Is @gravitykit/gravitymcp safe to use?

@gravitykit/gravitymcp has a security risk score of 100/100 (CRITICAL risk). Our security analysis detected 351 findings. Review the detailed security assessment below to understand the specific risks before installation.

What are the security risks of @gravitykit/gravitymcp?

Based on our automated security analysis, @gravitykit/gravitymcp presents critical risk level. The extension is analyzed for malware patterns, secret exposure, network communications, permissions, and supply chain vulnerabilities.

How is the security score calculated?

Risky Plugins calculates security scores using weighted categories: severity of findings (25 points max), malware detections (35 points), secret exposure (28 points), network communications (10 points), and obfuscation (10 points). Scores range from 0-100, with higher scores indicating greater risk.

What does CRITICAL, HIGH, MEDIUM, LOW, MINIMAL risk mean?

CRITICAL (80-100): Severe security issues like malware. HIGH (60-79): Significant vulnerabilities. MEDIUM (40-59): Moderate security concerns. LOW (20-39): Minor issues. MINIMAL (0-19): Very low risk. Always review findings before installing any extension.

Is "@gravitykit/gravitymcp" on MCP Registry Safe to Install?

Name: @gravitykit/gravitymcp
Availability: InStock
Author: gravitykit

gravitykit · mcp · v1.4.1

Full-featured MCP server for Gravity Forms

Risk Assessment

Analyzed

100

out of 100

CRITICAL

351 security findings detected across all analyzers

MCP server analyzed for tool poisoning, prompt injection, and data exfiltration

Severity Breakdown

Critical

117

High

176

Medium

Low

Info

Finding Categories

117

Malware Signatures

Secrets

Network

172

IoC Indicators

YARA Rules Matched

12 rules(117 hits)

postinstall file manipulation NoUseWeakRandom postinstall crypto operations postinstall network communication credential env files postinstall obfuscation postinstall registry modification UsingShellInterpreterWhenExecutingOSCommands postinstall system command UsingCommandLineArguments postinstall file download postinstall persistence mechanism

MCP Server Analysis

MCP servers expose tools and resources to AI assistants. Unlike browser extensions, they run as standalone processes with direct system access. Tool definitions are analyzed for prompt injection, data exfiltration, and tool poisoning patterns.

About This Extension

Full-featured MCP server for Gravity Forms

Detailed Findings

177 total

YARA Rule Matches

12 rules

Indicators of Compromise

Network indicators, suspicious strings, and potential IoCs extracted during analysis

URLs

Domains

129

Strings

172

All Indicators · 172

Domain

detected Domain: result.feed.is

XIOC detected Domain: result.feed.is

extracted_from_files

Domain

detected Domain: docs.gravityforms.com

XIOC detected Domain: docs.gravityforms.com

extracted_from_files

Domain

detected Domain: registry.date

XIOC detected Domain: registry.date

extracted_from_files

Domain

detected Domain: result.entry.id

XIOC detected Domain: result.entry.id

extracted_from_files

Domain

detected Domain: agents.md

XIOC detected Domain: agents.md

extracted_from_files

Domain

detected Domain: github.com

XIOC detected Domain: github.com

extracted_from_files

Domain

detected Domain: test.yoursite.com

XIOC detected Domain: test.yoursite.com

extracted_from_files

Domain

detected Domain: www.yourwebsite.com

XIOC detected Domain: www.yourwebsite.com

extracted_from_files

Domain

detected Domain: www.gravitykit.com

XIOC detected Domain: www.gravitykit.com

extracted_from_files

Domain

detected Domain: emailfield.id

XIOC detected Domain: emailfield.id

extracted_from_files

Domain

detected Domain: yoursite.com

XIOC detected Domain: yoursite.com

extracted_from_files

URL

detected URL: https://api.example.com/v1/resource?api_key=secret123&token=tok_456789&public=true';

