SUSPICIOUS — build_zipslip_poc.py

SUSPICIOUS — build_zipslip_poc.py is a shell sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 0 of 53 detection engines flagged it.

Identification

• SHA-256: d2075b30a896e9c6b8f2571b583e7ec405355b78426b5009ae433824f9e94199
• SHA-1: 31413c445ac1dfcadc18651fbbcb2879bff63841
• MD5: 6e31e0f60ba1705affae9d79fb89afc9
• ssdeep: 96:E3wCYnV1+osoYpnQZqbQKIHYd01M1fggzaeMfOpKa0/neC+EfMjAPfaG8t89Z8cv:E6nH+osRnQZlKI4d0yV9zaNPaep3MjA5
• TLSH: T1F21CEAF03238E87F59A7C82B7F951A7DC9C2158731B04D7E2292D3866C90E41745906F
• Submitted as: build_zipslip_poc.py
• File type: shell · Size: 5475 bytes
• Verdict: suspicious (54/100)

Detections (0 of 53 engines)

No engine flagged this sample.

Why this verdict

The suspicious score of 54/100 is the fusion of 2 weighted signals:

• Obfuscated python script: download, defense-evasion (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• Embedded network infrastructure: https://malwareanalyzer.com/v1/submit - static signal, weight 0.35, confidence 0.60

Dynamic analysis (linux)

542 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• ntp.ubuntu.com
• 10.240.0.1
• 185.125.190.58
• ff02::16
• ff02::2
• 255.255.255.255
• ff02::1:ff12:3456

Embedded URLs

• https://malwareanalyzer.com/v1/submit

Embedded domains

• malwareanalyzer.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report