9b81b5b51e483a373e0f177ed2cc94c7737c8bf0ebb90c624b0dc42913176381

Analysis

max time kernel
4s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
12/10/2026, 23:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BUAA-WaterPoweredRocket/运行组件/nn_training/crosscheck_python.py
Size 1KB
Sample261012-29cm8sfa92
SHA256 9b81b5b51e483a373e0f177ed2cc94c7737c8bf0ebb90c624b0dc42913176381
MD5 f06083a9fb7ce6fc87550d474b8644a1
SHA1 770455534e261d1f5d6b8c02f31c7d2024753c7b
SHA512 b23d681436d357865a01936bab1aba867b0448c08302f741cd2231118bc11e58e657474dc1f38be44dfa23575528ba96b2ccc52680345c7051bd7297f05b566c
TLSH
T1E931C001552F3924A3DB11AC1A04B9305371BAFB27418816B1CF5738DF882BB55372AC
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: Python 1 TTPs 4 IoCs

Execution via Python.

execution

Python

T1059.006

pid	Process
655	python3
655	python3
655	python3
655	python3

Reads runtime system information 2 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/status	python3
File opened for reading	/proc/mounts	python3

/tmp/BUAA-WaterPoweredRocket/运行组件/nn_training/crosscheck_python.py
/tmp/BUAA-WaterPoweredRocket/运行组件/nn_training/crosscheck_python.py
1⤵
PID:655

/usr/local/sbin/python3
python3 /tmp/BUAA-WaterPoweredRocket/运行组件/nn_training/crosscheck_python.py
1⤵
- Command and Scripting Interpreter: Python
PID:655

/usr/local/bin/python3
python3 /tmp/BUAA-WaterPoweredRocket/运行组件/nn_training/crosscheck_python.py
1⤵
- Command and Scripting Interpreter: Python
PID:655

/usr/sbin/python3
python3 /tmp/BUAA-WaterPoweredRocket/运行组件/nn_training/crosscheck_python.py
1⤵
- Command and Scripting Interpreter: Python
PID:655

/usr/bin/python3
python3 /tmp/BUAA-WaterPoweredRocket/运行组件/nn_training/crosscheck_python.py
1⤵
- Command and Scripting Interpreter: Python
- Reads runtime system information
PID:655

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Python

T1059.006

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads