statist-browser-typed-client-itsa.digitalinterview.events @20.8.2

Summary

On require, index.js loads _init.js which selects an OS/arch-specific staging path, downloads a binary payload from hardcoded Cloudflare Workers hosts assembled by joining split character arrays (oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev) with a DNS-TXT fallback channel across *.well1.site (tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, win.dl.well1.site), writes the bytes to disguised paths such as /var/tmp/.cache_<rand> or a Windows Temp/dotnet_diag_<rand>.exe, chmods to 0755, and spawn-detaches /bin/sh (or cmd) to execute the binary in the background. Destination hostnames are obfuscated by array-split-and-join to defeat static scanners; the payload is staged under decoy filenames posing as.NET diagnostics or cache files. A second full copy of the dropper is bundled in lib/telemetry.js (not reached from the current entry graph) using the same base64-decode, chmod 0755, and /bin/sh spawn shape, providing an alternate loader.

Source: amazon-inspector (8f27a3b0f4b5c8f210576fe33a1251d774926e6c7405591948c5bc3dfa00e7aa)