The Linux sandbox runs a server image with no desktop, so there is no screen to record - this is the boot console, kept because a kernel panic or an out-of-memory kill would show up here and in no other layer. What the sample did is under Behavior, File & registry and Network, captured from the syscall trace rather than from pixels.

1 process(es) observed; 2 dropped file(s)

Every auto-start method checked on this sample, grouped by family. A method with no result is reported clean.

No operations match your filter.

Hash lookups only - the sample itself is never uploaded to any third party.

The analysis of the sample indicates that it successfully executed within the sandbox environment. **Initial Access:** The sample was executed as a Python script located at `/var/tmp/archive-report.py`, which suggests that it was initiated through a command line invocation of the Python interpreter. **Execution:** The sample spawned a process named `python3` with the command line `/usr/bin/python3 /var/tmp/archive-report.py`. This indicates that the sample was actively running and executing its code. **Persistence:** There were no indications of persistence mechanisms being employed by the sample. It did not attempt to create any registry entries or other methods to maintain its presence on the system after execution. **Defense Evasion:** The sample demonstrated behavior consistent with defense evasion techniques, specifically through file deletion. It created a temporary file at `/tmp/zg0q2ucn` and subsequently deleted it, which aligns with the MITRE technique for "Indicator Removal: File Deletion" (T1070.004). **Command and Control (C2):** There were no network connections or communications observed during the execution, indicating that the sample did not attempt to establish any command and control communications. **Impact:** The impact of the sample is not clearly defined due to the lack of malicious behavior or significant actions beyond file creation and deletion. The behavior observed does not suggest any harmful effects on the system. **Verdict Rationale:** The sample executed successfully and exhibited behaviors associated with execution and defense evasion. However, it did not demonstrate any clear malicious intent or significant impact. Therefore, while the sample executed, the lack of harmful actions leads to a conclusion that it is not definitively malicious based on the observed behavior. Further context or additional indicators would be necessary to provide a more conclusive assessment.

No evasive checkpoints detected.

The Sigma corpus was evaluated against this run's processes, registry, file, network, DNS and script activity. Nothing matched.

The report downloads - PCAP and the SIEM/TIP exports - are a paid-plan feature. Sign in with a paid plan to export this report.

An enterprise report with an AI-written executive summary, threat assessment, kill chain, and recommendations, plus the derived evidence (verdict, MITRE ATT&CK, network, file modifications, dropped files, IOCs) and screenshots. The AI narrative is built from derived analysis data only, so the raw sample never leaves the host (no-upload and AI-boundary preserved).