XIOC detected URL: https://api.example.com/v1/resource?api_key=secret123&token=tok_456789&public=true';

extracted_from_files

URL

detected URL: https://site.com/wp-json/gf/v2/forms/1/entries?page=2&per_page=10';

XIOC detected URL: https://site.com/wp-json/gf/v2/forms/1/entries?page=2&per_page=10';

extracted_from_files

URL

detected URL: https://example.com'

XIOC detected URL: https://example.com'

extracted_from_files

URL

detected URL: https://example.com/uploads/file.pdf'

XIOC detected URL: https://example.com/uploads/file.pdf'

extracted_from_files

URL

detected URL: https://example.com/form?gf_token=abc123def456',

XIOC detected URL: https://example.com/form?gf_token=abc123def456',

extracted_from_files

URL

detected URL: https://example.com/uploads/file3.png'

XIOC detected URL: https://example.com/uploads/file3.png'

extracted_from_files

URL

detected URL: https://example.com/contact',

XIOC detected URL: https://example.com/contact',

extracted_from_files

URL

detected URL: https://test.example.com'

XIOC detected URL: https://test.example.com'

extracted_from_files

URL

detected URL: https://your-test-site.com');

XIOC detected URL: https://your-test-site.com');

extracted_from_files

URL

detected URL: https://site.com/api?consumer_key=ck_3f4d5e6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e&form_id=1';

XIOC detected URL: https://site.com/api?consumer_key=ck_3f4d5e6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e&form_id=1';

extracted_from_files

URL

detected URL: https://site.com/api?consumer_secret=cs_1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b';

XIOC detected URL: https://site.com/api?consumer_secret=cs_1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b';

extracted_from_files

URL

detected URL: https://site.com/wp-json/gf/v2/forms?ck_3f4d5e6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e';

XIOC detected URL: https://site.com/wp-json/gf/v2/forms?ck_3f4d5e6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e';

extracted_from_files

URL

detected URL: https://example.com/wp-json/gf/v2/forms',

XIOC detected URL: https://example.com/wp-json/gf/v2/forms',

extracted_from_files

URL

detected URL: https://example.com/wp-json/gf/v2/forms');

XIOC detected URL: https://example.com/wp-json/gf/v2/forms');

extracted_from_files

URL

detected URL: http://insecure.com',

XIOC detected URL: http://insecure.com',

extracted_from_files

URL

detected URL: https://example.com/'

XIOC detected URL: https://example.com/'

extracted_from_files

URL

detected URL: https://example.com',

XIOC detected URL: https://example.com',

extracted_from_files

URL

detected URL: https://example.com/uploads/file1.pdf',

XIOC detected URL: https://example.com/uploads/file1.pdf',

extracted_from_files

URL

detected URL: https://example.com/uploads/file2.jpg',

XIOC detected URL: https://example.com/uploads/file2.jpg',

extracted_from_files

URL

detected URL: https://github.com/GravityKit/GravityMCP#readme

XIOC detected URL: https://github.com/GravityKit/GravityMCP#readme

extracted_from_files

URL

detected URL: https://staging.yoursite.com');

XIOC detected URL: https://staging.yoursite.com');

extracted_from_files

URL

detected URL: https://test.example.com',

XIOC detected URL: https://test.example.com',

extracted_from_files

URL

detected URL: https://test.com'

XIOC detected URL: https://test.com'

extracted_from_files

URL

detected URL: http://insecure.com'),

XIOC detected URL: http://insecure.com'),

extracted_from_files

URL

detected URL: https://example.com');

XIOC detected URL: https://example.com');

extracted_from_files

URL

detected URL: http://example.com'

XIOC detected URL: http://example.com'

extracted_from_files

URL

detected URL: https://www.yoursite.com

XIOC detected URL: https://www.yoursite.com

extracted_from_files

URL

detected URL: https://staging.yoursite.com

XIOC detected URL: https://staging.yoursite.com

extracted_from_files

URL

detected URL: https://github.com/GravityKit/GravityMCP/issues)

