Open-source atomic malware analysis

Analyze another

acme.sh

SHELL
Verdict: SUSPICIOUS
SHA256: 5afa747a59a2dad83ac4775c6d67bb3152cef495bf5f2d59bd0b1bf51c2ffb92
Mal-ecule
KO₇(C₄DyP₂S₂ErI₂La)H₅(Po₄Cm₃Db₄F₂Os₄)Md₂(Pa)
Size 221.0 KB download
First seen 118 days ago
Analyzed 116 days ago
Ecosystem malcontent-samples

Well-known

baseline severity, 100% confident.
tool/sysadmin Uses sed for text processing

Objectives

notable severity, 70% confident.
command-and-control/botnet BusyBox command in shell script
notable severity, 80% confident.
discovery/host Greps for token or secret keywords
notable severity, 100% confident.
persistence/login/shell .cshrc file (C shell, not
notable severity, 85% confident.
persistence/system/cron Cron with download cradle
baseline severity, 80% confident.
anti-static/obfuscation/code-metrics Extremely large function (>500 lines)
baseline severity, 100% confident.
command-and-control/dropper Benign platform bootstrap curl domain

Micro-behaviors

suspicious severity, 90% confident.
process/create Shell command with piping and null redirection
notable severity, 80% confident.
communications/dns Cloudflare DoH JSON API endpoint
notable severity, 80% confident.
communications/http/download curl silent flags
notable severity, 70% confident.
data tr command for character deletion
notable severity, 75% confident.
fs/chmod chmod +x (make executable)
notable severity, 66% confident.
fs/path Reference to /bin/su
notable severity, 80% confident.
os/env/vars uname command for fingerprinting
notable severity, 90% confident.
os/network ss socket statistics
notable severity, 70% confident.
process Background process with hidden output
baseline severity, 90% confident.
communications/http HTTP protocol prefix

Metadata

notable severity, 90% confident.
encoded-payload Encoded payload detected: xor → base64
baseline severity, 80% confident.
binary High density of shell commands
baseline severity, 100% confident.
lang shell code embedded in string

20 of 32 traits shown

Identity

SHA-256 5afa747a59a2dad83ac4775c6d67bb3152cef495bf5f2d59bd0b1bf51c2ffb92
Filename acme.sh

Origin

Source harvest
Feed datasets
Ecosystem malcontent-samples

Timeline

First seen 24 Apr 2026 16:18 UTC
Last analyzed 26 Apr 2026 13:00 UTC
Last updated 26 Apr 2026 13:00 UTC

Labeling

Label bad
Label source harvest
Traits version bf48d