Source: amazon-inspector (09fa98b6fd8313abbfeb250d10c12db28975f7bb12742f56dd5f1a3e1959d6d1)
On require of index.js, top-level code starts a polling loop that GETs commands from https://badai.run.place/cekapppiapi.php?uid=, executes them via child_process.exec, and POSTs AES-256-ECB-encrypted stdout/stderr to /fallback.php, giving the remote operator arbitrary RCE on the installer host. A stealKeysAsync() routine shell-executes find over /root/.ssh, /home/*/.ssh, /opt/wallet-keys, /etc/ssl/private, $HOME/.ethereum/keystore, /var/lib/ethereum/keystore, and /mnt/crypto/wallets for *.pem, .key, UTC--, and keystore files containing PRIVATE KEY material, and exfiltrates the contents encrypted to the same C2. For each harvested 64-hex private key (and the ETH_PRIVATE_KEY env var), the package builds a web3 wallet against mainnet.infura.io and sends the full balance minus gas to the hardcoded attacker address 0x742d35Cc6634C0532925a3b844Bc454e4438f44e. Exfil payloads are AES-256-ECB encrypted with a hardcoded key and posted as text/plain; uncaughtException and unhandledRejection handlers silently swallow errors to reduce noise.
Credit: OpenSSF (source)
References
Source: amazon-inspector (09fa98b6fd8313abbfeb250d10c12db28975f7bb12742f56dd5f1a3e1959d6d1)
On require of index.js, top-level code starts a polling loop that GETs commands from https://badai.run.place/cekapppiapi.php?uid=, executes them via child_process.exec, and POSTs AES-256-ECB-encrypted stdout/stderr to /fallback.php, giving the remote operator arbitrary RCE on the installer host. A stealKeysAsync() routine shell-executes
findover /root/.ssh, /home/*/.ssh, /opt/wallet-keys, /etc/ssl/private, $HOME/.ethereum/keystore, /var/lib/ethereum/keystore, and /mnt/crypto/wallets for *.pem, .key, UTC--, and keystore files containing PRIVATE KEY material, and exfiltrates the contents encrypted to the same C2. For each harvested 64-hex private key (and the ETH_PRIVATE_KEY env var), the package builds a web3 wallet against mainnet.infura.io and sends the full balance minus gas to the hardcoded attacker address 0x742d35Cc6634C0532925a3b844Bc454e4438f44e. Exfil payloads are AES-256-ECB encrypted with a hardcoded key and posted as text/plain; uncaughtException and unhandledRejection handlers silently swallow errors to reduce noise.Credit: OpenSSF (source)
References