Open-source atomic malware analysis

Analyze another

CryptoNews-PR-Agreement.xz

XZ
Verdict: SUSPICIOUS
SHA256: ffa33247483de7741092a71a548e2faedcf19aaa8e83c19efdb9f8c5a3746c6b
Mal-ecule
KO₃(As₃PAl)H₂(F₂Po₃)Md₂(Bi₂Si)
Size 34.5 KB download
First seen 117 days ago
Analyzed 117 days ago
Ecosystem malcontent-samples

Well-known

component severity, 100% confident.
malware/stealer Unwind_Resume import

Objectives

suspicious severity, 95% confident.
anti-static/obfuscation Concealed Mach-O shell execution
suspicious severity, 85% confident.
persistence/system/daemon macOS double-fork daemon syscall pattern
notable severity, 80% confident.
anti-analysis Extremely low logic density (function sparsity)
notable severity, 70% confident.
anti-static/obfuscation/payload Tiny __cstring section (<0.1% of
component severity, 80% confident.
anti-static/pack Entry point in non-standard section

Micro-behaviors

notable severity, 80% confident.
fs/file Read file status and metadata (core)
notable severity, 95% confident.
process/create Executes command and captures output
baseline severity, 90% confident.
dylib/library GNU libstdc++ stdlib
baseline severity, 66% confident.
fs/chmod Look up file permissions
baseline severity, 66% confident.
fs/directory Uses opendir
baseline severity, 66% confident.
process/fork Process forking

Metadata

suspicious severity, 90% confident.
binary Extreme code-to-string ratio
notable severity, 100% confident.
signed Ad-hoc Signature
baseline severity, 100% confident.
arch::arm64-macho ARM64 Mach-O binary
baseline severity, 100% confident.
binary/linking Mach-O linked dylib metadata
baseline severity, 80% confident.
binary/metrics No sentence-like strings
baseline severity, 100% confident.
build Mach-O UUID present
baseline severity, 90% confident.
hardening::stack-chk-fail __stack_chk_fail function
component severity, 90% confident.
binary/section Tiny C string section ratio

Identity

SHA-256 ffa33247483de7741092a71a548e2faedcf19aaa8e83c19efdb9f8c5a3746c6b
Canonical SHA-256 651e2735bbb56456bf546565ae5ac9d7bfd2409166cf85779a1c0ad17ac524a6
Filename CryptoNews-PR-Agreement.xz

Origin

Source harvest
Feed datasets
Ecosystem malcontent-samples

Timeline

First seen 24 Apr 2026 16:18 UTC
Last analyzed 24 Apr 2026 21:10 UTC
Last updated 1 May 2026 06:38 UTC

Labeling

Label bad
Label source harvest
Traits version 8bf61