XIOC detected URL: https://github.com/GravityKit/GravityMCP/issues)

extracted_from_files

URL

detected URL: https://docs.gravityforms.com/rest-api-v2/)

XIOC detected URL: https://docs.gravityforms.com/rest-api-v2/)

extracted_from_files

URL

detected URL: https://modelcontextprotocol.io/)

XIOC detected URL: https://modelcontextprotocol.io/)

extracted_from_files

URL

detected URL: https://github.com/GravityKit/GravityMCP.git

XIOC detected URL: https://github.com/GravityKit/GravityMCP.git

extracted_from_files

Domain

detected Domain: input.id

XIOC detected Domain: input.id

extracted_from_files

URL

detected URL: https://www.yourwebsite.com

XIOC detected URL: https://www.yourwebsite.com

extracted_from_files

URL

detected URL: https://test.yoursite.com

XIOC detected URL: https://test.yoursite.com

extracted_from_files

URL

detected URL: https://github.com/GravityKit/GravityMCP

XIOC detected URL: https://github.com/GravityKit/GravityMCP

extracted_from_files

URL

detected URL: https://img.shields.io/npm/v/@gravitykit/gravitymcp.svg)](https://www.npmjs.com/package/@gravitykit/gravitymcp)

XIOC detected URL: https://img.shields.io/npm/v/@gravitykit/gravitymcp.svg)](https://www.npmjs.com/package/@gravitykit/gravitymcp)

extracted_from_files

URL

detected URL: https://www.gravitykit.com)

XIOC detected URL: https://www.gravitykit.com)

extracted_from_files

URL

detected URL: https://yoursite.com

XIOC detected URL: https://yoursite.com

extracted_from_files

Domain

detected Domain: obj.map

XIOC detected Domain: obj.map

extracted_from_files

Domain

detected Domain: response.entries.map

XIOC detected Domain: response.entries.map

extracted_from_files

Other

detected Email: [email protected]

XIOC detected Email: [email protected]

extracted_from_files

Other

detected Email: [email protected]

XIOC detected Email: [email protected]

extracted_from_files

Other

detected Email: [email protected]

XIOC detected Email: [email protected]

