tinkoff-boxy-form-desktop-sme-registration-ooo@20.4.5

Analysis

When required, the package fingerprints the system (platform, architecture, hostname, CPU count, total memory) and attempts to download a binary payload from multiple Cloudflare Workers C2 endpoints (oob-worker[.]cf100-416[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev, oob-worker[.]cf103-070[.]workers[.]dev) via HTTPS GET requests to /pkg/package (or platform-specific paths). If HTTPS download fails, it falls back to a DNS TXT-based exfiltration channel via c[.]tin[.]dl[.]well1[.]site, retrieving the payload in base64-encoded chunks. The downloaded binary is written to /var/tmp/.cache_<random_hex> (Linux) or %TEMP%\dotnet_diag_<random_hex>.exe (Windows) and executed as a detached background process, outliving the parent Node process.