Open-source atomic malware analysis

Analyze another

github.com/brotherlogic/gobuildslave v0.0.0-20230528035915-9de608647d34

UNKNOWN
Verdict: BENIGN
SHA256: e2b4d1e12c0c8e8d3c5a92fa94be69e6f90c82015a8e3b1b4d4486addb00c0b1
Mal-ecule
K₂(LiTe)H₆(Cm₅CrDb₂FOs₃Po₅)Md(Bk₂)
Size 222.2 KB download
First seen 31 days ago
Analyzed 9 days ago
Package pkg:golang/github.com/brotherlogic/[email protected]
Ecosystem go
Source proxy.golang.org

Referenced by 10 samples

Well-known

notable severity, 98% confident.
lib/format Go protobuf runtime import
notable severity, 99% confident.
tool/development Go module cache source archive go.mod member

Micro-behaviors

notable severity, 95% confident.
communications Go process is a gRPC client
notable severity, 85% confident.
communications/http Go http.Get call
notable severity, 90% confident.
communications/http/url Cleartext http:// URL
notable severity, 90% confident.
communications/ip HTTP URL uses private 192.168 address
notable severity, 90% confident.
communications/socket Loopback socket endpoint with explicit port
notable severity, 95% confident.
crypto/hash Go constructs an MD5 digest
notable severity, 90% confident.
data Copies data with Go io.Copy
notable severity, 95% confident.
data/serialize Unmarshals a protobuf message in Go
notable severity, 75% confident.
fs/directory Enumerate files via ioutil.ReadDir
notable severity, 85% confident.
os/env os.Environ() enumerates the entire environment
notable severity, 75% confident.
os/network Go network interface enumeration
notable severity, 95% confident.
os/sysinfo Calls Python socket.gethostname
notable severity, 95% confident.
process/create Imports Python's subprocess module
notable severity, 92% confident.
process/enumerate ps process listing command
notable severity, 90% confident.
process/terminate Go process kill method

Metadata

notable severity, 97% confident.
build Go generated-code header comment
baseline severity, 100% confident.
file/extension POSIX shell script extension
baseline severity, 80% confident.
file/profile English function-word token "the"

20 of 26 traits shown

Identity

SHA-256 e2b4d1e12c0c8e8d3c5a92fa94be69e6f90c82015a8e3b1b4d4486addb00c0b1
Canonical SHA-256 023866ac2586b24ec2b331e0ec720057e41b3b22890f5af66c06328a82be17f7
Filename [email protected]
Package github.com/brotherlogic/gobuildslave
Version v0.0.0-20230528035915-9de608647d34
PURL pkg:golang/github.com/brotherlogic/[email protected]

Origin

Source x
Feed pkg.go.dev
Ecosystem go
Domain golang.org
URL https://proxy.golang.org/github.com/brotherlogic/gobuildslave/@v/v0.0.0-20230528035915-9de608647d34.zip

Timeline

First seen 1 Aug 2026 23:27 UTC
First analyzed 1 Aug 2026 23:28 UTC
Last analyzed 23 Aug 2026 22:13 UTC
Last updated 23 Aug 2026 22:15 UTC

Labeling

Label unknown
Traits version b8c1c