Open-source atomic malware analysis

Analyze another

lslogins

ELF
Verdict: BENIGN
SHA256: ab29a809da0f0cb272999ba633b16faf68ad8cb7070cfb0c927d3cb817b92aa8
Mal-ecule
O₂(CaEr₂)H₃(CmF₂Os₂)Md(He)
Size 130.6 KB download
First seen 117 days ago
Analyzed 100 days ago
Ecosystem malcontent-samples

Objectives

suspicious severity, 80% confident.
credential-access/dump Read shadow password file (getspnam)
notable severity, 90% confident.
evasion/fileless proc self fd format string

Micro-behaviors

notable severity, 66% confident.
communications/socket Uses sendfile socket call
notable severity, 80% confident.
fs/file Read file status and metadata (core)
notable severity, 88% confident.
fs/path/log References login accounting file paths
notable severity, 80% confident.
os/group Resolve group name to GID (getgrnam)
notable severity, 80% confident.
os/user Iterate password entries
baseline severity, 80% confident.
dylib/library libc version string pattern
baseline severity, 80% confident.
fs/link Read symbolic link target path
baseline severity, 80% confident.
fs/path/config /etc/passwd user database
baseline severity, 100% confident.
process/create Line-based file reading (fgets)
baseline severity, 80% confident.
process/identity Drop privileges (setuid after getuid)

Metadata

notable severity, 70% confident.
hardening RPATH/RUNPATH set (library injection vector)
baseline severity, 100% confident.
binary ELF has program interpreter
baseline severity, 95% confident.
binary/anomaly ELF imports FORTIFY_SOURCE __*_chk symbols
baseline severity, 100% confident.
binary/linking ELF program interpreter metadata
baseline severity, 100% confident.
binary/metrics Binary has low average complexity
baseline severity, 100% confident.
build ELF GNU build-id metadata
baseline severity, 70% confident.
package Version information string
baseline severity, 100% confident.
unsigned Binary is not digitally signed

20 of 33 traits shown

Identity

SHA-256 ab29a809da0f0cb272999ba633b16faf68ad8cb7070cfb0c927d3cb817b92aa8
Filename lslogins

Origin

Source harvest
Feed datasets
Ecosystem malcontent-samples

Timeline

First seen 24 Apr 2026 16:18 UTC
First analyzed 11 May 2026 12:21 UTC
Last analyzed 11 May 2026 12:22 UTC
Last updated 11 May 2026 12:22 UTC

Labeling

Label bad
Label source harvest
Traits version 46790