Open-source atomic malware analysis

Analyze another

rkload

ELF
Verdict: SUSPICIOUS
SHA256: 0cb396985d033e5c1ab5c0633be6a25df2183e6a49eac7ed8bb2fef3a06514e0
Mal-ecule
KO₆(As₈CEr₉LaPDy)H₆(F₅Db₅Ds₂Os₃Po₆Cr₂)Md₃(Bi₃He)Th
Size 891.6 KB download
First seen 118 days ago
Analyzed 118 days ago
Ecosystem malcontent-samples

Well-known

suspicious severity, 95% confident.
malware/rootkit Medusa hidden configuration directory

Objectives

suspicious severity, 85% confident.
anti-static/obfuscation ELF concealing capabilities
suspicious severity, 90% confident.
command-and-control/backdoor Shared library with rootkit behavior
suspicious severity, 95% confident.
evasion/anti-av/platform SELinux bypass detected
suspicious severity, 85% confident.
evasion/file-hiding Hidden executable in /tmp
suspicious severity, 90% confident.
evasion/indicator-removal HISTFILE=/dev/null redirection
suspicious severity, 95% confident.
evasion/kernel-hide LD_PRELOAD rootkit installer (modifies /etc/ld.so.preload)
notable severity, 90% confident.
evasion/anti-av Syscall with immediate number
notable severity, 90% confident.
evasion/masquerade prctl syscall instruction (x86_64)

Micro-behaviors

suspicious severity, 70% confident.
fs/path Hidden file in /dev/shm
notable severity, 80% confident.
data/embedded Embedded ELF binary
notable severity, 84% confident.
data/embedded/payload Embedded ELF binary in rodata
notable severity, 90% confident.
dylib RTLD_NEXT pseudo-handle
notable severity, 80% confident.
fs/file Read file status and metadata (legacy 64-bit)
notable severity, 95% confident.
process/create Executes command and captures output

Metadata

notable severity, 80% confident.
binary Statically linked binary
notable severity, 90% confident.
encoded-payload Encoded payload detected: xor

Third-party

hostile severity, 90% confident.
elastic/Linux_Trojan_Orbit/linux/trojan

binary

notable severity, 90% confident.
embedded Embedded ELF binary at file offset 0xaf0e0 (~98184 bytes)

feat

notable severity, 100% confident.
binary/elf ELF IFUNC resolver: strcpy

20 of 66 traits shown

Identity

SHA-256 0cb396985d033e5c1ab5c0633be6a25df2183e6a49eac7ed8bb2fef3a06514e0
Filename rkload

Origin

Source harvest
Feed datasets
Ecosystem malcontent-samples

Timeline

First seen 24 Apr 2026 16:18 UTC
Last analyzed 24 Apr 2026 18:52 UTC
Last updated 30 Apr 2026 21:19 UTC

Labeling

Label bad
Label source harvest
Traits version 8bf61