Open-source atomic malware analysis

Analyze another

samplesftp

ELF
Verdict: BENIGN
SHA256: 6ad5ae422f9826436736560d3ec5ff1841990c4cd6ae4e529fa77b47f7c88ddc
Mal-ecule
H(Cm₂)Md(He)
Size 27.6 KB download unavailable
First seen 90 days ago
Analyzed 80 days ago
Ecosystem iot-malware

Objectives

component severity, 70% confident.
command-and-control/dropper Reference to /tmp directory path
component severity, 94% confident.
evasion/kernel-hide Regex component marker
component severity, 85% confident.
lateral-movement/brute-force Service account ubuntu

Micro-behaviors

notable severity, 85% confident.
communications/ssh SSH authentication implementation
baseline severity, 80% confident.
dylib/library libc version string pattern
baseline severity, 66% confident.
fs/file/write Write files
baseline severity, 100% confident.
fs/path /tmp/ path component
baseline severity, 100% confident.
process/create Line-based file reading (fgets)
component severity, 80% confident.
crypto/asymmetric Regex component marker

Metadata

notable severity, 70% confident.
hardening RPATH/RUNPATH set (library injection vector)
baseline severity, 100% confident.
binary Binary format is identified
baseline severity, 95% confident.
binary/anomaly ELF declares DT_RELACOUNT (relative relocations)
baseline severity, 100% confident.
binary/linking ELF needed library metadata
baseline severity, 100% confident.
binary/metrics Binary has low average complexity
baseline severity, 100% confident.
build ELF GNU build-id metadata
baseline severity, 100% confident.
unsigned Binary is not digitally signed

Identity

SHA-256 6ad5ae422f9826436736560d3ec5ff1841990c4cd6ae4e529fa77b47f7c88ddc
Filename samplesftp

Origin

Source harvest
Feed datasets
Ecosystem iot-malware

Timeline

First seen 1 May 2026 11:16 UTC
First analyzed 11 May 2026 12:23 UTC
Last analyzed 11 May 2026 12:24 UTC
Last updated 11 May 2026 12:24 UTC

Labeling

Label bad
Label source harvest
Traits version 46790