init.py

PYTHON

SUSPICIOUS

Mal-ecule

Size 1.5 KB download

First seen 117 days ago

Analyzed 106 days ago

Ecosystem malcontent-samples

Objectives

evasion/process/hidden Process creation with custom flags

supply-chain/impersonation subprocess with shell=True

anti-static/obfuscation Regex component marker

anti-static/obfuscation/payload Python source extension basename

anti-static/obfuscation/string Regex component marker

command-and-control/dropper open() function call

command-and-control/dropper/staging Regex component marker

credential-access/browser time module import

supply-chain/hidden-payload Regex component marker

supply-chain/recon-exfil __init__.py file

data/encode ROT13 encoded 'Windows' string (Jvaqbjf)

process/create Manipulates process via subprocess preexec_fn

communications/http/server Write file to persistent storage

data/decode Calls base64.b64decode (Python)

fs Reference to tempfile module

fs/file Opens a file

fs/temp Gets temp directory path

fs/write/file Write to text file (open with 'w')

lang Imports ctypes plus encoding family

import imports os

20 of 31 traits shown

SHA-256	53d430af9a3c96af57abd711c5251966b0afb001270070009f2526cde37582a8
Filename	__init__.py

Not seeing what you expected? Let us know