githash
docs
BeaverTail, the JavaScript first stage of the Contagious Interview chain, in the build ThreatProphet documented in March 2026 as Lumanagi. An obfuscator.io-packed loader planted in web3-themed project repos (NFT marketplaces, poker, DeFi wallets, 'Infinity Force MVP') after a run of whitespace padding, inside build config files, Express routes and files named as images (public/logo310.png). It decodes its strings with a rolling 4-byte XOR (key 0x30,0xd0,0x59,0x18, the report's Stage 3 key), resolves its live server with GET /s/bc7dc4e7ed09 on 165.140.85.105:1244 or 165.140.86.106:1244, posts the hostname and user name to /keys, then downloads /j/<type> and /p into ~/.vscode, runs npm install there and starts the next stage with node. Port 1244 and the /keys upload are BeaverTail's. The report assesses the chain as Contagious Interview at medium-high confidence and its Stage 3 as InvisibleFerret-lineage. Its command-and-control is a fixed config host, not PolinRider's blockchain dead drops, so it is a separate toolchain. Found 2026-10-30 by technique signatures.
- also known as
- Lumanagi, InvisibleFerret, Contagious Interview, /keys loader
references
spread over time
Press play to watch the threat spread, or drag the slider to pick dates.
known-malicious hashes · 18
| sha-256 | file names | repos | files | first seen | last seen |
|---|---|---|---|---|---|
| 33b1dba3026e57a2… | routes.js |
1 | 2 | ||
| cb8b91dae8919eb0… | routes.js |
3 | 3 | ||
| aa84638b9eaff441… | next.config.js |
1 | 2 | ||
| e3df555a315c5300… | malicious_script.js |
1 | 1 | ||
| 18ef41806616d80e… | script.js |
1 | 1 | ||
| 6e2bc6538a8a29f3… | test.deobfuscated.js |
1 | 1 | ||
| 6d638bca4dbbbe53… | test.beautified.js |
1 | 1 | ||
| 07759d104f41cd7f… | test.js |
1 | 1 | ||
| 01b15b0d0732d8a2… | next.config.js |
1 | 1 | ||
| 186d0e65f14c1e6a… | orderController.js |
1 | 1 | ||
| 89344ad3bd580fff… | stonk.routes.js |
1 | 1 | ||
| 97f94b9679310356… | index.js |
1 | 1 | ||
| 0d8fe703fe190fba… | index.js |
1 | 1 | ||
| 14691a48460c21f6… | DarkTheme.js |
1 | 1 | ||
| 2a8b0a66e1d7e313… | api_route.js |
1 | 1 | ||
| 101a63767447fe6a… | logo310.png |
7 | 7 | ||
| 247c21910ba93020… | tailwind.config.js |
1 | 1 | ||
| ad862b9088d9e5a6… | ps.config.js |
1 | 1 |