MAL-2026-12447

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (1381b3c1cd52acc110406d4609b7afea6e0681e3fe1259fcff0cd0a819aacabc) On require, index.js loads _loader.js which selects a platform-specific binary path, fetches bytes from obfuscated Cloudflare Workers endpoints (oob-worker.cf102-baf.workers.dev, cf100-416/cf103-070/cf99-9b3.workers.dev) with a DNS TXT-record fallback channel across numbered subdomains of dl.well1.site (tin, tina, ldr, win) that reassembles a base64 payload. The downloaded bytes are written to /tmp or %TEMP% under disguised names (.cache_<rand>, dotnet_diag_<rand>.exe), chmod'd to 0755, and spawned detached via /bin/sh -c or cmd.exe /c start. Hostnames and API names are reconstructed via split-string joins (e.g. ['tin.','dl.well1.si','te'].join(''), require('child_'+'process')) to evade static analysis. A parallel implementation of the same dropper is shipped as lib/telemetry.js under an 'analytics SDK' cover story, with identical DNS-TXT reassembly, chmod 0755, and detached /bin/sh execution.