Local reference
Suspicious dependency
Inferred
Mal-ecule
O(C₃)H(Cm₂)
Objectives
suspicious severity, 85% confident.
command-and-control/dropper/delivery
HTTP URL with IP:port
notable severity, 70% confident.
command-and-control/infrastructure
Raw IP:port URL for staged TCP retrieval
notable severity, 75% confident.
command-and-control/infrastructure/domain
Direct IP address in URL
component severity, 75% confident.
anti-static/obfuscation/string
Python recovered string print
component severity, 100% confident.
command-and-control/dropper
open() function call
component severity, 72% confident.
supply-chain/metadata-anomaly/manifest
setup.py has trailing whitespace
Micro-behaviors
suspicious severity, 90% confident.
communications/http/url
URL pinned to external IPv4
notable severity, 95% confident.
communications/ip
HTTP URL with IP address
baseline severity, 75% confident.
communications/http/server
Write file to persistent storage
baseline severity, 90% confident.
fs/file
Opens a file
baseline severity, 78% confident.
fs/file/write
Python write() call
baseline severity, 80% confident.
os/random/prng
Python random module import
component severity, 80% confident.
data/text
Python import-from statement
component severity, 84% confident.
fs/path
Hidden directory path literal
Metadata
baseline severity, 80% confident.
file/text
Sequential source identifier names
baseline severity, 95% confident.
import
imports os
baseline severity, 100% confident.
lang
Python shebang line (unversioned)
Identity
| SHA-256 | db5b43b8de3ffb308b2d5823650595eec5ff88863ffa78e50e8cd859f00e4426 |
|---|---|
| Filename | db5b43b8de3ffb308b2d5823650595eec5ff88863ffa78e50e8cd859f00e4426.unknown |
Origin
| Source | harvest |
|---|
Timeline
| First seen | 13 May 2026 08:51 UTC |
|---|---|
| First analyzed | 31 May 2026 04:22 UTC |
| Last analyzed | 31 May 2026 04:22 UTC |
| Last updated | 31 May 2026 04:22 UTC |
Labeling
| Label | bad |
|---|---|
| Label source | harvest |
| Traits version | 52045 |
Not seeing what you expected? Let us know