687 B

Raw Blame History

Crypto Virus (coinprompt)

DISCLAIMER: DO NOT RUN THE CODE. This repo contains malware written by somebody else. Provided for education purposes only.

Source: https://bitbucket.org/coinprompt/coinprompt/src/master/
Exploit: https://bitbucket.org/coinprompt/coinprompt/src/master/server/controllers/snippingController.js line 263
Found 8 variants (100..=107)
Deobfuscator: https://obf-io.deobfuscate.io/
Most readable: workspace/three.js
C&C server: http://95.164.17.24:1224 (down since the beginning)