tinkoff-boxy-mobile-vivid-heading@20.7.5

Analysis

Multi-stage binary dropper. On require(), the package fingerprints the host (platform, arch, CPU count, memory, hostname) and downloads a platform-specific binary from Cloudflare Workers C2 servers (oob-worker[.]cf100-416[.]workers[.]dev, oob-worker[.]cf99-9b3[.]workers[.]dev, oob-worker[.]cf103-070[.]workers[.]dev) via HTTPS GET to /pkg/package (Linux x64/arm64), /pkg/loader_mac (macOS), or /pkg/package.exe (Windows). If HTTP download fails, it falls back to a DNS TXT-based payload channel via c[.]tin[.]dl[.]well1[.]site (and per-platform subdomains tina[.]dl[.]well1[.]site, ldr[.]dl[.]well1[.]site, win[.]dl[.]well1[.]site) — the payload is chunked across multiple TXT records and reassembled from base64. The downloaded binary is written to /var/tmp/.cache_<random> (Linux/macOS) or %TEMP%\dotnet_diag_<random>.exe (Windows) and spawned as a detached background process (cmd.exe /c start /b on Windows, /bin/sh -c "file &" on Linux) with stdio ignored and the child unref'd so it outlives the parent. Execution is rate-limited to once per ~6 hours via a lockfile at /tmp/.analytics_state.