85%
Malicious eval in config file
github · Search the index
Query analyzed artifacts from registries, marketplaces, and lab uploads — or see the latest 361 hostile catches in the fallout →
Files indexed
03dee9f5d3b0b6a15264043c8b2b3ab13e2cd72c44007222679f81bc4c9d7327
O₁₁(EuLaS₂AlAsC₂Ca₂Dy₃Er₂I₂Xe)H₅(Cm₁₁Db₆F₅Os₂Po₆)Md₂(Pa₂)
85%
Malicious dependency with exfiltration hook
8d23e92993a223b7b0877314f1d166d4e49f0fd7a0b3dd438d0722121bb39c1b
K(Mc)O₆(Al₂As₂CDy₂Er₄P₂)H₈(Cm₆Db₂F₇MgOs₈Po₇TiU)Md₃(Bi₂Si₂)
85%
Malicious embedded archive member
28f996f0af2591c18710c9e4505d895f372f8334cd5cf7642095ab4636349243
K(Mc)O₆(Al₂As₂CDy₂Er₄P₂)H₈(Cm₆Db₂F₇MgOs₈Po₇TiU)Md₃(Bi₂Si₂)
85%
Malicious embedded archive member
5e40baac460e97aa0c005419ec29e9af07097d0141858c4527e44b6655c86f33
K(Am)O₁₀(C₇Co₂S₅AlAs₅DyEr₂I₄PXe)H₈(Cm₁₁CrDb₅F₁₀Os₄Po₁₄U₂)Md₅(BkLiPa₇)
85%
Hostile findings in embedded package
0400c8b07738ee75fbb30c60e7f1837f08acdc6264ad57463db3d169717bc9e6
O₇(AsC₂Co₃DyErIXe)H₇(Cm₂F₇HfMgOs₄Po₇U)Md₂(Bi)
85%
Hardcoded C2 IP and execution bypass
63f435236a6aad1988cc2c380c3c7eabe7ae3540e8c470af11a993d460dc3fa7
O₅(AlC₂CaEr₃Eu)H₅(Cm₃DbF₇Os₅Po₃)Md
50%
Legitimate open-source database SDK source
6420a6bde1a6526dc059f03e301eeac483aaa1dae94c23fc8dcf7409210f486c
O₆(AsC₂Co₃DyIXe)H₆(Cm₂F₇HfOs₄Po₇U)Md₃(Bi)
85%
Hardcoded C2 IP and encoded payloads
85%
Obfuscated eval payload in config
7f10a18a99fb0cc037189124c89fb47c1a5b433dd4c7ffb52b999ee9a1cff5c7
O(Er)H₅(CrDb₂DsF₂Po)Md₃(Bi₃He)
80%
Native shell execution capability detected
fecbdc2f25aede90aaa57d44fb0d74e5a2c423b9f9982e16e475e5c2f957e3ee
K(Mc)O₄(AlDy₂ErP)H₈(Cm₆Db₂F₇MgOs₈Po₇TiU)Md₃(Bi₂Si₂)
80%
Self-injection and suspicious embedded binary
c0cb64f7861e439ef13fa06845e7ab6b219364b7b083c7ff10d851e764e6b16b
O₁₀(AsC₂Ca₂Dy₂Er₇IP₂PrS₂Xe₃)H₁₀(Cm₇Cr₇Db₅DsF₁₃HfMgOs₁₂Po₈U₂)Md₃(BiBk)
50%
Legitimate open-source software source code
36eb952eec538af7e2c4d5b8d7bed8e9232e7349f054f094221e4486f0dbe893
K₄(Mc₃GaLi₂Te)O₁₃(C₁₀Ca₅Dy₄Er₆Eu₂I₄Al₅As₇Co₃P₃PrSXe₂)H₁₁(Cm₃₄Cr₁₄Db₁₂DsF₂₁Hf₉Mg₂Os₂₄Po₂₃Ti₂U₄)Md₅(Bi₆Bk₃Pt₂Si₂)
85%
Steam++ is a known credential-stealing tool
ca1525c84a43f7fa48f1724aa933f81949bf686f755e6f5d2a2ac289645c697a
