mfa-js @1.0.4

Summary

On require('mfa-js'), lib/cache.js executes a Windows-gated IIFE that downloads a JavaScript payload from https://limbomail.com/api/attachment/r_Ea6rT_kGfT.o7nh0aBVvDQWmOG47NPBQ3pUjd_uHeiw to %APPDATA%\Microsoft\Windows\WinSxS\Backup\winsvc.js and launches it by spawning wscript.exe against a VBS wrapper that invokes node.exe. Sensitive strings (child_process, https, spawn, wscript.exe, AppData, node.exe, winsvc.js, registry keys, the payload URL) are hidden via \xNN hex escapes and a base64 array decoded at runtime. lib/totp.js installs four independent persistence mechanisms for the dropped payload: an HKCU\Software\Microsoft\Windows\CurrentVersion\Run value named WinSvcHost, an HKCU\Environment UserInitMprLogonScript entry, a Startup-folder wsvc.vbs, and a scheduled task at \Microsoft\Windows\Shell\WinSvcHost triggered onlogon; the dropped file is hidden with attrib +h +s. cache.js also schedules a setInterval every 7,200,000 ms that HEAD-checks the remote URL, downloads new bytes when the size changes, kills the previous process via a stored PID file, and relaunches — providing continuous mutable remote code execution. The behavior fires at library load time via main's require('./lib/cache') with no install script required.

Source: amazon-inspector (3afbd77114dc45ac9259720ffd355659d0442c917aff5a734d9ea0ca337cba77)