home.social

#decompile — Public Fediverse posts

Live and recent posts from across the Fediverse tagged #decompile, aggregated by home.social.

  1. So, someone I know has fallen victim to a discord grabber thingy. Unfortunately, it doesn't just grab the discord token, but also all stored browser passwords - !Including bank details!!

    From what I can tell, it seems to be blank grabber, which is no longer under active development but still dangerous.

    Me and @max213 have tried reverse engineering the exe (it was compiled with pyinstaller) but to no luck. The malware runs as a background task and reports back to a webhook whenever a new discord login happens so that it can capture the token, so we aim to try retrieve the webhook URL in order to delete it so that the password can be safely reset.

    We managed to get the pyc files and partially decompile them using uncompyle, but it seems to use AES or whatever to run the code without antivirus noticing.

    If anyone could try and help, that would be amazing.

    The extracted .pyc files: cdn.discordapp.com/attachments

    Original EXE: cdn.discordapp.com/attachments

    #malware #reverseengineering #python #pyinstaller #decompile #grabber