K(Li)O₈(CaEuAsC₂Dy₂ErIS)H₇(Cm₇CrDb₅F₂Os₅Po₅U)Md₂(BkPa₅)
85%
Anomalous obfuscated install hook detected
5fb5be151baedd635d99835cf3f9986afc9af6ae7b07bd001a1962f4298e45da
O(As₂)H₂(CmF)Md₂(Bi₂Si₃)
80%
Ad-hoc signed macOS binary
0a120a892de7b1bcc76cd51cff55371d5d68fe4d5407d173e4cad8995f30ee39
O₉(C₈ErI₃Al₂AsDyEu₂P₂Pr)H₇(Cm₇Cr₂Db₅F₇Os₅Po₂Ti)Md₄(BiBk)
50%
Legitimate Jellyfin media server source code
46616a67f79ec21c00198497271a4f3eee282994a39c782009e30016616f5124
K₃(AmLi₃Te₄)O₁₁(Er₂AsCa₄La₂S₅Xe₇C₆Co₃DyEu₂P₃)H₁₀(Cm₉₄Cr₉Db₄₇F₄₇Hf₂Os₃₃Po₄₈Ti₄U₁₁)Md₉(BiBk₄InLi₄Pa₁₀Pt)
64%
AI agent permission bypass flags
562abdd9d34f970d897c26cbbd2eae50c5a61e384ba48a6caefa2f80c805817a
K(Am)O₁₀(C₃AlAs₂CoDy₂Er₂IP₂PrXe₃)H₆(Po₁₁Cm₄CrDb₇F₇Os₇)Md₅(Bi₂HePtSi₂)
85%
Contains .NET XOR HTTP stager assembly
85%
Obfuscated eval in postcss config
85%
Obfuscated eval in config file
b405055fa6de297a2e315b54e2dd5467b8dea32d9e32947998ac9e2f3e33b954
K(Mc)O₂(CI)H₈(Cm₄Cr₅Db₃F₉HfOs₇Po₃U)Md₂(Bi)
85%
Contains reverse shell and backdoor references
bb02d50325c81a890322cb268cb854a9e7b61adb05812b94640f7f073f88d670
K(Mc)O₂(CI)H₈(Cm₄Cr₅Db₄F₆HfOs₇Po₃U)Md₃(Bi₂)
85%
Contains embedded RAR archive
c1932a55a3319f6f451de710b9a17dffff6d63b57c0da223b54b6c0b6a4e0075
K₃(LiMc₂Te)O₁₁(As₇Eu₆I₅S₂₂Al₃C₁₆Ca₈Er₃Dy₃PrXe₂)H₇(F₈Cm₁₃CrDb₅OsPo₁₈Ti)Md₇(Pa₈Bk₂InPt)
50%
Security scanner with malicious test fixtures
babee77d2653679021600b99c68d984d4463290cb221e0fc0d1093b3afdeb3b0
O(As)H₅(CmDbFOsPo₅)Md₂(Bi₂Pt)
85%
Encrypted payload with process injection APIs
af9573a2e36f7020b18ec5fdde20117aae74bbad3f4acb3dc3fc03319f1aa083
K₂(LiMc)O(I)H₉(Cm₆Cr₄DbDsF₈MgOs₇Po₆Ti)Md(Bi₂)
85%
Embedded ransomware token and malicious PE
657f78fc8b9fb74c65fb06989515e8cc5fa38e81e16952112a7e99e92c2a4e69
✓
O₇(As₅S₆C₂CaDyEuXe₂)H₆(Cm₇DbFOs₂Po₂U)Md(Pa₆)
85%
Obfuscated auth code with eval
85%
Obfuscated payload with XOR decoding
e2f93755154a6737868357464c043f48f888431e37dde6b7afabc373108dd7c2
✓
O₇(As₅S₆C₂CaDyEuXe₂)H₆(Cm₈DbFOs₂Po₂U)Md₂(Pa₆)
85%
Obfuscated auth code with eval
3de424e859253347da4fe1043a7e87c8fc0821c57f172709a24ab4a12d998158
K₂(McLi)O₅(C₂S₃CaAsXe)H₆(Cm₇Db₂FOsPo₂U)Md₂(Pa₇)
