Local reference
Suspicious dependency
Inferred
Mal-ecule
O₂(IAs₄)H₆(CmCr₃Ds₂OsPoDb₂)Md₂(Bi₃He)
Objectives
suspicious severity, 90% confident.
impact/ransom
Ransomware file encryption status logging
Micro-behaviors
notable severity, 66% confident.
communications/socket
Uses _connect socket call
notable severity, 75% confident.
crypto/kdf
PBKDF2 key derivation
notable severity, 95% confident.
crypto/symmetric
ChaCha20/Salsa20 cipher constant
notable severity, 90% confident.
dylib
Dynamic library loading via dlopen
notable severity, 90% confident.
os/sysinfo
Reference to VMware VMFS volumes path
notable severity, 90% confident.
process/create
system() function call
baseline severity, 90% confident.
dylib/library
GNU libstdc++ stdlib
baseline severity, 100% confident.
fs/path/device
/dev/tty terminal device
baseline severity, 100% confident.
os
Access /dev/urandom
Metadata
notable severity, 95% confident.
binary/section
Non-empty initialization array section
baseline severity, 100% confident.
binary
ELF program interpreter present
baseline severity, 100% confident.
binary/linking
ELF program interpreter metadata
baseline severity, 100% confident.
binary::binary-format-checked
Binary format is identified
baseline severity, 100% confident.
build
ELF GNU build-id note present
baseline severity, 90% confident.
hardening::elf-dynamic-section-name
ELF dynamic section name
baseline severity, 90% confident.
hardening::elf-dynstr-section-name
ELF dynstr section name
baseline severity, 90% confident.
hardening::elf-dynsym-section-name
ELF dynsym section name
baseline severity, 100% confident.
hardening::no-pie
Binary is not position-independent (fixed load address)
baseline severity, 100% confident.
unsigned
Binary is not digitally signed
20 of 35 traits shown
Identity
| SHA-256 | 5bdc678ba73a3c444b2961894dfdd8f0b09dd83f2a2208d136cee96f841a097a |
|---|---|
| Filename | return25.out |
Origin
| Source | harvest |
|---|---|
| Feed | dissect-malware |
| Ecosystem | elf_linux |
Timeline
| First seen | 24 Apr 2026 16:11 UTC |
|---|---|
| Last analyzed | 30 Apr 2026 19:52 UTC |
| Last updated | 17 Jun 2026 14:39 UTC |
Labeling
| Label | bad |
|---|---|
| Traits version | 7a19b |
Not seeing what you expected? Let us know