GCVE-110-OSM-2026-5811

This package is a deliberate attack on a malware analysis pipeline disguised as a bug bounty probe. The code in beacon15.js implements a full UAC bypass via the fodhelper.exe registry hijack (writing to HKCU\Software\Classes\ms-settings\Shell\Open\command), registers a scheduled task running as NT AUTHORITY\SYSTEM, and then specifically targets analysis-pipeline artifacts: it reads findings.xml, workflow.log, and toolparams.json from a D:\TRANSFER directory, exfiltrates them in chunks to 173.255.233.239:8000, and — critically — writes '<!-- research-probe: verdict-poisoning-demonstrated -->' back into findings.xml before restoring it, explicitly demonstrating write capability against the verdict file. The self-asserted 'authorized bug bounty' framing does not legitimize privilege escalation, verdict poisoning, sandbox reconnaissance, or exfiltration to a hardcoded attacker-controlled IP; no legitimate bounty proof-of-concept requires SYSTEM-level scheduled tasks or writing to the analysis engine's verdict files. The attacker model is sandbox/analysis-infrastructure compromise: enumerate the pipeline, exfiltrate its configuration and findings, and demonstrate the ability to subvert verdicts. Entrypoint: run.js (install-hook: node run.js) Exfil: http://$bh`:$bp`/beacon?d=$mk%7C$tag&w=$s\ (custom-c2, recovery: plaintext in beacon15.js) Payload: beacon15.js Secondary files: beacon_linux.js Key findings: - Shell Command Execution in beacon15.js: "require('child_process')" - Data Encoding for Exfiltration in beacon15.js: "encodeURIComponent(w.slice(0, 1200" - Silent Process Execution in beacon15.js: "windowsHide: true" - Shell Command Execution in beacon_linux.js: "require('child_process')" - Data Encoding for Exfiltration in beacon_linux.js: "encodeURIComponent(MARKER + '|' + PHASE" IOCs: - ipv4: 173.255.233.239, 34.196.43.233 - urls: http://$bh`:$bp`/beacon?d=$mk%7C$tag&w=$s\ - domains: curran.tech, payload.net - emails: nicholas@curran.tech - payloadFileHash: b15b7345d68f1ae807f297406c204efb63f92bb3597cf507fc508110bc99b267