Open-source atomic malware analysis

Analyze another

v3.0.0.6

UNKNOWN
Verdict: HOSTILE
SHA256: 60ced7cf1a0683451206295e47620bbbb8eac85fbb9b5da7e84789bee83f0691 · 92%
Mal-ecule
K₃(AmLi₂Te₃)O₁₃(C₉Al₄AsI₂P₆S₇Xe₆CaCo₃Dy₄Er₂Eu₂La₂)H₁₀(Cm₆₃Cr₁₀Db₂₈DsF₃₄Hf₂Os₄₃Po₄₈Ti₂U₆)Md₇(BiBk₂LiPa₉Pt)
Size 4.5 MB download unavailable
First seen 3 days ago
Analyzed 3 days ago
Source codeload.github.com

Referenced by 1 sample

Well-known

notable severity, 100% confident.
lib Imports the Python urllib3 library

Objectives

hostile severity, 99% confident.
command-and-control/dropper/execution Hidden PowerShell downloads and launches an executable
suspicious severity, 96% confident.
anti-analysis/fingerprinting Host-derived payload key material
suspicious severity, 95% confident.
anti-analysis/timing CI check followed by requests
suspicious severity, 85% confident.
anti-static/obfuscation/code-metrics Multiple long padded Base64 string literals
suspicious severity, 98% confident.
execution/interpreter/eval Jinja traversal reaches shell command
suspicious severity, 94% confident.
impact/degrade/edr Multiple kernel-driver image options
suspicious severity, 94% confident.
persistence/system/init Shell enables FreeBSD rc.conf service

Micro-behaviors

notable severity, 100% confident.
communications/http/services GitHub issue management
notable severity, 100% confident.
communications/socket Python outbound socket connection

20 of 183 traits shown

Identity

SHA-256 60ced7cf1a0683451206295e47620bbbb8eac85fbb9b5da7e84789bee83f0691
Canonical SHA-256 005292293e26fa8768288f3ed7f643f747b7bc7ecc1a2737cfa0bcdcfa148b54
Filename v3.0.0.6

Origin

Source upload
Domain github.com
URL https://codeload.github.com/bceverly/sysmanage/tar.gz/refs/tags/v3.0.0.6

Timeline

First seen 1 Aug 2026 20:22 UTC
First analyzed 1 Aug 2026 20:24 UTC
Last analyzed 1 Aug 2026 20:24 UTC
Last updated 1 Aug 2026 20:23 UTC

Labeling

Label unknown
Label source upload
Traits version 9cc7c