Open-source atomic malware analysis

Analyze another

PWN.so

ELF
Verdict: BENIGN
SHA256: 06e51243c6e5087babf733c5dbcfd6eb85abeefa6778b23db9c3361572d7a959
Mal-ecule
O₂(CPr)H₃(Cm₃DbPo₃)Md(Bk)
Size 21.8 KB download
First seen 117 days ago
Analyzed 100 days ago
Ecosystem malcontent-samples

Objectives

suspicious severity, 66% confident.
command-and-control/reverse-shell References a reverse shell
notable severity, 95% confident.
privilege-escalation/exploit PwnKit exploit identifier
component severity, 94% confident.
evasion/kernel-hide Regex component marker
component severity, 92% confident.
persistence/system/daemon Regex component marker

Micro-behaviors

notable severity, 70% confident.
communications/ip SOCK_RAW socket type
notable severity, 66% confident.
communications/socket Uses _connect socket call
notable severity, 70% confident.
data/text/malware Reverse shell keyword
notable severity, 90% confident.
process/create Direct execve program execution
notable severity, 90% confident.
process/create/shell system() function call
baseline severity, 80% confident.
dylib/library libc version string pattern
baseline severity, 66% confident.
fs/path Reference to /usr/local/bin
baseline severity, 100% confident.
fs/path/device /dev/null (legitimate discard device)
baseline severity, 80% confident.
process/identity Drop privileges (setuid after getuid)

Metadata

notable severity, 100% confident.
build DWARF leaks builder home directory (/home/<user>)
baseline severity, 100% confident.
binary Binary format is identified
baseline severity, 95% confident.
binary/anomaly ELF declares DT_RELACOUNT (relative relocations)
baseline severity, 100% confident.
binary/linking ELF needed library metadata
baseline severity, 100% confident.
binary/metrics Binary has low average complexity
baseline severity, 90% confident.
hardening __stack_chk_fail function
baseline severity, 100% confident.
unsigned Binary is not digitally signed

20 of 21 traits shown

Identity

SHA-256 06e51243c6e5087babf733c5dbcfd6eb85abeefa6778b23db9c3361572d7a959
Filename PWN.so

Origin

Source harvest
Feed datasets
Ecosystem malcontent-samples

Timeline

First seen 24 Apr 2026 16:18 UTC
First analyzed 11 May 2026 12:39 UTC
Last analyzed 11 May 2026 12:39 UTC
Last updated 11 May 2026 12:39 UTC

Labeling

Label bad
Label source harvest
Traits version 46790