Hostile ^92% Download

language_server

CDP, credential theft, obfuscation

Unix-domain socket listener redirects stdio to a shellAllows JIT-compiled executable memory

SHA-256c5e7507280d836244417c3f2e27917ec30b728e47ff365dd1dd0db98e4d3595a

MaleculeK₄(Am₂Li₂McTe)O₈(C₃AlAs₄Ca₂Er₂ILaP₂)H₁₁(Cm₄₄Cr₁₁Db₁₂Ds₃F₂₂HfMg₂Os₁₆Po₈TiU₅)Md₈(Bi₃BkHePtSi₃)

Evidence

References the /bin/sh shell path 0x2214dfb–0x2214fdb

⋯13 more rows
0x2214ecb6465677265656d6f7374726172636d64degreemostrarcmd
0x2214edb2e72756e2f62696e2f7368506c617969.run/bin/shPlayi
0x2214eeb6e676265616d734f6e62706c61796572ngbeamsOnbplayer
⋯15 more rows

Native binary references Bash shell path 0x223a72d–0x223a8ad

⋯7 more rows
0x223a79d6973636f2e6c762f2e6c697665696d67isco.lv/.liveimg
0x223a7ad2f62696e2f626173682f686f6d652e69/bin/bash/home.i
0x223a7bd6d672f737761702e696d673c6e6f7474mg/swap.img<nott
⋯15 more rows

Native binary names a Unix-domain socket path 0x232e39c–0x232e52c

⋯7 more rows
0x232e40c6b65537562736372696265496e707574keSubscribeInput
0x232e41c2f72756e2f686170726f78792f61646d/run/haproxy/adm
0x232e42c696e2e736f636b666f72776172646564in.sockforwarded
0x232e43c50726f746f636f6c4865616465727065ProtocolHeaderpe
⋯15 more rows

Bind socket to address 0x6ebd421–0x6ebd711

0x6ebd4216354727573744576616c756174655769cTrustEvaluateWi
0x6ebd43174684572726f72005f53656354727573thError._SecTrus
0x6ebd4417453657456657269667944617465005ftSetVerifyDate._
0x6ebd4515f5f6572726f72005f5f65786974005f__error.__exit._
0x6ebd461616363657074005f6172633472616e64accept._arc4rand
0x6ebd4716f6d5f627566005f62696e64005f6368om_buf._bind._ch
0x6ebd481646972005f63686d6f64005f6368726fdir._chmod._chro
0x6ebd4916f74005f636c6f636b5f67657474696dot._clock_gettim
0x6ebd4a165005f636c6f7365005f636c6f736564e._close._closed
0x6ebd4b16972005f636f6e6e656374005f647570ir._connect._dup
0x6ebd4c1005f64757032005f657865637665005f._dup2._execve._
0x6ebd4d1666163636573736174005f6663686469faccessat._fchdi
0x6ebd4e172005f6663686d6f64005f6663686f77r._fchmod._fchow
0x6ebd4f16e005f66636e746c005f66646f70656en._fcntl._fdopen
0x6ebd501646972005f666c6f636b005f666f726bdir._flock._fork
0x6ebd511005f6672656561646472696e666f005f._freeaddrinfo._
0x6ebd5216673746174005f66737461746174005ffstat._fstatat._
0x6ebd5316673796e63005f667472756e63617465fsync._ftruncate
0x6ebd541005f6761695f7374726572726f72005f._gai_strerror._
0x6ebd55167657461646472696e666f005f676574getaddrinfo._get
0x6ebd561637764005f67657467726769645f7200cwd._getgrgid_r.
0x6ebd5715f6765746e616d65696e666f005f6765_getnameinfo._ge
0x6ebd58174706565726e616d65005f6765747069tpeername._getpi
0x6ebd59164005f67657470776e616d5f72005f67d._getpwnam_r._g
0x6ebd5a1657470777569645f72005f676574726cetpwuid_r._getrl
0x6ebd5b1696d6974005f67657472757361676500imit._getrusage.
0x6ebd5c15f676574736f636b6e616d65005f6765_getsockname._ge
0x6ebd5d174736f636b6f7074005f676574756964tsockopt._getuid
0x6ebd5e1005f696f63746c005f69737365747567._ioctl._issetug
0x6ebd5f16964005f6b4346416c6c6f6361746f72id._kCFAllocator
0x6ebd60144656661756c74005f6b6576656e7400Default._kevent.
0x6ebd6115f6b696c6c005f6b7175657565005f6c_kill._kqueue._l
0x6ebd621697374656e005f6c7365656b005f6c73isten._lseek._ls
0x6ebd631746174005f6d6163685f6162736f6c75tat._mach_absolu
0x6ebd64174655f74696d65005f6d6163685f7461te_time._mach_ta
0x6ebd651736b5f73656c665f005f6d6163685f74sk_self_._mach_t
0x6ebd661696d65626173655f696e666f005f6d61imebase_info._ma
0x6ebd67163685f766d5f726567696f6e005f6d61ch_vm_region._ma
0x6ebd6816476697365005f6d6b646972005f6d6cdvise._mkdir._ml
0x6ebd6916f636b005f6d6c6f636b616c6c005f6dock._mlockall._m
0x6ebd6a16d6170005f6d756e6d6170005f6e6f74map._munmap._not
0x6ebd6b16966795f69735f76616c69645f746f6bify_is_valid_tok
0x6ebd6c1656e005f6f70656e005f6f70656e6174en._open._openat
0x6ebd6d1005f70617468636f6e66005f70697065._pathconf._pipe
0x6ebd6e1005f7072656164005f70726f635f7265._pread._proc_re
0x6ebd6f167696f6e66696c656e616d65005f7074gionfilename._pt
0x6ebd70168726561645f617474725f6765747374hread_attr_getst
0x6ebd71161636b73697a65005f70746872656164acksize._pthread