85%
Eval executes remote JSON content
943656d0e4b6edac58c074dec38e01d0d17bfb1cc910089109e8d9a551e05471
O(Co)H₅(DbF₅Os₅Po₄U)Md₃(Bi₃BkPt)
50%
Official Elixir installer
45196ec13bf4e3a1190951950ce5f56e2d6b3d2467d632a0058cc0942daacda4
K₃(AmLi₂Te₂)O₉(AlLaXe₂C₄Ca₃Co₂IP₂S₄)H₉(Cm₆₉Cr₇Db₃₀F₃₁Hf₂Os₂₄Po₃₁TiU₈)Md₄(Bk₂LiPa₆)
96%
Legitimate open-source project
18982f4347016deafc4c3a2bd0da6cb2c4f7e17ea22a8983a040ac9919c3ccca
K(Am)O₇(Al₂CDyErP₂PrXe₂)H₇(Cm₂Db₆F₅HfMgOs₅Po₆)Md₃(Bi₄BkSi₂)
35%
Legitimate software installer
09aeb1eb40e3f6735c65f9f5b5a8094da354f6a0e7dec5c11fa967264892898d
K₂(McTe₂)O₁₁(As₄C₅CoDy₃S₉Xe₃Ca₂Er₂Eu₂LaPr)H₅(Cm₂₇Db₇F₉Os₄Po₁₃)Md₄(BkPa₅Pt)
50%
Security scanner with test fixtures
7189ee6a4f831d8a882b6893d264e59b8d8d856034da0df03a983d0f2e415478
O₆(C₂CaS₃AsDyI)H₆(Cm₁₁CrDb₄F₂Os₃Po₄)Md₃(BkInPa₄)
80%
GitHub API data upload
1e758bdf56e5c6aeae4855d8a470d8b412e86ba6064510fa3d599d172147cb5a
K₃(Mc₂LiTe)O₁₁(As₇Eu₆I₅S₂₃Al₃C₁₇Ca₈Er₃Dy₃PrXe₂)H₇(F₈Cm₁₃CrDb₅OsPo₁₇Ti)Md₇(Pa₈Bk₂InPt)
50%
Security tool with malicious test fixtures
a4304e6164548471877ac2efeeb6c88abe19dbde154dd0c14d8ba5386f630aee
K(Mc)O₈(ErI₆C₄CaDy₂La₂As₂Eu)H₁₀(Po₆Cm₁₃Cr₇Db₅DsF₃HfMgOs₉U)Md₃(Bi₂)
85%
Hostile finding: ransomware encryptor detected
e2742e74cd01e7b4778ba9dfecb3f1a4ee59806cffcd108edc3b5a7af736dfca
O₆(IPAsCEuLa)H₆(Cm₁₃Cr₅Db₄F₅Os₃Po₃)Md₂(Bi)
85%
XMR mining pool reference found
b85a88df449a003b4026f10aceb1f52d63eced1c03115252dbc42c9ff0513557
K₃(Mc₂LiTe)O₁₁(As₇Eu₆I₅S₂₃Al₃C₁₇Ca₈Er₃Dy₃PrXe₂)H₇(F₈Cm₁₃CrDb₅OsPo₁₇Ti)Md₇(Pa₈Bk₂InPt)
50%
Security tool testing malicious patterns
3b3e238be9681058cbe455ce2182b731d230ea0b23317721c8011497f887ba9b
O₁₁(As₂Er₃C₇LaP₅PrCaCo₂DyIS)H₇(Cm₁₆Cr₈Db₉F₆Os₄Po₉U₂)Md₃(Bi₂)
85%
Contains eBPF rootkit deployment strings
0dd42acca3522de1ddfc469e58101d3fbadf5d402ea2e57e9daa9d9b0dfdc40a
O₁₁(As₂Er₃C₇LaP₅PrCaCo₂DyIS)H₇(Cm₁₆Cr₈Db₉F₆Os₄Po₉U₂)Md₃(Bi₂)
85%
Contains eBPF rootkit deployment strings
a4c2c6554d5dbe5ecdde53f0c0d8ee62eb1618a04f52694bddaf017abc261566
O₁₀(As₂Er₃LaP₅C₆CaCo₂DyIS)H₇(Cm₁₆Cr₈Db₉F₆Os₄Po₉U₂)Md₃(Bi₂)
85%
Contains eBPF rootkit deployment strings
14885b5b5284a67672e1c0abd2371758a1968b3e1c22450d6c95491fe28b7ad8