extracted_from_files

URL

detected URL: https://local.gravityforms.test

XIOC detected URL: https://local.gravityforms.test

extracted_from_files

Domain

detected Domain: entry2.entry.id

XIOC detected Domain: entry2.entry.id

extracted_from_files

Domain

detected Domain: entry3.entry.id

XIOC detected Domain: entry3.entry.id

extracted_from_files

Domain

detected Domain: result.failures.map

XIOC detected Domain: result.failures.map

extracted_from_files

Domain

detected Domain: suite.name

XIOC detected Domain: suite.name

extracted_from_files

Domain

detected Domain: site.com

XIOC detected Domain: site.com

extracted_from_files

Domain

detected Domain: result.name

XIOC detected Domain: result.name

extracted_from_files

Domain

detected Domain: listformsschema.properties

XIOC detected Domain: listformsschema.properties

extracted_from_files

Domain

detected Domain: result.form.is

XIOC detected Domain: result.form.is

extracted_from_files

Domain

detected Domain: this.data

XIOC detected Domain: this.data

extracted_from_files

Domain

detected Domain: test.name

XIOC detected Domain: test.name

extracted_from_files

Domain

detected Domain: your-test-site.com

XIOC detected Domain: your-test-site.com

extracted_from_files

Domain

detected Domain: e.id

XIOC detected Domain: e.id

extracted_from_files

Domain

detected Domain: result.feeds.map

XIOC detected Domain: result.feeds.map

extracted_from_files

Domain

detected Domain: firstform.id

XIOC detected Domain: firstform.id

extracted_from_files

Domain

detected Domain: fieldtypesresult.total

XIOC detected Domain: fieldtypesresult.total

extracted_from_files

Domain

detected Domain: companyfield.id

XIOC detected Domain: companyfield.id

extracted_from_files

Domain

detected Domain: changelog.md

XIOC detected Domain: changelog.md

extracted_from_files

Domain

detected Domain: fieldtoupdate.id

XIOC detected Domain: fieldtoupdate.id

extracted_from_files

Domain

detected Domain: fieldtodelete.id

XIOC detected Domain: fieldtodelete.id

extracted_from_files

Domain

detected Domain: fieldregistry.email

XIOC detected Domain: fieldregistry.email

extracted_from_files

Domain

detected Domain: value.city

XIOC detected Domain: value.city

extracted_from_files

Domain

detected Domain: form.fields.map

XIOC detected Domain: form.fields.map

extracted_from_files

Domain

detected Domain: testform.id

XIOC detected Domain: testform.id

extracted_from_files

Domain

detected Domain: companyresult.field.id

XIOC detected Domain: companyresult.field.id

extracted_from_files

Domain

detected Domain: phoneresult.field.id

XIOC detected Domain: phoneresult.field.id

extracted_from_files

Domain

detected Domain: addressresult.field.id

XIOC detected Domain: addressresult.field.id

extracted_from_files

Domain

detected Domain: messageresult.field.id

XIOC detected Domain: messageresult.field.id

extracted_from_files

Domain

detected Domain: priorityresult.field.id

XIOC detected Domain: priorityresult.field.id

extracted_from_files

Domain

detected Domain: claude.md

XIOC detected Domain: claude.md

extracted_from_files

Domain

detected Domain: modelcontextprotocol.io

XIOC detected Domain: modelcontextprotocol.io

extracted_from_files

Domain

detected Domain: result.feed.meta.mappedfields.email

XIOC detected Domain: result.feed.meta.mappedfields.email

extracted_from_files

Domain

detected Domain: registry.email

XIOC detected Domain: registry.email

extracted_from_files

Domain

detected Domain: registry.select

XIOC detected Domain: registry.select

extracted_from_files

Domain

detected Domain: logger.info

XIOC detected Domain: logger.info

extracted_from_files

Domain

detected Domain: result.field.id

XIOC detected Domain: result.field.id

extracted_from_files

Domain

detected Domain: www.npmjs.com

XIOC detected Domain: www.npmjs.com

extracted_from_files

Domain

detected Domain: putrequest.config.data

XIOC detected Domain: putrequest.config.data

extracted_from_files

Domain

detected Domain: putrequest.config.data.is

XIOC detected Domain: putrequest.config.data.is

extracted_from_files

Domain

detected Domain: result.entry.is

XIOC detected Domain: result.entry.is

extracted_from_files

Domain

detected Domain: result.entry.date

XIOC detected Domain: result.entry.date

extracted_from_files

Domain

detected Domain: result.entry.page

XIOC detected Domain: result.entry.page

extracted_from_files

Domain

detected Domain: result.feed.id