Imports POSIX socket creation API 0x6ebd81d–0x6ebdafd

0x6ebd81d6561645f73656c66005f707468726561ead_self._pthrea
0x6ebd82d645f7365747370656369666963005f70d_setspecific._p
0x6ebd83d7468726561645f7369676d61736b005fthread_sigmask._
0x6ebd84d707472616365005f707772697465005fptrace._pwrite._
0x6ebd85d7261697365005f72656164005f726561raise._read._rea
0x6ebd86d646469725f72005f726561646c696e6bddir_r._readlink
0x6ebd87d005f726561646c696e6b6174005f7265._readlinkat._re
0x6ebd88d637666726f6d005f726563766d736700cvfrom._recvmsg.
0x6ebd89d5f72656e616d65005f7265735f395f6e_rename._res_9_n
0x6ebd8ad636c6f7365005f7265735f395f6e696eclose._res_9_nin
0x6ebd8bd6974005f7265735f395f6e7365617263it._res_9_nsearc
0x6ebd8cd68005f726d646972005f73656e646669h._rmdir._sendfi
0x6ebd8dd6c65005f73656e646d7367005f73656ele._sendmsg._sen
0x6ebd8ed64746f005f736574676964005f736574dto._setgid._set
0x6ebd8fd67726f757073005f7365746974696d65groups._setitime
0x6ebd90d72005f73657470676964005f73657472r._setpgid._setr
0x6ebd91d6c696d6974005f736574736964005f73limit._setsid._s
0x6ebd92d6574736f636b6f7074005f7365747569etsockopt._setui
0x6ebd93d64005f73687574646f776e005f736967d._shutdown._sig
0x6ebd94d616374696f6e005f736967616c747374action._sigaltst
0x6ebd95d61636b005f736f636b6574005f737461ack._socket._sta
0x6ebd96d74005f73796d6c696e6b005f73797363t._symlink._sysc
0x6ebd97d6f6e66005f73797363746c005f737973onf._sysctl._sys
0x6ebd98d63746c62796e616d65005f756e6c696ectlbyname._unlin
0x6ebd99d6b005f756e6c696e6b6174005f75736ck._unlinkat._usl
0x6ebd9ad656570005f7761697434005f77726974eep._wait4._writ
0x6ebd9bd65005f777269746576005f7870635f64e._writev._xpc_d
0x6ebd9cd6174655f6372656174655f66726f6d5fate_create_from_
0x6ebd9dd63757272656e74005f6d656d63707900current._memcpy.
0x6ebd9ed5f6d616c6c6f63005f66726565005f68_malloc._free._h
0x6ebd9fd6f73745f70726f636573736f725f696eost_processor_in
0x6ebda0d666f005f686f73745f73746174697374fo._host_statist
0x6ebda1d696373005f6d6163685f686f73745f73ics._mach_host_s
0x6ebda2d656c66005f766d5f6465616c6c6f6361elf._vm_dealloca
0x6ebda3d7465005f5f5f73746465727270005f61te.___stderrp._a
0x6ebda4d626f7274005f6670757463005f667772bort._fputc._fwr
0x6ebda5d697465005f76667072696e7466005f70ite._vfprintf._p
0x6ebda6d7468726561645f636f6e645f62726f61thread_cond_broa
0x6ebda7d6463617374005f736574656e76005f75dcast._setenv._u
0x6ebda8d6e736574656e76005f667072696e7466nsetenv._fprintf
0x6ebda9d005f6e616e6f736c656570005f707468._nanosleep._pth
0x6ebdaad726561645f617474725f64657374726fread_attr_destro
0x6ebdabd79005f707468726561645f617474725fy._pthread_attr_
0x6ebdacd736574737461636b73697a65005f7074setstacksize._pt
0x6ebdadd68726561645f6765745f737461636b61hread_get_stacka
0x6ebdaed6464725f6e70005f707468726561645fddr_np._pthread_
0x6ebdafd6765745f737461636b7369          get_stacksi     