Open-source atomic malware analysis

Analyze another

2026 03-27-telnyx-v4.87.2

ZIP
Verdict: SUSPICIOUS
Mal-ecule
KO₅(EuAs₂CCaI₂)H₄(Db₂Cm₃Os₂Po₃)Md(Pa)
Size 13.0 MB download unavailable
First seen 95 days ago
Analyzed 90 days ago
Package pkg:pypi/[email protected]
Ecosystem python
Source pythonhosted.org

Well-known

hostile severity, 100% confident.
malware/supply-chain Telnyx 4.87.2 encrypted source archive
component severity, 100% confident.
malware/dropper curl output to variable or subshell

Objectives

notable severity, 70% confident.
exfiltration curl explicit upload
component severity, 80% confident.
anti-static/obfuscation High import density in small script
component severity, 95% confident.
anti-static/obfuscation/payload Python source extension basename
component severity, 100% confident.
command-and-control/dropper open() function call
component severity, 100% confident.
credential-access/browser subprocess module import
component severity, 86% confident.
impact/wipe/disk Android file delete method string

Micro-behaviors

suspicious severity, 94% confident.
data/archive ZIP has many encrypted payload entries
notable severity, 78% confident.
communications/http Curl binary data upload to external URL
notable severity, 80% confident.
os/env/vars uname command for fingerprinting
notable severity, 80% confident.
process/create subprocess.check_output call
baseline severity, 90% confident.
fs/file Opens a file
baseline severity, 70% confident.
os/package-manager pip install command
component severity, 72% confident.
os/container Kubernetes API bearer header fragment
component severity, 100% confident.
process Redirects output to /dev/null

Metadata

baseline severity, 80% confident.
binary High density of shell commands
baseline severity, 75% confident.
file Tiny multi-line text script
baseline severity, 95% confident.
import imports contextlib
component severity, 90% confident.
package File has 30 or more lines

20 of 21 traits shown

Identity

SHA-256 4d6186a59549c433b09c8bd29b79526452c1d34ab5ccd1c3d0cdc1151c92b8c5
Canonical SHA-256 1534b7b2a20b847c48bf087df053bc9c51c1b7416650a03889273e173bca42be
Filename 2026-03-27-telnyx-v4.87.2.zip
Package 2026
Version 03-27-telnyx-v4.87.2
PURL pkg:pypi/[email protected]

Origin

Source harvest
Feed datadog
Ecosystem python
Domain pythonhosted.org

Timeline

First seen 24 Apr 2026 16:11 UTC
Last analyzed 30 Apr 2026 00:11 UTC
Last updated 30 Apr 2026 00:11 UTC

Labeling

Label bad
Label source harvest
Traits version f6eaa