Open-source atomic malware analysis

Analyze another

tg.py

PYTHON
Verdict: SUSPICIOUS
SHA256: ed5a1b889cadca69c1a0cbfdf148c2dd82071d5d4ed704f1ed0ec8eb89dde01c
Mal-ecule
KO₇(Ca₂EuAs₄CErILa)H₂(PoDb)Md(Pa)
Size 8.7 KB download
First seen 118 days ago
Analyzed 111 days ago
Ecosystem malcontent-samples

Well-known

suspicious severity, 95% confident.
malware/stealer AiBot Telegram appstore path
component severity, 92% confident.
malware/backdoor VIPERTUNNEL old obfuscation function cluster

Objectives

suspicious severity, 95% confident.
credential-access/messaging Telegram tdata full path
suspicious severity, 95% confident.
exfiltration/stealer Targets Telegram tdata session store (macOS)
component severity, 85% confident.
anti-static/obfuscation Low comment line count
component severity, 95% confident.
anti-static/obfuscation/payload Python source extension basename
component severity, 100% confident.
command-and-control/dropper open() function call
component severity, 100% confident.
credential-access/browser shutil module import
component severity, 80% confident.
evasion/self-delete Recursive directory removal call
component severity, 75% confident.
lateral-movement/social-engineering Inline password token in lure

Micro-behaviors

notable severity, 75% confident.
process/create subprocess.Popen call (content)
baseline severity, 75% confident.
communications/http Write file to persistent storage
baseline severity, 85% confident.
fs/directory Directory traversal operation
baseline severity, 90% confident.
fs/file Opens a file
baseline severity, 80% confident.
fs/path Expand user home directory

Metadata

baseline severity, 95% confident.
import imports os
component severity, 90% confident.
package File has 30 or more lines

Identity

SHA-256 ed5a1b889cadca69c1a0cbfdf148c2dd82071d5d4ed704f1ed0ec8eb89dde01c
Filename tg.py

Origin

Source harvest
Feed datasets
Ecosystem malcontent-samples

Timeline

First seen 24 Apr 2026 16:18 UTC
Last analyzed 1 May 2026 08:56 UTC
Last updated 1 May 2026 08:56 UTC

Labeling

Label bad
Label source harvest
Traits version feb13