Open-source atomic malware analysis

Analyze another

revshell.rb

RUBY
Verdict: SUSPICIOUS
SHA256: 43ce2c1d3e649e73610eff58cc5d3fd541ba41062a2a8f75cbe26c4a302b7865
Mal-ecule
O(C)H₃(CmFOs)
Size 565 B download
First seen 118 days ago
Analyzed 116 days ago
Ecosystem malcontent-samples

Objectives

suspicious severity, 90% confident.
command-and-control/reverse-shell Ruby command loop reverse shell

Micro-behaviors

notable severity, 80% confident.
communications/socket Ruby socket connect call
notable severity, 85% confident.
fs/write IO.copy_stream call
notable severity, 75% confident.
os/console STDIN input for interactive shell

Metadata

baseline severity, 95% confident.
import imports open3

Identity

SHA-256 43ce2c1d3e649e73610eff58cc5d3fd541ba41062a2a8f75cbe26c4a302b7865
Filename revshell.rb

Origin

Source harvest
Feed datasets
Ecosystem malcontent-samples

Timeline

First seen 24 Apr 2026 16:18 UTC
Last analyzed 26 Apr 2026 15:23 UTC
Last updated 26 Apr 2026 15:23 UTC

Labeling

Label bad
Label source harvest
Traits version bf48d