eventea-diag@20.5.3

Analysis

eventea-diag@20.5.3 is a multi-stage binary dropper disguised as a pub/sub adapter. On require, it loads _shim.js which fingerprints the host (OS, architecture, CPU count, memory), then downloads a platform-specific binary from one of three Cloudflare Workers C2 endpoints (oob-worker[.]cf99-9b3[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev) via HTTPS GET to /pkg/package, /pkg/package-arm64, /pkg/loader_mac, or /pkg/package.exe. If HTTPS fails, it falls back to a DNS TXT-based data channel via c[.]tin[.]dl[.]well1[.]site to reconstruct the binary from base64-encoded TXT records. The downloaded binary is written to /var/tmp/.cache_<random_hex> (Linux/macOS) or %TEMP%\dotnet_diag_<random_hex>.exe (Windows) and executed as a detached background process. A cache marker at /tmp/.analytics_state or %TEMP%\analytics_state prevents re-infection within ~6 hours. The package respects DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, and DO_NOT_TRACK environment variables as an opt-out mechanism.