Open-source atomic malware analysis

Analyze another

setup.py

PYTHON
Verdict: SUSPICIOUS
SHA256: afd03934f72d32ec4fc0bf4f4e355fe76fca93a88b61c0aafafcd6e88a53af0e
Mal-ecule
O₄(S₅As₄C₂I)H₃(DbOsPo₂)Md₂(PaPt)
Size 3.7 KB download
First seen 117 days ago
Analyzed 117 days ago
Ecosystem malcontent-samples

Objectives

suspicious severity, 95% confident.
supply-chain/install-hook setup.py invokes os.system
notable severity, 100% confident.
supply-chain setup.py file
notable severity, 70% confident.
supply-chain/metadata-anomaly from setuptools import statement
component severity, 85% confident.
anti-static/obfuscation Low comment line count
component severity, 95% confident.
anti-static/obfuscation/payload Python source extension basename
component severity, 90% confident.
command-and-control/backdoor Python plugin initialization
component severity, 100% confident.
command-and-control/dropper open() function call

Micro-behaviors

notable severity, 100% confident.
data/text Contains the string "urllib3"
notable severity, 80% confident.
os/sysinfo Checks for Windows platform
notable severity, 95% confident.
process/create Executes shell commands via Python
notable severity, 90% confident.
process/interpreter Python exec() built-in function
baseline severity, 90% confident.
communications/http HTTPS protocol prefix
baseline severity, 90% confident.
fs/file Opens a file

Metadata

baseline severity, 100% confident.
build Python setup.py or setup.cfg file
baseline severity, 95% confident.
import imports setuptools
baseline severity, 95% confident.
import/python::setuptools/command imports setuptools.command.test
baseline severity, 70% confident.
package/testing pytest module
component severity, 95% confident.
lang Few generated table functions
component severity, 90% confident.
package File has 30 or more lines

Identity

SHA-256 afd03934f72d32ec4fc0bf4f4e355fe76fca93a88b61c0aafafcd6e88a53af0e
Filename setup.py

Origin

Source harvest
Feed datasets
Ecosystem malcontent-samples

Timeline

First seen 24 Apr 2026 16:18 UTC
Last analyzed 24 Apr 2026 21:05 UTC
Last updated 1 May 2026 06:36 UTC

Labeling

Label bad
Label source harvest
Traits version 8bf61