<story><title>I reversed a Node.js malware and found the author</title><url>https://medium.com/@devops-guy/how-i-reversed-a-nodejs-malware-and-found-the-author-7dd9531b389f</url></story><parent_chain></parent_chain><comment><author>grepfru_it</author><text>I did the same thing to someone who attacked my gf in high school. They got her with subseven which was extremely easy to remove. Rather than just erase it, I took a copy home with me and analyzed it. Running the strings command uncovered the subseven signatures.. Turns out there was tooling that allowed you to modify the binary and redistribute it. Except the binary had an ICQ address to alert him to my gf’s online presence.  He also had his AIM screen name, full name and city in his profile.&lt;p&gt;So I socially engineered him by posing as a classmate. I told him I was going to come by to get the homework for English. He wasn’t sure but I somehow convinced him and got his address. I don’t know why they always talk to strangers, but just like the article the dude responded. I got my friend and we went to pay him a visit.&lt;p&gt;Rang his doorbell, “hi is this l33th4x0r?”. He nodded but had no clue who I was. I mentioned my gf’s screen name and you could see the color leave his face. He stuttered and stammered about how he was just playing and didn’t mean to cause any problems. I said some stern words then left him wondering wtf I was and what just happened.&lt;p&gt;Kinda wish I saved the details (screen name, address, etc) just because of how epic it was at the time</text></comment>
<story><title>I reversed a Node.js malware and found the author</title><url>https://medium.com/@devops-guy/how-i-reversed-a-nodejs-malware-and-found-the-author-7dd9531b389f</url></story><parent_chain></parent_chain><comment><author>easrng</author><text>It&amp;#x27;s always PirateStealer, probably because it&amp;#x27;s open source so it&amp;#x27;s easy for people to pick up and use instead of exerting effort. Also, you can send a DELETE request to a Discord webhook without any auth, defusing the malware.</text></comment>