Open-source atomic malware analysis

Analyze another

k8s.io-kubernetes-v0.0.0-20260616090720-f4d16b1a70ec.zip

ZIP
Verdict: BENIGN
SHA256: 09cc26213f2f9ee1c3761bfce25b341a0029f2be5a75fa808ffd5e47b503b46e
AI Legitimate Kubernetes source code archive
Mal-ecule
K₂(McTe)O₁₄(AlAs₁₀C₁₄Ca₅Dy₇Er₅Eu₂I₇LaP₆Pr₂S₂Co₂Xe₄)H₇(Cm₃₂F₂₅Os₂₆Cr₄Db₁₆Po₂₂Ti)Md₄(BiBk)
Size 22.7 MB download
First seen 3 days ago
Analyzed 3 days ago
Ecosystem go
Source proxy.golang.org
Go package init() runs network I/O on import
PowerShell script detecting emulator or sandbox environment
Shell base64 gunzip eval chain
k8s.io-kubernetes-v0.0.0-20260616090720-f4d16b1a70ec.zip zip
0 PK�������������������E���k8s.io/[email protected]/.geneTest or generated file context

Objectives

hostile severity, 95% confident.
command-and-control/channel/deaddrop URL dead drop / indirection pattern
hostile severity, 95% confident.
command-and-control/trigger Go package init() runs network I/O on import
suspicious severity, 90% confident.
command-and-control/backdoor/proxy Go portForward/tunnelForward module
suspicious severity, 95% confident.
command-and-control/dropper/execution Hidden PowerShell Get-Content IEX
suspicious severity, 92% confident.
credential-access/files Go reads SSH private key paths
suspicious severity, 94% confident.
credential-access/vpn Go PAN-OS OpenVPN client key
suspicious severity, 98% confident.
evasion/anti-av/platform Embedded Defender exclusion cmdlet
suspicious severity, 94% confident.
exfiltration/stealer/credential Go system secret path list
suspicious severity, 94% confident.
impact/dos NetScaler dd zero source
suspicious severity, 96% confident.
supply-chain/recon-exfil curl queries cloud metadata service

Micro-behaviors

suspicious severity, 95% confident.
fs/delete lu4p/shred secure deletion library

20 of 141 traits shown

Identity

SHA-256 09cc26213f2f9ee1c3761bfce25b341a0029f2be5a75fa808ffd5e47b503b46e
Canonical SHA-256 0028c2f78748af07c3b652fb76d15f8d0a47e2dbd902d4eea710bb55657def27
Filename k8s.io-kubernetes-v0.0.0-20260616090720-f4d16b1a70ec.zip
Package k8s.io/kubernetes
Version v0.0.0-20260616090720-f4d16b1a70ec

Origin

Source forager
Feed pkg.go.dev
Ecosystem go
Domain golang.org
URL https://proxy.golang.org/k8s.io/kubernetes/@v/v0.0.0-20260616090720-f4d16b1a70ec.zip

Timeline

First seen 16 Jun 2026 06:57 UTC
First analyzed 16 Jun 2026 23:15 UTC
Last analyzed 16 Jun 2026 23:15 UTC
Last updated 16 Jun 2026 23:15 UTC

Labeling

Label unknown
Label source forager
Traits version 27202