8a1bce668776fee44fff22350219763052f90c45f961e4f661b9499ffa878e8e

Analysis

max time kernel
0s
max time network
130s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
05/07/2026, 18:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
nuclei-templates-10.4.5/.github/scripts/update-kev.py
Size 14KB
Sample260705-wsv6csav5k
SHA256 8a1bce668776fee44fff22350219763052f90c45f961e4f661b9499ffa878e8e
MD5 c7b235ba4a915e58a7eab6927c43c710
SHA1 f865b104e7c68687ac6ecc7ab8637f4d2393cd52
SHA512 eae1d769fff0265c55b85bc5b2d41949a91b86e9148c65f4884f62adb2ae572f43dfc134ba96818c03eea63a864f51ed3f32bdbb23c8063f81e3b9596f464f04
SSDEEP 192:UI709bebPBtlIKtXZ0KEs2j2lpppkZz+WmXjIRwXma5PoG6Nr8whcE9XYtdAf4:UI709WPP1R7ppO+WujIRQmaCpTkv
TLSH
T159525212A4818674D3F38CADD996B012172A7D235B4D7131B5EC418CEF92660D2FBEFA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: Python 1 TTPs 4 IoCs

Execution via Python.

execution

Python

T1059.006

pid	Process
1516	python3
1516	python3
1516	python3
1516	python3

Command and Scripting Interpreter: Unix Shell 1 TTPs 1 IoCs

Execute scripts via Unix Shell.

execution

Unix Shell

T1059.004

pid	Process
1521	sh

Reads runtime system information 3 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/fd	python3
File opened for reading	/proc/self/status	python3
File opened for reading	/proc/mounts	python3

System Network Configuration Discovery 1 TTPs 5 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1516	update-kev.py
1516	python3
1516	python3
1516	python3
1516	python3

/tmp/nuclei-templates-10.4.5/.github/scripts/update-kev.py
/tmp/nuclei-templates-10.4.5/.github/scripts/update-kev.py
1⤵
- System Network Configuration Discovery
PID:1516

/usr/local/sbin/python3
python3 /tmp/nuclei-templates-10.4.5/.github/scripts/update-kev.py
1⤵
- Command and Scripting Interpreter: Python
- System Network Configuration Discovery
PID:1516

/usr/local/bin/python3
python3 /tmp/nuclei-templates-10.4.5/.github/scripts/update-kev.py
1⤵
- Command and Scripting Interpreter: Python
- System Network Configuration Discovery
PID:1516

/usr/sbin/python3
python3 /tmp/nuclei-templates-10.4.5/.github/scripts/update-kev.py
1⤵
- Command and Scripting Interpreter: Python
- System Network Configuration Discovery
PID:1516

/usr/bin/python3
python3 /tmp/nuclei-templates-10.4.5/.github/scripts/update-kev.py
1⤵
- Command and Scripting Interpreter: Python
- Reads runtime system information
- System Network Configuration Discovery
PID:1516
- /sbin/ldconfig
  /sbin/ldconfig -p
  2⤵
  PID:1517
- /sbin/ldconfig.real
  /sbin/ldconfig.real -p
  2⤵
  PID:1517
- /bin/sh
  /bin/sh -c "uname -p 2> /dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:1521
- - /bin/uname
    uname -p
    3⤵
    PID:1522

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Python

T1059.006

Unix Shell

T1059.004

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads