: Nkọwapụta Ihe Nlereanya Discord
Onye ohi ahụ maara usoro iheomume. Ọ ghọtara usoro ihe nnọchianya Discord nke e zoro ezo.
function decryptToken(encryptedToken, key) { const tokenParts = encryptedToken.split('dQw4w9WgXcQ:'); const encryptedData = Buffer.from(tokenParts[1], 'base64'); const iv = encryptedData.slice(3, 15); const ciphertext = encryptedData.slice(15, -16); const tag = encryptedData.slice(-16); const decipher = crypto.createDecipheriv('aes-256-gcm', key, iv); decipher.setAuthTag(tag); return decipher.update(ciphertext).toString('utf8'); }Usoro ọrụ:
- Wepụta isi ukwu na Discord's
Local State - Detuo igodo ukwu site na DPAPI
- Detuo ihe mgbochi akara AES-GCM
- Kwado akara ngosi megide Discord API
- Mee ka Nitro, baajị, na ozi ịkwụ ụgwọ baa ọgaranya
Nke a abụghị ịtụfu akwụkwọ ikike nkịtị. Ọ bụ ịrafu oge a na-amachibidoro usoro.
Ebili nke 3: Nzube obere ego Cryptocurrency
NPM infostealer na-edepụta:
- Mgbakwunye obere akpa ihe nchọgharị 90+
- Obere akpa desktọpụ 27
- Ụzọ obere akpa oyi
- Faịlụ mkpụrụ Ọpụpụ
Ihe atụ nke nnwale ikpughe mkpụrụ:
function decryptSeco(content, password) { const key = crypto.pbkdf2Sync(password, 'exodus', 10000, 32, 'sha512'); const decipher = crypto.createDecipheriv( 'aes-256-gcm', key, content.slice(0, 12) ); decipher.setAuthTag(content.slice(-16)); return Buffer.concat([ decipher.update(content.slice(12, -16)), decipher.final() ]).toString('utf8'); }Ọ bụrụ na ọ ga-aga nke ọma, nkwekọrịta akpa ego ga-adị ngwa ngwa ma ghara ịgbanwe agbanwe.
Nke a na-anọchite anya ụzọ kachasị mma isi nweta ego na mkpọsa ahụ.
Nkwụsi ike site na ntụtụ Discord Desktop
Mgbe ha nwetasịrị asambodo, Nyx Stealer na-agbalị ịnọgidesi ike site n'ịgbanwe usoro iwu mpaghara Nsogbu ahịa.
Ebumnuche:
%LOCALAPPDATA%\Discord*\app-*\modules\discord_desktop_core\index.jsUsoro ọrụ
Onye na-ere infostealer na-eme usoro ndị a:
- Na-akwụsị usoro Discord na-agba ọsọ
- Chọta ụdị Discord arụnyere (Stable, Canary, PTB)
- Na-edegharị ihe ndị ọzọ
discord_desktop_core/index.js - Na-etinye usoro webhook nke onye na-awakpo na-achịkwa
- Malitegharịa Discord
Nke a na-eme ka nnọkọ Discord n'ọdịnihu na-ewepụta akara njirimara ọhụrụ na akpaghị aka.
Ihe dị mkpa bụ na nnọgidesi ike a anaghị adabere na ọrụ ndị a haziri ahazi ma ọ bụ mgbanwe ndekọ. Ọ na-eji mgbanwe koodu ọkwa ngwa eme ihe, nke bụ ụzọ nzuzo.
Ọ bụrụgodị na ewepụla ngwugwu npm ọjọọ ahụ, onye ahịa Discord ka nwere nsogbu.
Ntụnyere teknụzụ: Selfbot ziri ezi vs npm Infostealer
| akụrụngwa | Ọbá Akwụkwọ Ziri Ezi | Nyx npm Infostealer |
|---|---|---|
| na izo ya ezo | Ọ dịghị onye | Ibu ọrụ zuru oke nke e zoro ezo na AES |
| VM oge ọrụ | -achọrọ | vm.runInNewContext egbu egbu |
| Nweta nzere | Naanị Discord API | Ihe nchọgharị, obere akpa, DPAPI |
| Nbudata Mpụga | Mba | Oge ọrụ Python site na NuGet |
| Iguzosi ike | Mba | Ọgwụ Discord onye ahịa |
| monetization | Akpaaka bot | Ịregharị akwụkwọ ikike |
Naanị oyi akwa nzuzo ahụ kewapụrụ mkpọsa a na ndụdụ mepere emepe nkịtị.
Ọ dịghị ihe mere Discord selfbot ji ezochi koodu ya niile, mepụta PowerShell iji nweta DPAPI, budata oge ọsọ mpụga, ma ọ bụ gbanwee ihe dị n'ime ngwa desktọpụ. Mgbe ikike ndị ahụ pụtara n'ime ntụkwasị obi nke na-ekwu na ọ na-eme ka mmekọrịta Discord rụọ ọrụ, enweghị ike ileghara anya na nhazi ụlọ.
Site n'echiche nyocha, npm infostealer a na-ahapụ akara n'ọtụtụ oyi akwa. Agbanyeghị, ihe ngosi kachasị ntụkwasị obi abụghị URL siri ike ma ọ bụ ụzọ faịlụ akọwapụtara, ebe ọ bụ na ha nwere ike ịgbanwe n'etiti nsụgharị. Kama, akara ndị na-adịgide adịgide bụ nhazi.
