atomdrift labBETA

Open-source atomic malware analysis

Analyze another

osimage/kde-x86-64/manjaro-kde-26.1.0-260812-linux71/manjaro/x86_64/livefs.sfs.d/usr/lib/calamares/modules/removeuser

ELF

BENIGN

f8122e3ae311a68cc657d825bf035cb7d40cbb07b490490cfe936bfe0b0f0798

Mal-ecule

Size 30.4 KB download

First seen 7 days ago

Analyzed 6 days ago

Ecosystem manjaro

Source manjaro

libcalamares_job_removeuser.so elf

0x5080	6d706c2e680000002f7573722f696e63	mpl.h.../usr/inc
0x5090	6c7564652f7174362f5174436f72652f	lude/qt6/QtCore/
0x50a0	716172726179646174616f70732e6800	qarraydataops.h.
0x50b0	746869732d3e642d3e7265665f2e6c6f	this->d->ref_.loEnglish function-word token "this"
0x50c0	616452656c617865642829203d3d2030	adRelaxed() == 0
0x50d0	000000000000000052656d6f76696e67	........Removing
0x50e0	206c69766520757365722066726f6d20	live user from
0x50f0	74686520746172676574207379737465	the target systeEnglish function-word token "the"
0x5100	6de280a6000000002865202d20622920	m.......(e - b)
0x5110	3c3d20746869732d3e66726565537061	<= this->freeSpa
0x5120	63654174456e64282900000000000000	ceAtEnd().......
0x5130	7669727475616c2043616c616d617265	virtual Calamare
0x5140	733a3a4a6f62526573756c742052656d	s::JobResult Rem
0x5150	6f7665557365724a6f623a3a65786563	oveUserJob::exec
0x5160	28290000000000007573657264656c20	()......userdel Deletes Unix account with userdel or deluser
0x5170	7465726d696e61746564207769746820	terminated with English function-word token "with"
0x5180	6578697420636f6465006c656e203e3d	exit code.len >=
0x5190	20300064617461207c7c20216c656e00	0.data \|\| !len.
0x51a0	73697a655f7428642e73697a6529203c	size_t(d.size) <
0x51b0	3d204d617853697a6500217765616b72	= MaxSize.!weakr
0x51c0	65662e6c6f616452656c617865642829	ef.loadRelaxed()
0x51d0	007374726f6e677265662e6c6f616452	.strongref.loadR
0x51e0	656c617865642829203c3d20300074	elaxed() <= 0.t

Micro-behaviors

0x5080	6d706c2e680000002f7573722f696e63	mpl.h.../usr/inc
0x5090	6c7564652f7174362f5174436f72652f	lude/qt6/QtCore/
0x50a0	716172726179646174616f70732e6800	qarraydataops.h.
0x50b0	746869732d3e642d3e7265665f2e6c6f	this->d->ref_.lo
0x50c0	616452656c617865642829203d3d2030	adRelaxed() == 0
0x50d0	000000000000000052656d6f76696e67	........Removing
0x50e0	206c69766520757365722066726f6d20	live user from
0x50f0	74686520746172676574207379737465	the target syste
0x5100	6de280a6000000002865202d20622920	m.......(e - b)
0x5110	3c3d20746869732d3e66726565537061	<= this->freeSpa
0x5120	63654174456e64282900000000000000	ceAtEnd().......
0x5130	7669727475616c2043616c616d617265	virtual Calamare
0x5140	733a3a4a6f62526573756c742052656d	s::JobResult Rem
0x5150	6f7665557365724a6f623a3a65786563	oveUserJob::exec
0x5160	28290000000000007573657264656c20	()......userdel
0x5170	7465726d696e61746564207769746820	terminated with
0x5180	6578697420636f6465006c656e203e3d	exit code.len >=
0x5190	20300064617461207c7c20216c656e00	0.data \|\| !len.
0x51a0	73697a655f7428642e73697a6529203c	size_t(d.size) <
0x51b0	3d204d617853697a6500217765616b72	= MaxSize.!weakr
0x51c0	65662e6c6f616452656c617865642829	ef.loadRelaxed()
0x51d0	007374726f6e677265662e6c6f616452	.strongref.loadR
0x51e0	656c617865642829203c3d20300074	elaxed() <= 0.t

Metadata

binary/linking ELF depends on glibc

0x5080	6d706c2e680000002f7573722f696e63	mpl.h.../usr/inc
0x5090	6c7564652f7174362f5174436f72652f	lude/qt6/QtCore/
0x50a0	716172726179646174616f70732e6800	qarraydataops.h.
0x50b0	746869732d3e642d3e7265665f2e6c6f	this->d->ref_.lo
0x50c0	616452656c617865642829203d3d2030	adRelaxed() == 0
0x50d0	000000000000000052656d6f76696e67	........Removing
0x50e0	206c69766520757365722066726f6d20	live user from
0x50f0	74686520746172676574207379737465	the target syste
0x5100	6de280a6000000002865202d20622920	m.......(e - b)
0x5110	3c3d20746869732d3e66726565537061	<= this->freeSpa
0x5120	63654174456e64282900000000000000	ceAtEnd().......
0x5130	7669727475616c2043616c616d617265	virtual Calamare
0x5140	733a3a4a6f62526573756c742052656d	s::JobResult Rem
0x5150	6f7665557365724a6f623a3a65786563	oveUserJob::exec
0x5160	28290000000000007573657264656c20	()......userdel
0x5170	7465726d696e61746564207769746820	terminated with
0x5180	6578697420636f6465006c656e203e3d	exit code.len >=
0x5190	20300064617461207c7c20216c656e00	0.data \|\| !len.
0x51a0	73697a655f7428642e73697a6529203c	size_t(d.size) <
0x51b0	3d204d617853697a6500217765616b72	= MaxSize.!weakr
0x51c0	65662e6c6f616452656c617865642829	ef.loadRelaxed()
0x51d0	007374726f6e677265662e6c6f616452	.strongref.loadR
0x51e0	656c617865642829203c3d20300074	elaxed() <= 0.t

Identity

SHA-256	f8122e3ae311a68cc657d825bf035cb7d40cbb07b490490cfe936bfe0b0f0798
Filename	libcalamares_job_removeuser.so
Package	osimage/kde-x86-64/manjaro-kde-26.1.0-260812-linux71/manjaro/x86_64/livefs.sfs.d/usr/lib/calamares/modules/removeuser

Origin

Source	forager
Feed	manjaro.org
Ecosystem	manjaro
Domain	manjaro

Timeline

First seen	26 Aug 2026 18:27 UTC
First analyzed	28 Aug 2026 05:52 UTC
Last analyzed	28 Aug 2026 05:52 UTC
Last updated	28 Aug 2026 05:52 UTC

Labeling

Label	good
Label source	promoter
Traits version	b59b7

Not seeing what you expected? Let us know