XIOC detected Domain: result.feed.id

extracted_from_files

Domain

detected Domain: insecure.com

XIOC detected Domain: insecure.com

extracted_from_files

Domain

detected Domain: info.secure

XIOC detected Domain: info.secure

extracted_from_files

Domain

detected Domain: suite.run

XIOC detected Domain: suite.run

extracted_from_files

Domain

detected Domain: result.id

XIOC detected Domain: result.id

extracted_from_files

Domain

detected Domain: result.is

XIOC detected Domain: result.is

extracted_from_files

Domain

detected Domain: result.total

XIOC detected Domain: result.total

extracted_from_files

Domain

detected Domain: runner.run

XIOC detected Domain: runner.run

extracted_from_files

Domain

detected Domain: existingformresponse.data

XIOC detected Domain: existingformresponse.data

extracted_from_files

Domain

detected Domain: response.data.is

XIOC detected Domain: response.data.is

extracted_from_files

Domain

detected Domain: searchparams.search

XIOC detected Domain: searchparams.search

extracted_from_files

Domain

detected Domain: response.data.total

XIOC detected Domain: response.data.total

extracted_from_files

Domain

detected Domain: existingentryresponse.data

XIOC detected Domain: existingentryresponse.data

extracted_from_files

Domain

detected Domain: existingfeedresponse.data

XIOC detected Domain: existingfeedresponse.data

extracted_from_files

Domain

detected Domain: fieldoperationhandlers.gf

XIOC detected Domain: fieldoperationhandlers.gf

extracted_from_files

Domain

detected Domain: entries.map

XIOC detected Domain: entries.map

extracted_from_files

Domain

detected Domain: def.storage

XIOC detected Domain: def.storage

extracted_from_files

Domain

detected Domain: requestconfig.data

XIOC detected Domain: requestconfig.data

extracted_from_files

Domain

detected Domain: authinfo.secure

XIOC detected Domain: authinfo.secure

extracted_from_files

Domain

detected Domain: response.data

XIOC detected Domain: response.data

extracted_from_files

Domain

detected Domain: validated.fields.map

XIOC detected Domain: validated.fields.map

extracted_from_files

Domain

detected Domain: this.httpclient.post

XIOC detected Domain: this.httpclient.post

extracted_from_files

Domain

detected Domain: affectedrules.map

XIOC detected Domain: affectedrules.map

extracted_from_files

Domain

detected Domain: notification.name

XIOC detected Domain: notification.name

extracted_from_files

Domain

detected Domain: confirmation.name

XIOC detected Domain: confirmation.name

extracted_from_files

Domain

detected Domain: f.id

XIOC detected Domain: f.id

extracted_from_files

Domain

detected Domain: targetfield.id

XIOC detected Domain: targetfield.id

extracted_from_files

Domain

detected Domain: fielddef.storage

XIOC detected Domain: fielddef.storage

extracted_from_files

Domain

detected Domain: originalfield.id

XIOC detected Domain: originalfield.id

extracted_from_files

Domain

detected Domain: entrydata.id

XIOC detected Domain: entrydata.id

extracted_from_files

Domain

detected Domain: entrydata.date

XIOC detected Domain: entrydata.date

extracted_from_files

Domain

detected Domain: validated.date

XIOC detected Domain: validated.date

extracted_from_files

Domain

detected Domain: supportedaddons.map

XIOC detected Domain: supportedaddons.map

extracted_from_files

Domain

detected Domain: error.name

XIOC detected Domain: error.name

extracted_from_files

Domain

detected Domain: field.storage

XIOC detected Domain: field.storage

extracted_from_files

Domain

detected Domain: dirent.name

XIOC detected Domain: dirent.name

extracted_from_files

Domain

detected Domain: filters.map

XIOC detected Domain: filters.map

extracted_from_files

Domain

detected Domain: validated.id

XIOC detected Domain: validated.id

extracted_from_files

Domain

detected Domain: formdata.id

XIOC detected Domain: formdata.id

extracted_from_files

Domain

detected Domain: params.search

XIOC detected Domain: params.search

extracted_from_files

Domain

detected Domain: validated.search

XIOC detected Domain: validated.search

extracted_from_files

Domain

detected Domain: params.paging.page

XIOC detected Domain: params.paging.page

extracted_from_files

Domain

detected Domain: paging.page

XIOC detected Domain: paging.page

extracted_from_files

Domain

detected Domain: this.name

XIOC detected Domain: this.name

extracted_from_files

Domain

detected Domain: config.errormessages.format.email

