Hey everyone! Recently my little brother got sent some fake video game hacking software by some random on discord. He decided to throw all logic out the window and turned his anti-virus off and downloaded and ran the exe file. Long story short a lot of his accounts got hacked.

I did some analysis of the file using Cuckoo Sandbox and I believe it’s a simple python token grabber. I’m pretty sure the people who sent him the file used something like this. I’ve interacted with them and they seem like complete idiots. The virus seems very rudementary, it wasnt even able to detect that I was running it in a VM.

Anyways I was wondering if decompiling the executable and getting the source code would be a viable option? I’m thinking that the virus uses a webhook to send the attackers any grabbed tokens and information. If that’s the case would it be possible to hijack it and send them an infected file of my own?