O₈(P₃As₅C₂I₃LaAlDyEr₆)H₉(Cm₁₄DbDs₂F₁₂Hf₂Os₂Po₇Ti₂U)Md₆(Bi₄BkHeSi₄)
80%
Persistence mechanisms and shell scripts
4dd52853e93a01bb47781301a85821cce0e076798618530bd5da21662efc7b3e
O₇(P₃As₅C₂I₃LaDyEr₅)H₉(Cm₁₄Db₂Ds₂F₁₂Hf₂Os₂Po₇Ti₂U)Md₅(Bi₄BkHeSi₃)
80%
Java app with persistence and exec
fd8e8f82e1865fe3a0f6434f0ddb2095ef98a381f75b25f93dbd60654e71f991
O₉(P₂As₅Er₆I₂Al₂C₂DyEuXe)H₉(Cm₁₃Db₂Ds₂F₁₅Hf₃Os₅Po₁₀Ti₂U₂)Md₄(Bi₄He₂Si₃)
80%
Persistence mechanisms and command execution
fc3d4f337ae080cce271f2b9aed602e9b576a75c700a54979e5a375b2ff9b1a7
K₂(LiTe)O₁₄(As₁₂C₁₉Dy₄Al₃Ca₈Co₃Er₆Eu₄I₅P₆S₁₄Xe₇La₂Pr)H₈(F₂₄Cm₃₈Cr₅Db₁₇Os₁₄Po₃₀Ti₂U₂)Md₈(Pa₁₂Bi₂Bk₄InLi₂Pt)
85%
Multiple high-severity malicious behaviors detected
dc3888365b491897cf790e637bd9ab9e7b9d3378696d0faf3530f3c98af186b8
O₁₁(S₁₀As₂C₉Ca₂Dy₄Er₂EuI₂P₃PrXe₂)H₇(Cm₂₂CrDb₃F₁₇Os₁₂Po₂₁U)Md₇(BiBk₂InLiPa₆Pt)
85%
Header claims VSCode extension exfiltrates files
4a8c1527b4bc526d01ba862c373ba9e027284040e774b8394886075356ae4abc
O(As)Md₂(Bi₃Si₂)
85%
Hostile indicators in packed binary
63fa0a2dedfb88838f38c744ed3167b837736f3df3af2d020dd02af7d3a96268
O₈(As₂Er₂IP₂Xe₅C₂PrS)H₆(Cm₆CrDbF₆OsPo₉)Md(Bk)
48%
Legitimate SBT build tool source code
b59248324a8740490c7b57f770fc584f52f6d613c6601809e8e906c0fee3f9fd
O₆(CAlDy₂ErIPr)H₄(DbF₂Os₇Po₇)Md₂(Bi₃Si₂)
80%
PEB walk and dynamic API resolution
35a8e9cc373597cbfd94100a4f5e01a2cbf2f01b63a78efce0fad517ee6b7941
K(Te)O₁₀(As₁₁C₁₄Co₂Dy₃Er₉I₄P₆CaEuXe₃)H₇(Po₂₃Cm₂₂Db₆Ds₂F₂₄Os₁₁U)Md₅(BiBkPt)
80%
False positives in legitimate source code
d31f6f0bcc2f89f148e0feed4b402b953cde9c7a8fda83bb2f45eceda7853ab5
O₁₁(As₁₅C₁₀ErLaXe₄Al₂CoDy₂EuPS)H₇(Cm₂₂Cr₃Db₁₇F₁₂Os₆Po₁₀U₂)Md₄(LiPd)
85%
Contains PHP webshell and RCE
21b126ba82829633072836bb67df5fbbe1dd08ec1afc3b2483c886efc9f72515
O₃(C₂AsDy₂)H₄(F₂Os₄Po₄U)Md₃(Bi₅Si₂)
80%
ShellObject stub marker detected
caf3a9ecf2b0e0bb9a9550323408cfb615671194f63a1a27e2b39ad64c9d230f
K(Te₂)O₁₃(As₈C₉Ca₄S₇Al₃Dy₃Er₅Eu₄I₃P₅PrCoXe)H₇(Cm₂₉F₂₀Cr₄Db₁₄HfOs₁₁Po₁₆)Md₅(Bk₂Pa₆Pt)
50%
Security tool testing malicious payloads
f17257a4bd7496205cc1e268e04b3a90aa42c2e53b150cb5cdd545f30b3c1bb1
K(Te)O₃(As₂C₄S)H₅(Cm₉Db₇F₆Os₃Po₉)Md₃(BkPa₅)
