Open-source atomic malware analysis

Analyze another

armv4l.SNOOPY

ELF
Verdict: HOSTILE
SHA256: cc4e6e7913791778ff622c7b983938bd9d519ed561d23a1bca6b6bcdba349bd2
Mal-ecule
K₂O₇(IC₃P₂Dy₃AsEr₃La)H₆(Cm₆FOsPo₂CrDb₂)Md₃(Bi₄BkHe)
Size 93.7 KB download
First seen 104 days ago
Analyzed 104 days ago
Ecosystem elf_linux

Well-known

suspicious severity, 95% confident.
malware/botnet SNOOPY architecture binary basename

Objectives

hostile severity, 98% confident.
impact/dos C2 tasked DDoS bot daemon
suspicious severity, 92% confident.
command-and-control/botnet PING PONG keepalive pair
suspicious severity, 75% confident.
persistence/system/daemon Unix daemon persistence mechanism
notable severity, 70% confident.
discovery/host User/group ID gathering

Micro-behaviors

notable severity, 95% confident.
communications External IPv4 endpoint in static ELF
notable severity, 70% confident.
os/service telnetd daemon reference
notable severity, 75% confident.
process/tty Get terminal attributes
baseline severity, 100% confident.
process/create Line-based file reading (fgets)

Metadata

notable severity, 80% confident.
binary Binary has many exports (>10)
notable severity, 100% confident.
build::dwarf-builddir-leak DWARF leaks builder home directory (/home/<user>)
notable severity, 80% confident.
hardening::no-mitigations ELF lacks key security mitigations (no canary + no NX + no RELRO)
notable severity, 90% confident.
hardening::no-relro No RELRO (GOT writable after load)
notable severity, 90% confident.
hardening::no-stack-canary No stack canary (stack smashing protection absent)
notable severity, 90% confident.
hardening::nx-disabled NX/DEP disabled (stack is executable)
notable severity, 75% confident.
hardening::static-linked-heuristic ELF lacks dynamic linker sections
baseline severity, 100% confident.
binary::binary-format-checked Binary format is identified
baseline severity, 100% confident.
build::has-dwarf-debug-info Binary retains DWARF debug info (unstripped)
baseline severity, 100% confident.
hardening::no-pie Binary is not position-independent (fixed load address)
baseline severity, 100% confident.
unsigned Binary is not digitally signed

20 of 40 traits shown

Identity

SHA-256 cc4e6e7913791778ff622c7b983938bd9d519ed561d23a1bca6b6bcdba349bd2
Filename armv4l.SNOOPY

Origin

Source harvest
Feed dissect-malware
Ecosystem elf_linux

Timeline

First seen 4 May 2026 22:29 UTC
Last analyzed 4 May 2026 22:48 UTC
Last updated 4 May 2026 22:48 UTC

Labeling

Label bad
Label source harvest
Traits version 27ac5