The Linux sandbox runs a server image with no desktop, so there is no screen to record - this is the boot console, kept because a kernel panic or an out-of-memory kill would show up here and in no other layer. What the sample did is under Behavior, File & registry and Network, captured from the syscall trace rather than from pixels.

4 process(es) observed; 5 dropped file(s)

Every auto-start method checked on this sample, grouped by family. A method with no result is reported clean.

No operations match your filter.

Hash lookups only - the sample itself is never uploaded to any third party.

The analysis of the sample indicates that it was executed successfully in the sandbox environment. The observed behaviors suggest a potential malicious intent, particularly in the context of process execution and file manipulation. **Initial Access:** The sample executed a script located at `/var/tmp/log-rotate.sh`, which is indicative of an initial access vector through a script execution. **Execution:** The sample spawned multiple processes, including `log-rotate.sh` and `wc`, utilizing system calls such as `execve`, which is a common method for executing programs in Linux environments. This behavior aligns with the MITRE ATT&CK techniques for execution, specifically "Native API" (T1106) and "Command and Scripting Interpreter" (T1059). **Persistence:** There were no clear indicators of persistence mechanisms observed in the analysis. The sample did not attempt to establish any long-term presence on the system. **Defense Evasion:** The analysis did not reveal any specific techniques employed for defense evasion, such as obfuscation or anti-analysis measures. **Command and Control (C2):** No network connections or command and control communications were detected during the analysis, indicating that the sample did not attempt to communicate with external servers. **Impact:** The sample created multiple log files in the `/tmp` directory, specifically `service.log` and `service.log.1`. This could suggest an attempt to log activities or errors, but without further context, the impact remains unclear. **Verdict Rationale:** The sample executed and displayed behaviors consistent with potential malicious activity, particularly through the execution of scripts and file manipulation. However, the lack of persistence and C2 communications limits the assessment of its overall impact. Further investigation may be warranted to determine the full extent of its capabilities and intent.

No evasive checkpoints detected.

The Sigma corpus was evaluated against this run's processes, registry, file, network, DNS and script activity. Nothing matched.

The report downloads - PCAP and the SIEM/TIP exports - are a paid-plan feature. Sign in with a paid plan to export this report.

An enterprise report with an AI-written executive summary, threat assessment, kill chain, and recommendations, plus the derived evidence (verdict, MITRE ATT&CK, network, file modifications, dropped files, IOCs) and screenshots. The AI narrative is built from derived analysis data only, so the raw sample never leaves the host (no-upload and AI-boundary preserved).