Open-source atomic malware analysis

Analyze another

pkg:golang/google.golang.org/[email protected]

UNKNOWN
Verdict: HOSTILE
SHA256: f8df11e405572304f57535768c0bc55a826074d318fcab455085f09fc23b61ea · 92%
Mal-ecule
K(Li)O₂(CCa)H₆(Cm₂₄Cr₆Db₁₀F₆Os₆Po₁₃)Md₃(Bk)
Size 18.9 MB download unavailable
First seen 2 days ago
Analyzed 1 day ago
Ecosystem go

Referenced by 4 samples

Well-known

notable severity, 99% confident.
lib Xray Trojan inbound server type declaration

Objectives

hostile severity, 95% confident.
command-and-control/trigger Go package init() runs network I/O on import
notable severity, 94% confident.
credential-access/discord Token records as credential entries

Micro-behaviors

notable severity, 95% confident.
communications Imports google.golang.org/grpc package
notable severity, 90% confident.
communications/email/send SMTP server or credential input field
notable severity, 90% confident.
communications/http/download Curl downloads file into /tmp
notable severity, 90% confident.
communications/http/header References HTTP Content-Type application/json
notable severity, 97% confident.
crypto/asymmetric Embedded PEM private-key material
notable severity, 95% confident.
crypto/hash Go FNV-1a hash constructor
notable severity, 100% confident.
data/decode base64.StdEncoding.Decode (Go)
notable severity, 95% confident.
fs/directory Shell changes working directory

Metadata

notable severity, 95% confident.
build Job environment references an Actions secret

20 of 56 traits shown

Identity

SHA-256 f8df11e405572304f57535768c0bc55a826074d318fcab455085f09fc23b61ea
Canonical SHA-256 01fe2b9851d6beed077055586752c4095ffc4a852adf8e67ea74ff0aef0affb8
Filename pkg:golang/google.golang.org/[email protected]

Origin

Source x
Feed pkg.go.dev
Ecosystem go

Timeline

First seen 2 Aug 2026 19:35 UTC
First analyzed 2 Aug 2026 19:36 UTC
Last analyzed 4 Aug 2026 10:38 UTC
Last updated 4 Aug 2026 10:36 UTC

Labeling

Label unknown
Traits version 6052a