Open-source atomic malware analysis

Analyze another

umbra.mod.c

C
Verdict: HOSTILE
SHA256: 66d4152f6983c47de6d3380823a92e34113456ff83dc394cd437837ebdbf5d47 · 100%
Mal-ecule
O₂(ErPr)H(Os)
Size 1.8 KB download
First seen 72 days ago
Analyzed 68 days ago

Objectives

suspicious severity, 90% confident.
evasion/kernel-hide/lkm kallsyms_lookup_name string reference
suspicious severity, 95% confident.
privilege-escalation/exploit Local privilege escalation via commit_creds(prepare_creds())
component severity, 90% confident.
evasion/kernel-hide Kill hook privilege markers

Micro-behaviors

notable severity, 85% confident.
os/kernel kallsyms_lookup_name kernel symbol resolver
baseline severity, 75% confident.
data/format snprintf formatting function
component severity, 99% confident.
os/syscall Linux kernel module header include (linux/module.h)

Identity

SHA-256 66d4152f6983c47de6d3380823a92e34113456ff83dc394cd437837ebdbf5d47
Filename umbra.mod.c

Origin

Source harvest

Timeline

First seen 4 Jun 2026 19:46 UTC
First analyzed 7 Jun 2026 22:18 UTC
Last analyzed 7 Jun 2026 22:18 UTC
Last updated 7 Jun 2026 22:18 UTC

Labeling

Label bad
Label source harvest
Traits version 8e9ac