Overview
overview
3Static
static
1new-tools/...int.js
windows10-2004-x64
3new-tools/...int.js
windows11-ltsc_2024-x64
3backdoor-p...ell.js
windows10-2004-x64
3backdoor-p...ell.js
windows11-ltsc_2024-x64
3new-tools/main.py
ubuntu-18.04-amd64
3new-tools/main.py
debian-9-armhf
3new-tools/main.py
debian-9-mips
new-tools/main.py
debian-9-mipsel
new-tools/...10.pyc
windows10-2004-x64
3new-tools/...10.pyc
windows11-ltsc_2024-x64
3new-tools/...10.pyc
windows10-2004-x64
3new-tools/...10.pyc
windows11-ltsc_2024-x64
3new-tools/...10.pyc
windows10-2004-x64
3new-tools/...10.pyc
windows11-ltsc_2024-x64
3new-tools/...10.pyc
windows10-2004-x64
3new-tools/...10.pyc
windows11-ltsc_2024-x64
3new-tools/...10.pyc
windows10-2004-x64
3new-tools/...10.pyc
windows11-ltsc_2024-x64
3new-tools/...10.pyc
windows10-2004-x64
3new-tools/...10.pyc
windows11-ltsc_2024-x64
3new-tools/...10.pyc
windows10-2004-x64
3new-tools/...10.pyc
windows11-ltsc_2024-x64
3new-tools/...10.pyc
windows10-2004-x64
3new-tools/...10.pyc
windows11-ltsc_2024-x64
3new-tools/...10.pyc
windows10-2004-x64
3new-tools/...10.pyc
windows11-ltsc_2024-x64
3new-tools/...10.pyc
windows10-2004-x64
3new-tools/...10.pyc
windows11-ltsc_2024-x64
3new-tools/...10.pyc
windows10-2004-x64
3new-tools/...10.pyc
windows11-ltsc_2024-x64
3new-tools/...10.pyc
windows10-2004-x64
3new-tools/...10.pyc
windows11-ltsc_2024-x64
3Analysis
- max time kernel
0s - max time network
133s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
03/08/2026, 12:29
Static task
static1
Behavioral task
behavioral1
Sample
new-tools/files/int.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
new-tools/files/int.js
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
backdoor-plugin/shell.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
backdoor-plugin/shell.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
new-tools/main.py
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral6
Sample
new-tools/main.py
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral7
Sample
new-tools/main.py
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral8
Sample
new-tools/main.py
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral9
Sample
new-tools/modules/__pycache__/acf_extended_rce.cpython-310.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
new-tools/modules/__pycache__/acf_extended_rce.cpython-310.pyc
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
new-tools/modules/__pycache__/antimalware_cve_2025_11705.cpython-310.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
new-tools/modules/__pycache__/antimalware_cve_2025_11705.cpython-310.pyc
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
new-tools/modules/__pycache__/arbitrary_plugin_install_2024.cpython-310.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
new-tools/modules/__pycache__/arbitrary_plugin_install_2024.cpython-310.pyc
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
new-tools/modules/__pycache__/career_section_upload.cpython-310.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
new-tools/modules/__pycache__/career_section_upload.cpython-310.pyc
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral17
Sample
new-tools/modules/__pycache__/dsgvo_fonts_cve_2026_3535.cpython-310.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
new-tools/modules/__pycache__/dsgvo_fonts_cve_2026_3535.cpython-310.pyc
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral19
Sample
new-tools/modules/__pycache__/everestforms_cve_2026_3300.cpython-310.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
new-tools/modules/__pycache__/everestforms_cve_2026_3300.cpython-310.pyc
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
Behavioral task
behavioral21
Sample
new-tools/modules/__pycache__/feou_upload.cpython-310.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
new-tools/modules/__pycache__/feou_upload.cpython-310.pyc
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral23
Sample
new-tools/modules/__pycache__/gravityforms_cve_2025_7243.cpython-310.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
new-tools/modules/__pycache__/gravityforms_cve_2025_7243.cpython-310.pyc
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral25
Sample
new-tools/modules/__pycache__/kingaddons_cve_2025_6327.cpython-310.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
new-tools/modules/__pycache__/kingaddons_cve_2025_6327.cpython-310.pyc
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral27
Sample
new-tools/modules/__pycache__/ninjaforms_cve_2026_0740.cpython-310.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
new-tools/modules/__pycache__/ninjaforms_cve_2026_0740.cpython-310.pyc
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral29
Sample
new-tools/modules/__pycache__/sneeit_framework_cve_2025_6389.cpython-310.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
new-tools/modules/__pycache__/sneeit_framework_cve_2025_6389.cpython-310.pyc
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral31
Sample
new-tools/modules/__pycache__/wp_woo_scraper_cve_2026_46698.cpython-310.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
new-tools/modules/__pycache__/wp_woo_scraper_cve_2026_46698.cpython-310.pyc
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
General
- Target new-tools/main.py
- Size 10KB
- Sample260803-ppaxpayzhs
- SHA256 d110b13ac351119713a8e6af2c11b150ed6c8afa9557fe1d89795ab8686f504c
- MD5 073410263872b06b431ca0941627e711
- SHA1 33601c2222b3e71c97b479f03e1dbb0e28a1990a
- SHA512 cd1ff9aeb3f5413643589b2d1d929b38d78437f649ffcc93c7b11a82b461ce8718a7b1ad839a85abac10a4852544079106cde41751955164e78a0a58a83a648e
- SSDEEP 192:VOeoy612B7zXVr1tHZtNkXH/uuJnMXA4i/ok3TRJreyvikmDgzzi:VOgJtNkzJnMFQoMzreJXn
- TLSH T17B324F71083437653B0EDC8C88B5E896232A79C7BE756420F9DDB2E85FDD8244970AF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
-
pid Process 1485 python3 1485 python3 1485 python3 1485 python3 - Command and Scripting Interpreter: Unix Shell 1 TTPs 1 IoCs
Execute scripts via Unix Shell.
