Local reference
Suspicious dependency
Inferred
Mal-ecule
H(Ti)
Objectives
component severity, 93% confident.
anti-analysis/geofencing
Hostname query references domain substring
component severity, 92% confident.
anti-static/obfuscation/payload
DOMAIN URL component identifier
component severity, 85% confident.
collection/database
Regex for database users
component severity, 70% confident.
command-and-control/infrastructure
Sleep/beacon interval field
component severity, 75% confident.
lateral-movement/social-engineering
Inline password token in lure
Micro-behaviors
notable severity, 82% confident.
time/sleep
Python periodic timed loop
component severity, 84% confident.
communications/proxy
cloudflared URL forwarding flag
component severity, 90% confident.
communications/url
Encoded URL documentation context
component severity, 75% confident.
data/control-flow
Python set() construction
component severity, 80% confident.
data/text
Python import-from statement
component severity, 88% confident.
data/text/keywords
Codebase deletion target
component severity, 74% confident.
os/container
Docker exec verb
component severity, 90% confident.
time
Python time.time call
component severity, 84% confident.
ui
ANSI terminal erase operation
Metadata
baseline severity, 100% confident.
file
Python file extension
baseline severity, 80% confident.
file/text
Sequential source identifier names
component severity, 100% confident.
build
GitHub Actions self-hosted runner config arguments
Identity
| SHA-256 | 6f1bf5060920e67c5c15f69dcc157cf40140e83649d647df48e744514fed51a0 |
|---|---|
| Filename | dnscnc.py |
Origin
| Source | harvest |
|---|
Timeline
| First seen | 4 Jun 2026 23:17 UTC |
|---|---|
| First analyzed | 8 Jun 2026 21:57 UTC |
| Last analyzed | 8 Jun 2026 21:57 UTC |
| Last updated | 8 Jun 2026 21:57 UTC |
Labeling
| Label | bad |
|---|---|
| Label source | harvest |
| Traits version | 21b5c |
Not seeing what you expected? Let us know