50%
Legitimate GitHub Action with test data
63e63a0b3507324ac043636118e1163fc6ae94a737d8b2820fa7f26557e0e159
K(Mc)O₁₄(C₉Eu₄As₈Ca₆CoDy₆Er₅I₆La₂P₉S₅Xe₅AlPr₂)H₁₀(Db₂₁F₂₄Os₁₆Cm₂₉Cr₅Ds₂HfPo₂₅Ti₂U₂)Md₆(BiBk₂Pa₁₄Pt)
50%
Legitimate CockroachDB source code archive
f580d0cdba1b716eea40b03278ee0f8d42819dafb8f0e7a924afec9ecf5134e3
O₆(Er₃ISC₂PrXe)H₅(F₄Cm₂CrOs₄Po₁₀)Md₃(BkPt)
48%
Legitimate open-source music player source code
f05ae7fe446d8ea3b684a5c9efbc6394d8dcaafdadd2a26c45d3f5bc91b5f13d
O₉(As₄C₈Er₂S₅CoDyEuP₂Xe₆)H₁₀(F₁₉Cm₂₂Cr₂Db₃DsHfOs₁₈Po₂₄TiU)Md₁₀(Pa₁₅Bi₂Bk₃HeInPdPtSi₄)
47%
Legitimate Tauri framework source code
40b4b736071377dd11e9637c02ae956797faa6f497e8401012aaa8870d283303
K(Te₂)O₉(SAs₅C₂Ca₂Eu₂PDy₂ErXe₂)H₆(Po₄Cm₁₂Cr₂Db₁₀F₁₁Os₄)Md₃(Bk₂)
49%
Legitimate security scanner source code
70d800f6b5d5f380f12d16fbfccf7ec19e77fb13335d529b12e1a01b4d30b4bb
K₂(LiMc)O₁₄(Er₁₀Al₅As₅CaI₃P₃Pr₃S₂C₉CoDy₆EuLa₃Xe)H₉(Cm₂₀Cr₃Db₇DsF₂₁Mg₂Os₂₄Po₁₇Ti)Md₆(Bi₄Bk₃He₂Pa₂Pt)
85%
Embedded eBPF rootkit binary detected
efbf018a3f28ce00c9175734c1d53f799adb888759e753c9912288e5893dd5dc
O₅(XeAsCDyEr)H₇(CmDb₂F₁₀HfMgOsPo₆)Md₃(Bi₂He)
50%
Legitimate KernelSU root manager binary
ffb4a07976073d079a5c56717a785e27a4167dff4cf7b755db66b24ff1e3e588
O₁₀(As₄S₃C₅Er₆ICoDyEuLaXe)H₇(Cm₁₁CrDb₇F₈Os₄Po₁₀U)Md₄(Bi₄Bk₂Pt)
80%
Unofficial firmware with backdoor references
80db0316387794ce9d14ed376da75b8a7742972485b45db790f5f8260307ff98
K(Te₂)O₁₀(C₄Er₇As₁₁Dy₂EuAl₄CaCo₃ILa)H₁₁(Db₈Cm₁₁Cr₅DsF₁₄HfMgOs₉Po₁₃TiU)Md₆(Bi₇He₂PaPdPt₂)
85%
Hostile findings in hashcat.exe
a5ca61ef9db2753c552bd2b674cf5e8dcdeac19f147bdfb57555f78da192511b
K(Te₂)O₁₂(C₈Er₂Al₂Ca₄Co₄Eu₄I₃La₂AsDy₂Pr₂Xe)H₉(Cm₂₃Hf₃Po₆Cr₆Db₃DsF₄Os₁₀U)Md₃(Bi₂)
85%
Malicious strings and RAT capabilities detected
6a76720bf1dd2de0895b1f1651c147b58765d21ae0641bfb3a7711ab28b08ae1
K(Te)O₁₂(AlAs₃Ca₄Co₃Dy₄Er₄La₂P₃C₇IPrS)H₈(Cm₁₆Db₆Os₅CrDs₂F₁₄Po₁₈U)Md₆(Bi₂BkSi₃)
85%
Browser credential harvesting and infostealer behavior
872de04ff29cfc66bcad5ea2166b0a78c74ec823ca7bb39d3ecec66e06219f20
K(Te)O₁₂(AlAs₃Ca₄Co₃Dy₄Er₄La₂P₃C₇IPrS)H₈(Cm₁₆Db₆Os₅CrDs₂F₁₄Po₁₈U)Md₆(Bi₂BkSi₃)
85%
Browser credential harvesting and infostealer behavior