XIOC detected Domain: config.errormessages.format.email

extracted_from_files

Domain

detected Domain: config.errormessages.format.date

XIOC detected Domain: config.errormessages.format.date

extracted_from_files

Domain

detected Domain: config.errormessages.format.id

XIOC detected Domain: config.errormessages.format.id

extracted_from_files

Domain

detected Domain: ids.map

XIOC detected Domain: ids.map

extracted_from_files

Domain

detected Domain: params.page

XIOC detected Domain: params.page

extracted_from_files

Domain

detected Domain: validated.page

XIOC detected Domain: validated.page

extracted_from_files

Domain

detected Domain: date.now

XIOC detected Domain: date.now

extracted_from_files

Domain

detected Domain: field.id

XIOC detected Domain: field.id

extracted_from_files

Domain

detected Domain: definition.storage

XIOC detected Domain: definition.storage

extracted_from_files

Domain

detected Domain: process.env.gf

XIOC detected Domain: process.env.gf

extracted_from_files

Domain

detected Domain: form.form.id

XIOC detected Domain: form.form.id

extracted_from_files

Domain

detected Domain: a.date

XIOC detected Domain: a.date

extracted_from_files

Domain

detected Domain: b.date

XIOC detected Domain: b.date

extracted_from_files

Domain

detected Domain: feedresult.feed.id

XIOC detected Domain: feedresult.feed.id

extracted_from_files

Domain

detected Domain: form.id

XIOC detected Domain: form.id

extracted_from_files

Domain

detected Domain: entry.id

XIOC detected Domain: entry.id

extracted_from_files

Domain

detected Domain: feed.id

XIOC detected Domain: feed.id

extracted_from_files

Domain

detected Domain: tool.name

XIOC detected Domain: tool.name

extracted_from_files

Domain

detected Domain: test.com

XIOC detected Domain: test.com

extracted_from_files

Domain

detected Domain: response.result.tools

XIOC detected Domain: response.result.tools

extracted_from_files

Domain

detected Domain: mcp.call

XIOC detected Domain: mcp.call

extracted_from_files

Domain

detected Domain: readme.md

XIOC detected Domain: readme.md

extracted_from_files

Domain

detected Domain: endpoint.name

XIOC detected Domain: endpoint.name

extracted_from_files

Domain

detected Domain: error.response.data

XIOC detected Domain: error.response.data

extracted_from_files

Domain

detected Domain: email.com

XIOC detected Domain: email.com

extracted_from_files

Domain

detected Domain: result.form.id

XIOC detected Domain: result.form.id

extracted_from_files

Domain

detected Domain: entryresult.entry.id

XIOC detected Domain: entryresult.entry.id

extracted_from_files

Domain

detected Domain: img.shields.io

XIOC detected Domain: img.shields.io

extracted_from_files

Domain

detected Domain: www.yoursite.com

XIOC detected Domain: www.yoursite.com

extracted_from_files

Domain

detected Domain: staging.yoursite.com

XIOC detected Domain: staging.yoursite.com

extracted_from_files

URL

detected URL: https://github.com/GravityKit/GravityMCP/issues

XIOC detected URL: https://github.com/GravityKit/GravityMCP/issues

extracted_from_files

Security Analysis Summary

Security Analysis Overview

@gravitykit/gravitymcp is a mcp extension published by gravitykit. Version 1.4.1 has been analyzed by the Risky Plugins security platform, receiving a risk score of 100/100 (CRITICAL risk) based on 351 security findings.

Risk Assessment

This extension presents critical security risk. Severe issues were detected, potentially including malware indicators, exposed secrets, or dangerous behaviors. Installation is strongly discouraged until these issues are addressed.

Findings Breakdown

Critical: 8 finding(s)
High: 117 finding(s)
Medium: 176 finding(s)
Low: 1 finding(s)

What Was Analyzed

The security assessment covers multiple analysis categories:

Malware Detection: YARA rule matching against 2,400+ malware signatures
Secret Detection: Scanning for exposed API keys, tokens, and credentials
Static Analysis: Code-level security analysis for common vulnerability patterns
Network Analysis: Detection of suspicious network communications and endpoints
Obfuscation Detection: Identification of code obfuscation techniques

Developer Information

@gravitykit/gravitymcp is published by gravitykit on the mcp marketplace.

Recommendation

This extension is not recommended for installation without thorough manual review. Consider alternatives with lower risk scores, or contact the developer to address the identified security concerns.

