boxy-test-block @35.9.5

Summary

On require('boxy-test-block'), index.js loads _compat.js which reconstructs attacker-controlled destination hosts via string-split obfuscation (oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev, with DNS-TXT chunked fallback via sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru), fetches an opaque platform-specific binary over HTTPS, writes it to /var/tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows, sets mode 0755 via fs['chmod'+'Sync'], and spawns it detached via /bin/sh -c or cmd.exe /c start /b. Dangerous APIs are hidden with concatenation (require('child_'+'process'), fs['chmod'+'Sync']) to evade static scanners. A second dropper implementation using the same toolkit (base64 chunk decoder, HTTPS + DNS-TXT service discovery, chmod 0755, spawn '/bin/sh -c filePath &') is bundled in lib/telemetry.js. The %TEMP%\dotnet_diag_*.exe and /var/tmp/.cache_* staging names are cover for persistence.

Source: amazon-inspector (a2ce2597c942a6017ba1aad05cadffba71e6673f8ae9298ef589493e3c4e5ad3)