Open-source atomic malware analysis

Analyze another

https://hub.unity3d.com/linux/repos/deb/pool/main/u/unity/unityhub_amd64/unityhub_3.21.0_amd64.deb

UNKNOWN
Verdict: HOSTILE
SHA256: b90d3e38ecfac7b3cc5954b298cc8beec915250a4cb0038bb50781ee1fce0e25 · 92%
Mal-ecule
K₃(Am₃Li₁₉Te₂)O₁₁(S₅Al₃C₃As₃CaCo₂Dy₄Eu₂LaPrXe₂)H₁₁(Cm₁₀₇Cr₂₀Db₅₃Ds₃F₃₆Hf₅MgOs₄₇Po₅₂Ti₂U₁₂)Md₁₁(Pa₂₄Bi₁₀BkInLi₃Pt₃Si₃)
Size 158.0 MB download
First seen 3 days ago
Analyzed 3 days ago

Referenced by 2 samples

Well-known

notable severity, 99% confident.
lib/cloud Firebase product homepage marker
notable severity, 100% confident.
lib/runtime Electron app.asar member path

Objectives

hostile severity, 96% confident.
supply-chain/install-hook/dropper npm preinstall hook elevates to admin via PowerShell RunAs
hostile severity, 99% confident.
supply-chain/recon-exfil npm preinstall profiles host and posts data
suspicious severity, 90% confident.
anti-analysis/analysis-bomb Rule evaluation timeout: micro-behaviors/os/package-manager/install::package-manager-if-conditional took 169711ms (limit: 90000ms)
suspicious severity, 97% confident.
command-and-control/dropper/execution IRM or RestMethod piped to IEX

Micro-behaviors

notable severity, 99% confident.
crypto/library Native cryptographic library context
notable severity, 100% confident.
data/db ioredis driver reference
notable severity, 100% confident.
data/encode Converts buffer to hex string
notable severity, 100% confident.
data/source Dense repeated Math.pow arithmetic
notable severity, 100% confident.
data/source/function Many JavaScript functions return string literals
notable severity, 100% confident.
fs/file/write Node synchronously writes a file
notable severity, 100% confident.
os/network References GetAllNetworkInterfaces method

Metadata

notable severity, 100% confident.
binary/linking ELF directly depends on the dynamic loader
notable severity, 100% confident.
file/extension System.Private.CoreLib.dll runtime basename
notable severity, 100% confident.
file/format JavaScript source map
notable severity, 99% confident.
file/profile Escaped Unicode codepoint in source
notable severity, 100% confident.
signed Signed by Microsoft Corporation
notable severity, 100% confident.
strings-truncated String extraction truncated due to limits (count: 100000, total bytes: 50 MB)

20 of 211 traits shown

Identity

SHA-256 b90d3e38ecfac7b3cc5954b298cc8beec915250a4cb0038bb50781ee1fce0e25
Filename https://hub.unity3d.com/linux/repos/deb/pool/main/u/unity/unityhub_amd64/unityhub_3.21.0_amd64.deb

Origin

Source x

Timeline

First seen 25 Aug 2026 07:20 UTC
First analyzed 25 Aug 2026 06:59 UTC
Last analyzed 25 Aug 2026 10:45 UTC
Last updated 25 Aug 2026 10:45 UTC

Labeling

Label unknown