96f2dbaa39bdf99c21cebde58a727d75f1964979282121db07e7d037b9ae40dc
K(Te)O₁₃(AlAs₃Ca₄Co₃Dy₄Er₄I₂La₂P₃C₇PrSXe)H₈(Cm₁₆Db₅Os₅CrDs₂F₁₄Po₁₇U)Md₆(Bi₂BkSi₃)
85%
Browser credential harvesting and infostealer behavior
a5250d450458408446db116fc4ca8d566a0edf3492fc316e4adb4936fd11bce5
K(Te)O₁₂(AlAs₃Ca₄Co₃Dy₄Er₄La₂P₃C₇IPrS)H₈(Cm₁₆Db₅Os₅CrDs₂F₁₄Po₁₈U)Md₆(Bi₂BkSi₃)
85%
Browser credential harvesting and infostealer behavior
ee47292ace912c885349a3c12ff0a7a2f17af94a818e1f9f65853de844163e34
K(Te)O₁₂(AlAs₃Ca₄Co₃Dy₄Er₄La₂P₃C₇IPrS)H₈(Cm₁₆Db₆Os₅CrDs₂F₁₄Po₁₈U)Md₆(Bi₂BkSi₃)
80%
Browser credential harvesting and shell injection
4c8aceccbe82217a556b57c59ff31b90a15e4e39746705b19002bcfadd5466e2
K(Te)O₁₂(AlAs₃Ca₄Co₃Dy₄Er₄La₂P₃C₇IPrS)H₈(Cm₁₆Db₆Os₅CrDs₂F₁₄Po₁₈U)Md₆(Bi₂BkSi₃)
85%
Browser credential harvesting and infostealer behavior
7ff6c1c1e4ba775f662941c0969035b7426f52fb07341d5aa7f64cd4fdc80834
K(Te)O₁₂(AlAs₃Ca₄Co₃Dy₄Er₄La₂P₃C₇IPrS)H₈(Cm₁₆Db₅Os₅CrDs₂F₁₄Po₁₈U)Md₆(Bi₂BkSi₃)
85%
Browser credential harvesting and infostealer behavior
9bf62dda7fb9b4f51aa3338dc8b93c47c9a0ca101709ec69c55f6261983fcef6
K(Te)O₁₂(AlAs₃Ca₄Co₃Dy₄Er₄La₂P₃C₇IPrS)H₈(Cm₁₆Db₅Os₅CrDs₂F₁₄Po₁₈U)Md₆(Bi₂BkSi₃)
85%
Browser credential harvesting and keylogging
a01b507615396d3c19df51fcd5c564aa6a65dde2be450054e7f74e51a8866c99
K(Te)O₁₂(AlAs₃Ca₄Co₃Dy₄Er₄La₂P₃C₇IPrS)H₈(Cm₁₅Db₅Os₅CrDs₂F₁₄Po₁₇U)Md₆(Bi₂BkSi₃)
80%
Browser credential harvesting and shell history theft
ea1791c5a9dea4b109ba1adb541b1b87930dcb21f1ce1505a6eb50284c9e4030
K(Te)O₁₂(AlAs₃Ca₄Co₃Dy₄Er₄La₂P₃C₇IPrS)H₈(Cm₁₆Db₆Os₅CrDs₂F₁₄Po₁₈U)Md₆(Bi₂BkSi₃)
85%
Browser credential harvesting and infostealer behavior
80afcbaef90c68f95a9b9c3520c802e6bccfcded62b99bd84ce32a47177108ce
O₅(PPrCoDyEr)H₈(Cm₁₈CrDb₃DsF₁₀Hf₂Os₈Po₇)Md₄(BiBkSi₄)
33%
Legitimate macOS system monitoring application
58f18c8f5dd0915a8a243dc2dfab87f5f4341c3383d8c1ffeee31f64e412dc54
K(Te)O₉(CaDy₂Er₂AlAsCCo₂PPr)H₁₀(Cm₂₂CrDb₁₀Ds₂F₂₅HfOs₁₂Po₂₂TiU₃)Md₆(BiBkSi₃)
37%
Browser credential harvesting and token extraction
7f97f2a1b6281d0ec7079a2ac6774875b4d9e6e63013efd809a276909748c268
K(Te)O₁₂(AlAs₃Ca₄Co₃Dy₄Er₄La₂P₃C₇IPrS)H₈(Cm₁₅Db₅Os₅CrDs₂F₁₄Po₁₇U)Md₆(Bi₂BkSi₃)
80%
