MAL-2026-12311

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (91b37a5aa06b2d75f250bd23ce01f2667646c1aa7609ec2323f226842e043e9d) streak-calc-metrics@1.0.0 is presented as a native math accelerator for streak calculations but ships a bundled Linux ELF at dist/calc.bin that the main module unconditionally chmods and spawns detached at import time (cp.spawn(binaryPath, [], { stdio: 'pipe', shell: false, detached: true })). The ELF self-identifies as 'REDSHELL' and beacons to hardcoded C2 IP 217.60.77.63 with the protocol tag SECURE_BEACON|...|REDSHELL, providing a full remote shell over /bin/sh and /bin/bash. The implant downloads and executes arbitrary ELF binaries and shellcode over plain HTTP with TLS verification disabled from http://217.60.77.63/Others/<name> and http://217.60.77.63/SC/<name>, staging into /tmp/.elf_* or via memfd_create (syscall 319) and chmod +x before execution, with no hash or signature check. It exposes command handlers /ssh_keys, /creds, /dbfind, /env, and /dataextract <path> that harvest the installer's SSH keys, credential files, environment variables, and arbitrary filesystem paths, then exfiltrates them in chunks via POST /api/extract-receive using markers such as BIGEXTRACT_START and Destination: Loot_%s_%s_%s. Persistence is established by writing ~/.config/systemd/user/svc-update.service (Description='System Update Service', ExecStart=/proc/self/exe, Restart=always) and enabling it with systemctl --user daemon-reload && systemctl --user enable --now svc-update.service. The implant additionally exposes a remote-controlled SOCKS5 proxy (/socks start <port>) and arbitrary TCP port forwarding (/portfwd start <lport> <rhost> <rport>), turning the installer's host into a pivot into internal networks. The JS wrapper contains a cover story ('Native accelerator loaded and verified', 'Performance mode enabled') and an inverted SHA-256 integrity check against 4537b1189ce419f1a595cf47216c03f80e9170ce80dad8d9227a1e52f9cb3466 that never blocks execution.