The Linux sandbox runs a server image with no desktop, so there is no screen to record - this is the boot console, kept because a kernel panic or an out-of-memory kill would show up here and in no other layer. What the sample did is under Behavior, File & registry and Network, captured from the syscall trace rather than from pixels.

2 process(es) observed

Every auto-start method checked on this sample, grouped by family. A method with no result is reported clean.

No operations match your filter.

Hash lookups only - the sample itself is never uploaded to any third party.

The analysis of the sample indicates that it was executed successfully in the sandbox environment. The following kill-chain elements were observed: 1. **Initial Access**: The sample appears to be associated with a URL (hxxp://aura.tcplegit.space/download_and_run.sh), suggesting a potential method of initial access through a web-based delivery mechanism. 2. **Execution**: The sample executed a script named `scan.sh`, which was spawned as a process (PID 681). The execution involved various system calls, including `execve`, indicating that it invoked a command or script. 3. **Persistence**: There were no indications of persistence mechanisms observed during the analysis, as no registry operations or file drops were recorded. 4. **Defense Evasion**: The sample did not exhibit any specific behaviors aimed at evading detection, as no evasion signals were noted. 5. **Command and Control (C2)**: There were no network connections established during the execution, indicating a lack of observable command and control activity. 6. **Impact**: The behavior summary does not provide evidence of any harmful impact on the system, as the operations primarily involved reading system files and executing a script without any apparent malicious actions. In conclusion, while the sample executed and displayed some capabilities, the lack of persistence, C2 activity, and observable impact leads to a neutral assessment. The sample does not appear to exhibit malicious behavior based on the available evidence.

No evasive checkpoints detected.

The Sigma corpus was evaluated against this run's processes, registry, file, network, DNS and script activity. Nothing matched.

alert http any any -> any any (msg:"sandbox auto scan 2385 C2 URL"; http.uri; content:"/download_and_run.sh"; sid:15978048; rev:1;)

rule auto_file_2385_yara
{
    meta:
        description = "Auto-generated from scan 2385"
        author = "sandbox auto-generator"
        anchors = "3 independent regions"
    strings:
        $s0 = "commands=(" ascii fullword
        $s1 = "echo \"Running command: $cmd\"" ascii fullword
        $s2 = "echo \"Command finished\"" ascii fullword
    condition:
        filesize < 65536 and all of them
}

The report downloads - PCAP and the SIEM/TIP exports - are a paid-plan feature. Sign in with a paid plan to export this report.

An enterprise report with an AI-written executive summary, threat assessment, kill chain, and recommendations, plus the derived evidence (verdict, MITRE ATT&CK, network, file modifications, dropped files, IOCs) and screenshots. The AI narrative is built from derived analysis data only, so the raw sample never leaves the host (no-upload and AI-boundary preserved).