Source Code Viewer

Source Code Not Available

Source code is not available for this version of the extension.

Frequently Asked Questions

Similar Extensions

Related extensions from the same publisher or marketplace

@synergy-design-system/mcp

schilchsickag

CRITICAL

n8n-mcp

czlonkowski

CRITICAL

msteams-mcp

m0nkmaster

CRITICAL

kam-mcp-server

bamo

CRITICAL

livereload-js

smhg

CRITICAL

Risk Assessment

Severity Breakdown

Finding Categories

YARA Rules Matched

MCP Server Analysis

About This Extension

Detailed Findings

MCP-TRANSPORT-HARDCODED-TOKEN-src/tests/sanitize.test.js

MCP-TRANSPORT-HARDCODED-TOKEN-src/tests/sanitize.test.js

MCP-TRANSPORT-HARDCODED-TOKEN-src/tests/sanitize.test.js

MCP-TRANSPORT-HARDCODED-TOKEN-src/tests/sanitize.test.js

MCP-TRANSPORT-HARDCODED-TOKEN-src/tests/sanitize.test.js

MCP-TRANSPORT-HARDCODED-TOKEN-src/tests/sanitize.test.js

MCP-TRANSPORT-HARDCODED-TOKEN-src/tests/sanitize.test.js

MCP-TRANSPORT-HARDCODED-TOKEN-src/tests/sanitize.test.js

NET-AXIOS-scripts/check-env.js-109

NET-AXIOS-src/gravity-forms-client.js-23

MCP-TOOL-CODE-SMELL-scripts/verify-field-tools.js-19

HASH-e5f7a841c71433cd

HASH-2cd6ed40cc5cb51f

HASH-a6c8358464b0196f

HASH-6eebbaaab0522ec9

HASH-e857572f9ab8a452

HASH-1e4049b1be687b49

HASH-47c4ec5685a130d7

HASH-08b0966679c037fd

HASH-5d1b02b37241d5cc

HASH-bbf391351b6653d4

HASH-9972e5aed1adece4

HASH-8ca631d05cc325a6

HASH-31595fd332f81534

HASH-4d18d521d4f4ff0b

HASH-c29bf4e0403984cd

HASH-63c5b1e19619f3e9

HASH-0b732ee340df63b7

HASH-076480b7f9d8f5ea

HASH-8c1fff2fc927ddcf

HASH-6869da807e986994

HASH-1f288fe05e839523

HASH-0087c7aa5043a297

HASH-2ce6c712f6c8d2b7

HASH-bdb2892455761e6e

HASH-bbc387680729cfbe

HASH-860c5c05827258b7

HASH-ae8f632095b200e6

HASH-7a0e865f588e35c3

HASH-04e0eb0c84010f0a

HASH-a178cdceb473dc4a

HASH-1053a95dbe002453

HASH-2836090488f50adb

HASH-e71632b50efd5644

HASH-1e71ce074951aeb4

HASH-ebed4bd7dea69e55

HASH-e51903c9d7ebc405

HASH-b65d4e53df0e07b4

HASH-e2af02a9c37baedb

HASH-d64ba1d684e92fc1

HASH-654f803e5112e871

HASH-4ee4cf8ca1a5ccd2

HASH-e5a265ad25388a74

HASH-3b963eadcd53beb5

HASH-fdc8b98f1a6d6569

HASH-7fff00c29c8a640b

HASH-02c4631ed2fe287d

HASH-d0638885e0b25777

HASH-85b30f124d25401f

HASH-2a3c77087e74695c

YARA Rule Matches

postinstall file manipulation

NoUseWeakRandom

postinstall crypto operations

postinstall network communication

credential env files

postinstall obfuscation

postinstall registry modification

UsingShellInterpreterWhenExecutingOSCommands

postinstall system command

UsingCommandLineArguments

postinstall file download

postinstall persistence mechanism