4f3c89bca86faf899da5d79ceaaf9c0b5d4edc0504ca40a9fe6bdb5c1679e54d

Analysis

max time kernel
0s
max time network
131s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
03/07/2026, 22:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Aether_Os/4ndr0tools_rssfinder.py.null
Size 3KB
Sample260703-2hxt4agz21
SHA256 4f3c89bca86faf899da5d79ceaaf9c0b5d4edc0504ca40a9fe6bdb5c1679e54d
MD5 628437dee3bf6acf888d56e81f477445
SHA1 eaa1688c42dd5c8b5d8ef41ea6b73692f9a17881
SHA512 97fe84c2e29258b7d96f922f4309bb287463dcfd1b90c6d31d77e49d058e5f51043f70dac5c0043456fb8c8b1edb18252443d8af3aea5a0e9a49262e2661dc95
TLSH
T1F471B66A140E212B57C2284CC86AE510532BBD9729416971B41CA35C1F9D97ECF373AE
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: Unix Shell 1 TTPs 1 IoCs

Execute scripts via Unix Shell.

execution

Unix Shell

T1059.004

pid	Process
1511	sh

Reads runtime system information 3 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/status	python3
File opened for reading	/proc/mounts	python3
File opened for reading	/proc/self/fd	python3

/tmp/Aether_Os/4ndr0tools_rssfinder.py.null
/tmp/Aether_Os/4ndr0tools_rssfinder.py.null
1⤵
PID:1509

/usr/local/sbin/python3
python3 /tmp/Aether_Os/4ndr0tools_rssfinder.py.null
1⤵
PID:1509

/usr/local/bin/python3
python3 /tmp/Aether_Os/4ndr0tools_rssfinder.py.null
1⤵
PID:1509

/usr/sbin/python3
python3 /tmp/Aether_Os/4ndr0tools_rssfinder.py.null
1⤵
PID:1509

/usr/bin/python3
python3 /tmp/Aether_Os/4ndr0tools_rssfinder.py.null
1⤵
- Reads runtime system information
PID:1509
- /sbin/ldconfig
  /sbin/ldconfig -p
  2⤵
  PID:1510
- /sbin/ldconfig.real
  /sbin/ldconfig.real -p
  2⤵
  PID:1510
- /bin/sh
  /bin/sh -c "uname -p 2> /dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:1511
- - /bin/uname
    uname -p
    3⤵
    PID:1512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Unix Shell

T1059.004

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads