Open-source atomic malware analysis

Analyze another

EraTech.RabbitMq.Client 2.2.6

ZIP
Verdict: BENIGN
SHA256: 96036e68767fba4f476ab2e381be9931e2e508d13f972177b0b30c29cbfda07a
Mal-ecule
H(Cm)Md(Bi)
Size 19.8 KB download
First seen 54 days ago
Analyzed 54 days ago
Ecosystem dotnet
Source api.nuget.org

Objectives

baseline severity, 85% confident.
evasion/masquerade/dll DLL filename extension present
component severity, 100% confident.
anti-static/obfuscation/binary-metrics Binary has normal code entropy (>5.5)
component severity, 99% confident.
anti-static/obfuscation/payload PE version resource text
component severity, 90% confident.
anti-static/pack PE has under ten imports
component severity, 95% confident.
command-and-control/backdoor/loader Staged loader six file archive
component severity, 100% confident.
command-and-control/infrastructure Binary has 4 or fewer sections
component severity, 95% confident.
evasion/indicator-removal Regex component marker
component severity, 92% confident.
evasion/process/injection Regex component marker
component severity, 90% confident.
persistence/login/scheduled-task Regex component marker
component severity, 98% confident.
supply-chain/metadata-anomaly/manifest NuGet nuspec manifest file

Micro-behaviors

notable severity, 86% confident.
communications/ip Hardcoded external IPv4 address
baseline severity, 85% confident.
data/serialize Newtonsoft.Json serialization library reference
component severity, 90% confident.
communications/proxy SOCKS5 client greeting bytes
component severity, 88% confident.
data/text/keywords Codebase deletion target

Metadata

notable severity, 72% confident.
binary Embedded absolute PDB path
baseline severity, 90% confident.
binary/section PE .reloc section presence
baseline severity, 95% confident.
dylib::mscoree links mscoree (CorDllMain)
baseline severity, 100% confident.
hardening High-entropy ASLR (64-bit)
baseline severity, 90% confident.
package PE version resource metadata
component severity, 95% confident.
binary/anomaly PE version info numeric fields present

20 of 28 traits shown

Identity

SHA-256 96036e68767fba4f476ab2e381be9931e2e508d13f972177b0b30c29cbfda07a
Canonical SHA-256 1e79c33e6ebc05d3a454f3cc4ee878f36c641b29ae945cc8d12649a53222c995
Filename EraTech.RabbitMq.Client.2.2.6.nupkg
Package EraTech.RabbitMq.Client
Version 2.2.6

Origin

Source forager
Feed nuget.org
Ecosystem dotnet
Domain nuget.org
URL https://api.nuget.org/v3-flatcontainer/eratech.rabbitmq.client/2.2.6/eratech.rabbitmq.client.2.2.6.nupkg

Timeline

First seen 4 Jun 2026 07:00 UTC
First analyzed 4 Jun 2026 13:37 UTC
Last analyzed 4 Jun 2026 13:37 UTC
Last updated 4 Jun 2026 13:37 UTC

Labeling

Label unknown
Label source forager
Traits version 84adb