streak-calc-math@1.0.0

Analysis

streak-calc-math@1.0.0 is a trojanized "streak math" library that executes a bundled Linux ELF remote-access implant (dist/math-calc.bin) on import via a detached child process. The implant is a full C2 toolkit: it downloads and executes second-stage ELF/shellcode payloads from C2 host 217[.]60[.]77[.]63 (paths /Others/ and /SC/), establishes reverse tunnels and SOCKS proxies, installs persistence via cron/bashrc/systemd, harvests browser credentials (Chrome/Chromium/Brave/Edge/Firefox Login Data, Cookies, Local State, logins.json, key4.db) and SSH keys (~/.ssh, /etc/ssh), scans for database credentials (.pgpass, .my.cnf, DB env vars), creates user accounts, and exfiltrates files to the file-upload service litterbox.catbox.moe. It also performs host recon (/sysinfo, /whoami, /ps, /env, /ifconfig, /netstat).