TELEPUZ C2 communication

TELEPUZ's configuration contains a single C2 domain, which is initialized just before the generation of the session identifier. In the communication thread, the sample attempts to establish contact with its C2 up to 10 times, if it fails, it attempts to retrieve a fallback C2 address using 4 different methods. These fallback methods access public resources to retrieve new C2 URLs, allowing operators to update addresses if the primary URL fails. We identified the following methods: Telegram method TELEPUZ accesses the Telegram profile ”t[. ]me/chanadarkpart, which contains the encrypted fallback URL.

The data is XOR-encrypted using the hardcoded key ”Goodman, the Steam profile and DNS record methods utilize this same encryption scheme. Decryption reveals the current C2 server at cal. snehamumbai[. ]org. Examination of the channel messages indicates the channel was created in late April 2026.

Steam Profile The second method is based on Steam profile usernames, the profile the malware is targeting is hxxps://steamcommunity[. ]com//profiles/76561199705801219. The profile name contains the same C2 address found in the Telegram channel. The profile's name history reveals both the C2 domain configured in the malware (cal. joycedoula[.

]com[. ]br) and this one again but encrypted with the key 111111111. DNS record The DNS record method does a DNS query for the domain codebasecode[. ]com, it then extracts and decrypts the fallback C2 from the information returned. However so far we haven’t found any record associated with this domain.

Polygon blockchain TELEPUZ initiates a JsonRPC HTTP POST request to the Polygon blockchain using pre-configured endpoints, targeting the smart contract address 0xf55Bea1FdCf1c3ABb39ab92567C09aC1BFf6753E with the method selector 0xc3f909d4. {"jsonrpc":"2.