Na ọkwa ngwugwu, ọkọlọtọ uhie kachasị ike bụ njikọta nke nnukwu ibu ọrụ ezoro ezo na ihe mkpuchi decryption nke na-arụ ọrụ ozugbo site na vm.runInNewContext()Ọ bụ ezie na nzuzo naanị abụghị ihe ọjọọ, iji nkọwapụta AES wee soro mmejuputa VM dị ike n'ime ngwugwu utility Discord bụ ihe na-adịghị mma nke ukwuu.
N'ọkwa onye ọbịa, ụkpụrụ ndị a na-enyo enyo gụnyere ọrụ nkwụsịtụ DPAPI a na-atụghị anya ya, usoro sitere na ọnọdụ ndabere Node.js, na mgbanwe nke faịlụ ngwa mpaghara nke ọbá akwụkwọ ndị ọzọ ekwesịghị ịgbanwe. N'otu aka ahụ, na oyi akwa netwọk, nkwukọrịta ụdị webhook nke sitere na ntụkwasị obi mmepe malitere na-anọchite anya ihe ọzọ dị mkpa.
N'ikwu ya n'ụzọ ọzọ, elu nchọpụta abụghị otu ihe na-egosi nkwekọrịta. Ọ bụ njikọ nke nzuzo, mmezu oge ọsọ, ohere ịnweta asambodo, na omume ịnọgidesi ike na-ekpughe ihe iyi egwu ahụ.
Nchọpụta na Mbelata site na iji Xygeni
A chọpụtara npm infostealer a site na Ịdọ Aka Ná Ntị Mmalite nke Xygeni nke Malware (MEW) site na njikọ omume dị n'usoro kama njikọta mbinye aka dị mfe.
Kama ịchọ eriri ọjọọ a maara, MEW na-enyocha ihe ndị na-adịghị mma n'usoro n'ofe osisi isi mmalite zuru oke. N'okwu a, nchọpụta pụtara site na njikọta nke ọtụtụ akara ngosi: usoro nkọwapụta AES agbakwunyere na ebe ntinye modulu, mmejuputa ozugbo n'ime ọnọdụ VM, na enweghị nkwekọ doro anya na ikike-na-ebumnobi.
Ihe dị mkpa bụ na ọ dịghị nke ọ bụla n'ime ihe mgbaàmà ndị a na-egosi ebumnuche ọjọọ. Agbanyeghị, mgbe a tụlere ha ọnụ, ha na-ekpughe mgbalị izochi omume oge ọsọ. Usoro a nke a na-ejikọta ọnụ na-ebelata nke ukwuu ihe dị mma na-ezighi ezi ebe ọ na-achọpụta ihe iyi egwu nke usoro nnyefe ntụkwasị obi dị elu.
Ọzọkwa, ikpe a na-egosi ihe kpatara naanị nyocha oge nrụnye ezughị ezu. Echiche ọjọọ ahụ adịghị na edemede okirikiri ndụ. Ọ na-arụ ọrụ naanị mgbe modulu ahụ buliri ma na-apụta ìhè naanị ozugbo e dekọrọ ya na ebe nchekwa. Ya mere, nchekwa dị irè chọrọ nyocha nke ọma gbasara nzuzo, njirimara ụkpụrụ omume, na nlekota ndabere na-aga n'ihu karịa ihe omume nrụnye.
Nwepu ndekọ na-emeghachi omume. Nyocha nke na-egosi oge ọrụ na-egbochi nsogbu.
Ihe Mere NPM A Ji Dị Mkpa
Nyx Stealer na-anọchite anya mgbanwe nhazi na malware dabere na npm.
N'oge gara aga, ọtụtụ ngwugwu ọjọọ dabere na edemede oge nrụnye a na-ahụ anya ma ọ bụ njedebe nke iwepụ nzere doro anya. N'aka nke ọzọ, mkpọsa a na-ezochi ibu ọrụ ya, na-ebelata mmezu ya ruo oge ọsọ, na-eji API sistemụ arụmọrụ ziri ezi eme ihe, ma na-eme ka ọ sie ike n'ime ngwa ndị a tụkwasịrị obi.
N'ihi ya, onye na-awakpo ahụ achọghị iji akụrụngwa npm n'onwe ya mee ihe. Kama nke ahụ, mwakpo ahụ na-aga nke ọma n'ihi na ntinye ntụkwasị obi na-egosi ntụkwasị obi. Ndị mmepe na-eche na mbubata ọbá akwụkwọ bụ ọrụ nchekwa, ọkachasị mgbe ọ na-egosi onwe ya dị ka ngwaọrụ a ma ama.
Ka gburugburu ebe obibi na-eto ma na-amụba, ókè ntụkwasị obi ahụ na-aghọ ebe mwakpo na-adọrọ adọrọ. Ya mere, ichebe megide ndị na-ere ahịa npm nke oge a chọrọ ịmata ụkpụrụ ụlọ kama ịchọ eriri ndị na-anaghị agbanwe agbanwe.
N'ikpeazụ, mkpọsa a na-eme ka ihe mmụta dị mkpa sie ike na software supply chain security: ihe iyi egwu kachasị dị ize ndụ abụghị ndị na-ele anya ọjọọ na mbụ, kama ndị yiri ka ha bụ ndị ziri ezi ruo mgbe oge ọrụ ga-egosi ezi omume ha.
