Open-source atomic malware analysis

Analyze another

dd98ee5273a02829167b255baf9979759f84a0a6b7769a67ecbf6c0c9100c38d.elf

ELF
Verdict: SUSPICIOUS
SHA256: dd98ee5273a02829167b255baf9979759f84a0a6b7769a67ecbf6c0c9100c38d
Mal-ecule
KO₉(Ca₂Er₃AlC₃EuLa₂As₄IP)H₆(F₅Os₄Cm₉Cr₂Db₄Po₁₁)Md₃(HeBi₂Pa)
Size 1.1 MB download
First seen 117 days ago
Analyzed 117 days ago
Ecosystem malcontent-samples

Objectives

suspicious severity, 85% confident.
credential-access/pam Hidden credential log path
suspicious severity, 85% confident.
evasion/file-hiding Hidden executable in /tmp
notable severity, 95% confident.
command-and-control/reverse-shell POSIX shell with socket fd redirection
notable severity, 80% confident.
credential-access/dump Read shadow password file (getspnam)
notable severity, 90% confident.
evasion/masquerade prctl system call symbol
notable severity, 85% confident.
lateral-movement/brute-force SSH authentication credential spraying

Micro-behaviors

suspicious severity, 70% confident.
fs/path Hidden file in /var/tmp
suspicious severity, 90% confident.
os/sysinfo/platform Multiple MTD flash device paths
notable severity, 78% confident.
communications Hardcoded loopback IPv4 address
notable severity, 75% confident.
communications/socket Bind socket to address
notable severity, 85% confident.
communications/ssh Full SSH client implementation
notable severity, 75% confident.
crypto/kdf PBKDF2 key derivation
notable severity, 95% confident.
crypto/symmetric ChaCha20/Salsa20 cipher constant
notable severity, 90% confident.
data/compress Zlib deflate and inflate
notable severity, 80% confident.
fs/path/config /etc/group group database
notable severity, 80% confident.
fs/path/log References btmp failed login path
notable severity, 80% confident.
os/group Resolve GID to group name (getgrgid)
notable severity, 80% confident.
os/user Iterate password entries
notable severity, 95% confident.
process/create Executes command and captures output
notable severity, 75% confident.
process/tty Set terminal attributes

20 of 62 traits shown

Identity

SHA-256 dd98ee5273a02829167b255baf9979759f84a0a6b7769a67ecbf6c0c9100c38d
Filename dd98ee5273a02829167b255baf9979759f84a0a6b7769a67ecbf6c0c9100c38d.elf

Origin

Source harvest
Feed datasets
Ecosystem malcontent-samples

Timeline

First seen 24 Apr 2026 16:18 UTC
Last analyzed 24 Apr 2026 17:33 UTC
Last updated 30 Apr 2026 19:52 UTC

Labeling

Label bad
Label source harvest
Traits version 8bf61