Open-source atomic malware analysis

Analyze another

upd.py

PYTHON
Verdict: SUSPICIOUS
SHA256: e62a52f66f7750c4dc85f0680d58432d3f391175f5f73acdc45377f2ee80dd47
Mal-ecule
O₈(As₈C₂CaEuIPPrS₃)H(Db)Md₂(PtPa)
Size 25.0 KB download
First seen 117 days ago
Analyzed 106 days ago
Ecosystem malcontent-samples

Objectives

suspicious severity, 88% confident.
anti-static/obfuscation/code-metrics Excessive Python line length
suspicious severity, 80% confident.
anti-static/obfuscation/control-flow Uses large complex number logic
suspicious severity, 90% confident.
anti-static/obfuscation/steganography Mathematical homoglyphs used for obfuscation
component severity, 95% confident.
anti-static/obfuscation/payload Python source extension basename
component severity, 92% confident.
anti-static/obfuscation/string Regex component marker
component severity, 85% confident.
anti-static/obfuscation/tools Low comment line count
component severity, 90% confident.
command-and-control/channel/tunnel Regex component marker
component severity, 85% confident.
command-and-control/dropper/staging PowerShell archive file extension marker
component severity, 100% confident.
credential-access/browser tempfile module import
component severity, 80% confident.
exfiltration/http Regex component marker
component severity, 90% confident.
persistence/login Regex component marker
component severity, 85% confident.
privilege-escalation Regex component marker
component severity, 80% confident.
supply-chain/impersonation Regex component marker
component severity, 84% confident.
supply-chain/install-hook Hidden directory literal

Micro-behaviors

baseline severity, 70% confident.
fs Reference to tempfile module
baseline severity, 66% confident.
fs/temp Temp directory string lookup

Metadata

notable severity, 95% confident.
lang Source imports requests library
baseline severity, 80% confident.
file/text High non-ASCII ratio in source
baseline severity, 95% confident.
import imports base64
component severity, 90% confident.
package Very long line

20 of 21 traits shown

Identity

SHA-256 e62a52f66f7750c4dc85f0680d58432d3f391175f5f73acdc45377f2ee80dd47
Filename upd.py

Origin

Source harvest
Feed datasets
Ecosystem malcontent-samples

Timeline

First seen 24 Apr 2026 16:18 UTC
Last analyzed 6 May 2026 01:09 UTC
Last updated 18 May 2026 09:31 UTC

Labeling

Label bad
Label source harvest
Traits version 84923