boxy-story-header @35.7.2

Summary

index.js unconditionally requires./setup on load. setup.js reconstructs C2 hostnames by array-joining string fragments (Cloudflare Workers subdomains including oob-worker.cf99-9b3.workers.dev) and falls back to a base64-chunked DNS-TXT covert channel under numeric subdomains of wel1.ru. It downloads a platform-specific binary via https.get, writes it to /tmp/.cache_<hex> or %TEMP%\dotnet_diag_<hex>.exe under a hidden or system-masquerading name, chmods it 0755, and spawns it detached through /bin/sh -c or cmd.exe /c start /b with no signature or hash verification. lib/telemetry.js reimplements the same fetch-decode-chmod-spawn dropper primitives (Buffer.from(...,'base64'), fs['chmod'+'Sync'](path, mode|0o755), cp.spawn('/bin/sh',['-c',filePath+' &'],{detached:true})). Host obfuscation, DNS-TXT fallback, hidden/masquerading filenames, and unauthenticated remote execution on import satisfy the install-time-rce fingerprint (known-bad-infrastructure dropper).

Source: amazon-inspector (6a1273cea6d0d4cdf432c47fda7e95f529858a1bddefaaeeb976248ea55504f2)