e356f2e3889df7de0de3e804a7bcb868365a767092d384a842e8862d95db5e41

Analysis

max time kernel
0s
max time network
129s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
13/08/2026, 12:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
news-search-skill_20260602182336/scripts/news_llm_search.py
Size 6KB
Sample260813-pd4evsyfqd
SHA256 e356f2e3889df7de0de3e804a7bcb868365a767092d384a842e8862d95db5e41
MD5 1d9abe021c4fc88f78efbba69e128bd4
SHA1 19ba0d9befbaada5c29a2ed1c577e530762afc6a
SHA512 17c8f003e19a84ab854a9afc204944abf63f23621db08947a6c25fe42ab3b95d0dedaf8010c438f033172594aa6211422e8b180c64e384aa837898d904d0b4ec
SSDEEP 192:qtq2dibXZEvTIhU/+UO8jqZAFGyzjP8cdSI4dbei:qo2g9OTrRB/jPcIMn
TLSH
T114D1A8249DD67C428BEAC92CDD26E5829730B803180879B87DEC42682FDC969D5F725D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: Python 1 TTPs 4 IoCs

Execution via Python.

execution

Python

T1059.006

pid	Process
1471	python3
1471	python3
1471	python3
1471	python3

Command and Scripting Interpreter: Unix Shell 1 TTPs 1 IoCs

Execute scripts via Unix Shell.

execution

Unix Shell

T1059.004

pid	Process
1480	sh

Reads runtime system information 3 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/status	python3
File opened for reading	/proc/mounts	python3
File opened for reading	/proc/self/fd	python3

System Network Configuration Discovery 1 TTPs 5 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1471	python3
1471	news_llm_search.py
1471	python3
1471	python3
1471	python3

/tmp/news-search-skill_20260602182336/scripts/news_llm_search.py
/tmp/news-search-skill_20260602182336/scripts/news_llm_search.py
1⤵
- System Network Configuration Discovery
PID:1471

/usr/local/sbin/python3
python3 /tmp/news-search-skill_20260602182336/scripts/news_llm_search.py
1⤵
- Command and Scripting Interpreter: Python
- System Network Configuration Discovery
PID:1471

/usr/local/bin/python3
python3 /tmp/news-search-skill_20260602182336/scripts/news_llm_search.py
1⤵
- Command and Scripting Interpreter: Python
- System Network Configuration Discovery
PID:1471

/usr/sbin/python3
python3 /tmp/news-search-skill_20260602182336/scripts/news_llm_search.py
1⤵
- Command and Scripting Interpreter: Python
- System Network Configuration Discovery
PID:1471

/usr/bin/python3
python3 /tmp/news-search-skill_20260602182336/scripts/news_llm_search.py
1⤵
- Command and Scripting Interpreter: Python
- Reads runtime system information
- System Network Configuration Discovery
PID:1471
- /sbin/ldconfig
  /sbin/ldconfig -p
  2⤵
  PID:1479
- /sbin/ldconfig.real
  /sbin/ldconfig.real -p
  2⤵
  PID:1479
- /bin/sh
  /bin/sh -c "uname -p 2> /dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:1480
- - /bin/uname
    uname -p
    3⤵
    PID:1481

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Python

T1059.006

Unix Shell

T1059.004

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads