Benign Download

hexium_gemini.ko.zst

Infostealer 'grabber' slang termSuspicious repository name keywords
SHA-256907349b923e13f64301a031857e2962fbec9e3b6b2441f593d7d6904975109fe
MaleculeO₂(AsC)

Evidence

Repeated NOP-run pattern in executable section 0x130–0x180
0x13000000000000000000000000000000000................
0x14090909090909090909090909090909090................
0x150e800000000554889e54154534889fb4c.....UH..ATSH..L
0x1608ba7c0010000f6050000000004740266.............t.f
0x170904889de498d7c2408e8000000004889.H..I.|$......H.
0x180dfe800000000498dbc24c004000083 ......I..$.....
Infostealer 'grabber' slang term 0x1e65–0x1e95
0x1e656d2067656d696e6927206672616d6520m gemini' frame
0x1e75677261626265722d25640a0000000000grabber-%d......
0x1e850000002f6275696c642f6c696e75782d.../build/linux-
0x1e956971566e6b6a2f iqVnkj/
GPL license reference 0x234a–0x237a
0x234ac031ffe9000000006c6963656e73653d.1......license=
0x235a47504c00617574686f723d4d69636861GPL.author=Micha
0x236a656c2048756e6f6c64203c6d69636861el Hunold <micha
0x237a656c40 el@

No evidence locations were recorded for this file. Raw result

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.