Overview

overview

7

Static

static

1

better_logging.py

ubuntu-22.04-amd64

7

better_logging.py

debian-9-armhf

3

better_logging.py

debian-9-mips

3

better_logging.py

debian-9-mipsel

3

Resubmissions

03/05/2026, 23:36

260503-3lkjlsh181

03/05/2026, 23:33

260503-3jynfsh1717

Analysis

  • user interaction
    yes
  • max time kernel
    13s
  • max time network
    128s
  • platform
    ubuntu-22.04_amd64
  • resource
    ubuntu2204-amd64-20260127-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2204-amd64-20260127-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system
  • submitted
    03/05/2026, 23:33

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    better_logging.py
  • Size 3KB
  • Sample260503-3jynfsh171
  • SHA256 ec010a1a2d5de6a29d87e73ab93be70799d67c8197550207c792037ee0b917e1
  • MD5 SHA1 SHA512 TLSH
Score
7/10
credential_accessdefense_evasiondiscoveryexecutionprivilege_escalation

Malware Config

Signatures

  • OS Credential Dumping 1 TTPs 1 IoCs

    Adversaries may attempt to dump credentials to use it in password cracking.

    credential_access
  • Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 2 IoCs

    Abuse sudo or cached sudo credentials to execute code.

    privilege_escalationdefense_evasion
  • Reads AppArmor ptrace settings 1 TTPs 1 IoCs

    Discovery of allowed ptrace capabilities by AppArmor.

    discovery
  • Contacts third-party web service commonly abused for C2 1 TTPs 12 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads hardware information 1 TTPs 1 IoCs

    Accesses system info like serial numbers, manufacturer names etc.

    discovery
  • Reads network interface configuration 2 TTPs 12 IoCs

    Fetches information about one or more active network interfaces.

    discovery
  • Reads CPU attributes 1 TTPs 15 IoCs
    discovery
  • Command and Scripting Interpreter: Python 1 TTPs 1 IoCs

    Execution via Python.

    execution
  • Command and Scripting Interpreter: Unix Shell 1 TTPs 8 IoCs

    Execute scripts via Unix Shell.

    execution
  • Enumerates kernel/hardware configuration 1 TTPs 64 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /usr/bin/python3
    python3 /tmp/better_logging.py
    1⤵
    • Command and Scripting Interpreter: Python
    • Writes file to tmp directory
    PID:1577
    • /bin/sh
      /bin/sh -c "uname -a"
      2⤵
        PID:1578
        • /usr/bin/uname
          uname -a
          3⤵
            PID:1579
        • /bin/sh
          /bin/sh -c "cat /etc/os-release 2>/dev/null || uname"
          2⤵
          • Command and Scripting Interpreter: Unix Shell
          PID:1580
          • /usr/bin/cat
            cat /etc/os-release
            3⤵
              PID:1581
          • /bin/sh
            /bin/sh -c "uname -r"
            2⤵
            • Command and Scripting Interpreter: Unix Shell
            PID:1582
            • /usr/bin/uname
              uname -r
              3⤵
                PID:1583
            • /bin/sh
              /bin/sh -c "find / -perm -4000 2>/dev/null | head -10"
              2⤵
              • Command and Scripting Interpreter: Unix Shell
              PID:1589
              • /usr/bin/head
                head -10
                3⤵
                  PID:1591
                • /usr/bin/find
                  find / -perm -4000
                  3⤵
                  • Reads AppArmor ptrace settings
                  • Reads hardware information
                  • Reads network interface configuration
                  • Reads CPU attributes
                  • Enumerates kernel/hardware configuration
                  • Reads runtime system information
                  PID:1590
              • /bin/sh
                /bin/sh -c "uname -r"
                2⤵
                • Command and Scripting Interpreter: Unix Shell
                PID:1592
                • /usr/bin/uname
                  uname -r
                  3⤵
                    PID:1593
                • /bin/sh
                  /bin/sh -c "sudo -l || true"
                  2⤵
                  • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                  PID:1594
                  • /usr/bin/sudo
                    sudo -l
                    3⤵
                    • OS Credential Dumping
                    • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                    PID:1595
                • /bin/sh
                  /bin/sh -c "uname -r"
                  2⤵
                  • Command and Scripting Interpreter: Unix Shell
                  PID:1596
                  • /usr/bin/uname
                    uname -r
                    3⤵
                      PID:1597
                  • /bin/sh
                    /bin/sh -c "docker --version 2>/dev/null || echo no docker"
                    2⤵
                    • Command and Scripting Interpreter: Unix Shell
                    PID:1598
                  • /bin/sh
                    /bin/sh -c "uname -r"
                    2⤵
                    • Command and Scripting Interpreter: Unix Shell
                    PID:1599
                    • /usr/bin/uname
                      uname -r
                      3⤵
                        PID:1600
                    • /bin/sh
                      /bin/sh -c "uname -r"
                      2⤵
                      • Command and Scripting Interpreter: Unix Shell
                      PID:1601
                      • /usr/bin/uname
                        uname -r
                        3⤵
                          PID:1602

                    Network

                          MITRE ATT&CK Enterprise v16

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          test
                          • Path /tmp/path_test/test
                          • Size 76B
                          • SHA256 b8666f566aec15dcbf838157a28a8c0a7224c1542ebc11da0581ffc7f2ddb917
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download