pid Process 1487 sh -
description ioc Process File opened for reading /proc/self/status python3 File opened for reading /proc/mounts python3 File opened for reading /proc/self/fd python3 - Writes file to tmp directory 14 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/new-tools/modules/__pycache__/wpvivid_cve_2026_1192.cpython-36.pyc.140480660204400 python3 File opened for modification /tmp/new-tools/modules/__pycache__/acf_extended_rce.cpython-36.pyc.140480648188432 python3 File opened for modification /tmp/new-tools/modules/__pycache__/sneeit_framework_cve_2025_6389.cpython-36.pyc.140480648266592 python3 File opened for modification /tmp/new-tools/modules/__pycache__/kingaddons_cve_2025_6327.cpython-36.pyc.140480648220848 python3 File opened for modification /tmp/new-tools/modules/__pycache__/antimalware_cve_2025_11705.cpython-36.pyc.140480648220976 python3 File opened for modification /tmp/new-tools/modules/__pycache__/arbitrary_plugin_install_2024.cpython-36.pyc.140480648221104 python3 File opened for modification /tmp/new-tools/modules/__pycache__/ninjaforms_cve_2026_0740.cpython-36.pyc.140480648445232 python3 File opened for modification /tmp/new-tools/modules/__pycache__/everestforms_cve_2026_3300.cpython-36.pyc.140480648445360 python3 File opened for modification /tmp/new-tools/modules/__pycache__/dsgvo_fonts_cve_2026_3535.cpython-36.pyc.140480648445488 python3 File opened for modification /tmp/new-tools/modules/__pycache__/career_section_upload.cpython-36.pyc.140480648188552 python3 File opened for modification /tmp/new-tools/modules/__pycache__/feou_upload.cpython-36.pyc.140480648298880 python3 File opened for modification /tmp/new-tools/modules/__pycache__/wp_woo_scraper_cve_2026_46698.cpython-36.pyc.140480648445616 python3 File opened for modification /tmp/new-tools/modules/__pycache__/gravityforms_cve_2025_7243.cpython-36.pyc.140480648445744 python3 File opened for modification /tmp/new-tools/modules/__pycache__/wpbookit_upload.cpython-36.pyc.140480648188792 python3
Processes
-
/tmp/new-tools/main.py/tmp/new-tools/main.py1⤵PID:1485
-
/usr/local/sbin/python3python3 /tmp/new-tools/main.py1⤵
- Command and Scripting Interpreter: Python
PID:1485
-
/usr/local/bin/python3python3 /tmp/new-tools/main.py1⤵
- Command and Scripting Interpreter: Python
PID:1485
-
/usr/sbin/python3python3 /tmp/new-tools/main.py1⤵
- Command and Scripting Interpreter: Python
PID:1485
-
/usr/bin/python3python3 /tmp/new-tools/main.py1⤵
- Command and Scripting Interpreter: Python
- Reads runtime system information
- Writes file to tmp directory
PID:1485 -
/sbin/ldconfig/sbin/ldconfig -p2⤵PID:1486
-
-
/sbin/ldconfig.real/sbin/ldconfig.real -p2⤵PID:1486
-
-
/bin/sh/bin/sh -c "uname -p 2> /dev/null"2⤵
- Command and Scripting Interpreter: Unix Shell
PID:1487 -
/bin/unameuname -p3⤵PID:1488
-
-