tinkoff-statist-browser-typed-client-mb.reliability.android.events @20.5.4

Summary

index.js unconditionally requires./_loader on module load. _loader.js selects a platform-specific payload path for Linux/macOS/Windows, downloads a binary over HTTPS from a rotating list of Cloudflare Workers subdomains (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS-TXT chunked base64 fallback resolving via tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, win.dl.well1.site. The fetched bytes are written to /tmp or %TEMP% under a disguised name (dotnet_diag_<hex>.exe or.cache_<hex>), chmod 0755 on POSIX, and spawned detached via cp.spawn("/bin/sh", ["-c", path + " &"]).unref(). No hash or signature verification is performed. Host destinations are reconstructed at runtime via.join("") on split string fragments to evade static analysis. A sibling module lib/telemetry.js contains identical dropper primitives with additional bracketed-property obfuscation (fs["chmod"+"Sync"], require("child_"+"process")). The package name resembles an internal Tinkoff analytics client but the network destinations, payload naming, and obfuscation shape have no relation to the declared purpose.

Source: amazon-inspector (10c12f5330c144cfe67198d49d442d702f5e40977e1d607ab651d33dffb2d073)