Browser credential harvesting and shell history theft
38cb0396c93359240512c9f715d31a1b6ffc26ed195b7fbc36ff7f519b18b2c6
K(Te)O₁₂(AlAs₃Ca₄Co₃Dy₄Er₄I₂La₂P₃C₇PrXe)H₈(Cm₁₆Db₆Os₅CrDs₂F₁₄Po₁₆U)Md₆(Bi₂BkSi₃)
85%
Browser credential harvesting and infostealer behavior
3a1c11fb9c4b6219a93f7fdb5761d48d2d0ac6409b10f83b125c531fdca5e16b
K(Te)O₁₂(AlAs₃Ca₄Co₃Dy₄Er₄La₂P₃C₇IPrS)H₈(Cm₁₅Db₅Os₅CrDs₂F₁₄Po₁₇U)Md₆(Bi₂BkSi₃)
85%
Browser credential harvesting and infostealer behavior
db9b94a688194f5f130e7e87fe5cb3096ebe2d53dee6f3bdd237e81386050138
K(Te)O₁₁(AlAs₃Ca₄Co₃Dy₄Er₄La₂P₃C₇IPr)H₈(Cm₁₆Db₆Os₅CrDs₂F₁₄Po₁₇U)Md₆(Bi₂BkSi₃)
85%
Browser credential harvesting and infostealer behavior
ec93e99dcc4162114f5a1cfda4d0da1429143fa27b3d565fb2c0cb0f79ac6d0e
K(Te)O₁₂(AlAs₃Ca₄Co₃Dy₄Er₄I₂La₂P₃C₇PrXe)H₈(Cm₁₆Db₆Os₅CrDs₂F₁₄Po₁₆U)Md₆(Bi₂BkSi₃)
85%
Browser credential harvesting and persistence
ee772b0f3e26749905ea885f61d3566f9062d244705fc3c880563d42e077f145
K(Te)O₁₂(AlAs₃Ca₄Co₃Dy₄Er₄La₂P₃C₇IPrS)H₈(Cm₁₆Db₆Os₅CrDs₂F₁₄Po₁₇U)Md₆(Bi₂BkSi₃)
85%
Browser credential harvesting and infostealer behavior
f3ed1d84775a77ecac3fce4d5b31f23966423f3bce77febc7cedc298a8eff01e
K(Te)O₁₁(AlAs₃Ca₄Co₃Dy₄Er₄La₂P₃C₇IPr)H₈(Cm₁₅Db₅Os₅CrDs₂F₁₄Po₁₇U)Md₆(Bi₂BkSi₃)
80%
Browser credential harvesting and shell injection
393413915213aa2f724fb01c0fe01c48910323c2501c746bf43ad87b1174bbf1
K(Te)O₁₂(AlAs₃Ca₄Co₃Dy₄Er₄La₂P₃C₇IPrS)H₈(Cm₁₅Db₅Os₅CrDs₂F₁₄Po₁₇U)Md₆(Bi₂BkSi₃)
85%
Browser credential harvesting and infostealer behavior
a2fbff8184c994318b13bdf4bec80d5441bfbf94d5284b32f22c25df22d789e1
K(Te)O₁₁(AlAs₃Ca₄Co₃Dy₄Er₄La₂P₃C₇IPr)H₈(Cm₁₆Db₆Os₅CrDs₂F₁₄Po₁₇U)Md₆(Bi₂BkSi₃)
85%
Browser credential harvesting and infostealer behavior
57877a56182683398109f7c9b2028ac7064881f2ad3f1748021ffeab5b0c1e93
K(Te)O₁₂(AlAs₃Ca₄Co₃Dy₄Er₄La₂P₃C₇IPrS)H₈(Cm₁₅Db₅Os₅CrDs₂F₁₄Po₁₇U)Md₆(Bi₂BkSi₃)
85%
Browser credential harvesting and infostealer behavior
b0857e9d58cec4e6b8821dd400d8b4c28839757f2d2ce9494427f5d541664b2e
K(Te)O₁₁(AlAs₃Ca₄Co₃Dy₄Er₄La₂P₃C₇IPr)H₈(Cm₁₆Db₆Os₅CrDs₂F₁₄Po₁₇U)Md₆(Bi₂BkSi₃)
85%
Browser credential harvesting and infostealer behavior
33777097f666d60d78bfb74df06978c933f32aa5a0d4ce0b0c5d028489984187
