Open-source atomic malware analysis

Analyze another

emp3r0r.agent

ELF
Verdict: SUSPICIOUS
SHA256: 11974b1de679d7058d897765e7923ab6058d980c49f52ca333f13e528b3396e5
Mal-ecule
O₁₃(C₁₅Dy₄Er₁₀PPr₃As₇Co₂Eu₂I₆AlCaLa₂S₂)H₇(Cm₁₉F₉Cr₄Db₄DsOs₆Po₅)Md₆(Bi₂BkPaPt)
Size 36.4 MB download
First seen 117 days ago
Analyzed 115 days ago
Ecosystem malcontent-samples

Objectives

suspicious severity, 92% confident.
command-and-control/remote-command Go SSH server command channel
suspicious severity, 80% confident.
command-and-control/reverse-shell SSH service setup
suspicious severity, 85% confident.
discovery/system ghw library in binary
suspicious severity, 95% confident.
evasion/file-hiding Hidden system binary path
suspicious severity, 85% confident.
evasion/hijack-execution-flow LD_LIBRARY_PATH environment variable set
suspicious severity, 90% confident.
evasion/indicator-removal HISTFILE=/dev/null redirection
suspicious severity, 90% confident.
persistence/system/cron Crontab echo pipe pattern
suspicious severity, 90% confident.
privilege-escalation/exploit PwnKit exploit with execution context
notable severity, 85% confident.
command-and-control/backdoor/binary WebSocket protocol headers

Micro-behaviors

suspicious severity, 86% confident.
communications/ssh Permissive Go SSH server auth
suspicious severity, 70% confident.
fs/path Hidden file in /dev/shm
notable severity, 85% confident.
communications net.DialUDP UDP connection
notable severity, 93% confident.
communications/http Go binary embeds uTLS fingerprint customization
notable severity, 85% confident.
communications/url/external GitHub releases download URL
notable severity, 95% confident.
crypto/hash SHA512 hashing functions
notable severity, 90% confident.
crypto/symmetric AES cipher constructor symbol
notable severity, 90% confident.
dylib Dynamic library loading via dlopen
notable severity, 90% confident.
os/network netstat command
notable severity, 90% confident.
process/create Executes commands via Go os/exec

Metadata

notable severity, 90% confident.
encoded-payload Encoded payload detected: url

20 of 94 traits shown

Identity

SHA-256 11974b1de679d7058d897765e7923ab6058d980c49f52ca333f13e528b3396e5
Filename emp3r0r.agent

Origin

Source harvest
Feed datasets
Ecosystem malcontent-samples

Timeline

First seen 24 Apr 2026 16:18 UTC
Last analyzed 26 Apr 2026 05:53 UTC
Last updated 26 Apr 2026 05:53 UTC

Labeling

Label bad
Label source harvest
Traits version bf48d