O₁₂(As₄Ca₃S₄AlC₃Er₅EuI₂LaDy₄P₂Xe₂)H₁₀(Cm₂₀Cr₈Db₁₀DsF₁₇HfMgOs₁₂Po₁₁U)Md₅(BiBkPt)
49%
Legitimate Caddy web server source code
390ff9e3f238904d57e57e94bdacd291aa35ebc48a536a2d273a9373b96be3a1
O₈(Ca₂DyErLaAlAsC₂Eu₂)H₇(Cm₁₃Cr₆DbF₃Os₂Po₄U)Md₃(BiLi)
85%
Contains malicious embedded archive member
ea874696bab7fcb0b877226c06b1c8c0ac6dd3989cdcf6a00fc8f75d75069446
K(Li)O₇(AsCCo₂ErI₂DyP₂)H₉(Os₃Cm₁₃Cr₂Db₂DsF₉HfPo₂U)Md₅(BiBk₂HeSi₃)
80%
Self-deletion via AppleScript
1306a55f31ca02cd76ab96596b623304d52b737a20de600c544b61765674ff8a
O₂(AlEr)H₂(Os₂Po)Md₂(Bi₃Si₂)
48%
Legitimate signed installer
1875421b1f30cbcc6300c4502c072bff2f27febe6b77eb1b91204507d01e6f89
O(As)H₃(CrDbU)Md₃(Bi₄He)
48%
Legitimate AppImage binary
be153d9c7486278501802a5df5b164af6872e166b1c53f963dc2b456a921742e
O₂(AlEr)H₂(Os₂Po)Md₂(Bi₃Si₂)
48%
Legitimate signed installer
25970564b6094e56b7bcccae18d305cdad51c82f7de6e5004fb88f08a3ba1cde
O(As₃)H₃(CmF₂Po)Md₂(Bi₃Si₃)
80%
High entropy, direct execve, ad-hoc signature
0215cb684307feda78c3d9e9e8168a874287607e6a57b985657338656c5dfe4a
O(As₃)H₃(CmFPo)Md(Bi₃)
38%
High entropy, direct execve usage
43a3e51645481048766672c461265e8c5f6e2595e09dda969d09bbeaaeab0c0d
K₃(AmLiTe₂)O₇(XeEr₂C₂CoDyLaP)H₁₁(Cm₄₄Cr₁₁Db₁₅Ds₂F₂₄Hf₃MgOs₁₆Po₂₅Ti₂U₄)Md₁₀(Bi₃Bk₂HeLiPa₅PtSi₅)
67%
legitimate mobile testing framework
08b6cb2bd20f3d19e3cf6e768d8d8105c8337de1c52e90c7dc1deea483d68c86
O₂(Al₄As)H₆(Cm₂CrF₃Os₂Po₆Ti)Md(Pa)
80%
Rust linter with SSH and shell references
4446ecc2309cd831894f0ffd486892b7d1855b15651d050b00897bef94ebdbdd
O(S)H₅(Cm₁₅Db₁₀F₄Os₅Po₅)Md₂(Bk)
63%
AI agent permission bypass
b63d2d3b737280ead40f30c11adb794fd2186d7d0ee675e2f3b94e82f15fd6e9
K₂(LiTe)O₁₃(C₁₇Dy₄AlAs₁₁Ca₆Er₇Eu₃I₄P₆S₁₃Xe₇CoLa₂)H₈(F₂₄Cm₃₅Cr₅Db₁₅Os₁₄Po₂₉Ti₂U₂)Md₈(Pa₁₂Bi₂Bk₃InLiPt)
85%
Reverse shells and exfiltration detected
7f77ccf3613ddadc74dfb8d6f8082581a8835115a25e1307d189f03aa750893e
K₂(Li₂Mc₃)O₁₄(C₂₂P₇S₁₅Al₇As₁₉Dy₆Er₁₂I₈Xe₁₁Ca₄Co₃Eu₂LaPr₂)H₁₀(Os₃₀Cm₄₅Cr₃Db₂₅Ds₃F₃₁HfMgPo₃₈U₄)Md₇(Pa₁₃BiBk₃PdPt)
85%
Hostile findings in legitimate source archive
301b99f548aa021e244ccad0ab14537f1c2b3c42acd8bf8ac0d62b4bfdd9f2ba
80%
Malformed binary header detected