Overview
overview
10Static
static
10SativaC2.sh
ubuntu-18.04-amd64
7SativaC2.sh
debian-9-armhf
7SativaC2.sh
debian-9-mips
SativaC2.sh
debian-9-mipsel
a-r.m-4.sativac2
debian-12-armhf
6a-r.m-5.sativac2
debian-12-armhf
6a-r.m-7.sativac2
debian-12-armhf
6a-r.m-8.sativac2
ubuntu-18.04-amd64
a-r.m-8.sativac2
debian-9-armhf
a-r.m-8.sativac2
debian-9-mips
a-r.m-8.sativac2
debian-9-mipsel
arm64.sh
ubuntu-18.04-amd64
10arm64.sh
debian-9-armhf
10arm64.sh
debian-9-mips
arm64.sh
debian-9-mipsel
m-6.8-k.sativac2
ubuntu-18.04-amd64
m-6.8-k.sativac2
debian-9-armhf
m-6.8-k.sativac2
debian-9-mips
m-6.8-k.sativac2
debian-9-mipsel
m-i.p-s.sativac2
debian-9-mips
m-p.s-l.sativac2
debian-12-mipsel
6p-p.c-.sativac2
ubuntu-18.04-amd64
p-p.c-.sativac2
debian-9-armhf
p-p.c-.sativac2
debian-9-mips
p-p.c-.sativac2
debian-9-mipsel
payload.sh
ubuntu-18.04-amd64
7payload.sh
debian-9-armhf
7payload.sh
debian-9-mips
payload.sh
debian-9-mipsel
x-3.2-.sativac2
ubuntu-18.04-amd64
6x-8.6-.sativac2
ubuntu-18.04-amd64
6Analysis
- max time kernel
72s - max time network
94s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
02/07/2026, 00:30
Behavioral task
behavioral1
Sample
SativaC2.sh
Resource
ubuntu1804-amd64-20260513-en
Behavioral task
behavioral2
Sample
SativaC2.sh
Resource
debian9-armhf-20260513-en
Behavioral task
behavioral3
Sample
SativaC2.sh
Resource
debian9-mipsbe-20260513-en
Behavioral task
behavioral4
Sample
SativaC2.sh
Resource
debian9-mipsel-20260513-en
Behavioral task
behavioral5
Sample
a-r.m-4.sativac2
Resource
debian12-armhf-20260127-en
Behavioral task
behavioral6
Sample
a-r.m-5.sativac2
Resource
debian12-armhf-20260127-en
Behavioral task
behavioral7
Sample
a-r.m-7.sativac2
Resource
debian12-armhf-20260513-en
Behavioral task
behavioral8
Sample
a-r.m-8.sativac2
Resource
ubuntu1804-amd64-20260513-en
Behavioral task
behavioral9
Sample
a-r.m-8.sativac2
Resource
debian9-armhf-20260513-en
Behavioral task
behavioral10
Sample
a-r.m-8.sativac2
Resource
debian9-mipsbe-20260513-en
Behavioral task
behavioral11
Sample
a-r.m-8.sativac2
Resource
debian9-mipsel-20260513-en
Behavioral task
behavioral12
Sample
arm64.sh
Resource
ubuntu1804-amd64-20260513-en
Behavioral task
behavioral13
Sample
arm64.sh
Resource
debian9-armhf-20260513-en
Behavioral task
behavioral14
Sample
arm64.sh
Resource
debian9-mipsbe-20260513-en
Behavioral task
behavioral15
Sample
arm64.sh
Resource
debian9-mipsel-20260513-en
Behavioral task
behavioral16
Sample
m-6.8-k.sativac2
Resource
ubuntu1804-amd64-20260513-en
Behavioral task
behavioral17
Sample
m-6.8-k.sativac2
Resource
debian9-armhf-20260513-en
Behavioral task
behavioral18
Sample
m-6.8-k.sativac2
Resource
debian9-mipsbe-20260513-en
Behavioral task
behavioral19
Sample
m-6.8-k.sativac2
Resource
debian9-mipsel-20260513-en
Behavioral task
behavioral20
Sample
m-i.p-s.sativac2
Resource
debian9-mipsbe-20260513-en
Behavioral task
behavioral21
Sample
m-p.s-l.sativac2
Resource
debian12-mipsel-20260513-en
Behavioral task
behavioral22
Sample
p-p.c-.sativac2
Resource
ubuntu1804-amd64-20260513-en
Behavioral task
behavioral23
Sample
p-p.c-.sativac2
Resource
debian9-armhf-20260513-en
Behavioral task
behavioral24
Sample
p-p.c-.sativac2
Resource
debian9-mipsbe-20260513-en
Behavioral task
behavioral25
Sample
p-p.c-.sativac2
Resource
debian9-mipsel-20260513-en
Behavioral task
behavioral26
Sample
payload.sh
Resource
ubuntu1804-amd64-20260513-en
Behavioral task
behavioral27
Sample
payload.sh
Resource
debian9-armhf-20260513-en
Behavioral task
behavioral28
Sample
payload.sh
Resource
debian9-mipsbe-20260513-en
Behavioral task
behavioral29
Sample
payload.sh
Resource
debian9-mipsel-20260513-en
Behavioral task
behavioral30
Sample
x-3.2-.sativac2
Resource
ubuntu1804-amd64-20260513-en
Behavioral task
behavioral31
Sample
x-8.6-.sativac2
Resource
ubuntu1804-amd64-20260513-en
General
- Target x-8.6-.sativac2
- Size 105KB
- Sample260702-atv14agy6k
- SHA256 77a88c19c58a48b22835c796fbd97471b891c6aeeb159c023a80912b7c3d6096
- MD5 45c93111ed9f802433768dfaae978002
- SHA1 a8174ea072d295075d65356fa788c7e84c28bf58
- SHA512 fcdc18b20faa2dde1ff3def57ca51534e651c8e378218d6561d1a25f4e6f3dfdae0955958f0033db0cd6584ca73d9f1e6aef2256647dc74e0d4124230013a93e
- SSDEEP 1536:Mr32xQzMb0BwHGyD65xFcQMHKJMA81CJcApZbUW/cO0EnMorBaqto0+dzSFzpG4o:MGxQgxmVxdMHuNJhbbOO99UqtOKpG4o
- TLSH T13AB34B02ADA1C0FEC0D6C53597DBD222F732BC5553117B2B3394AA353FA2F691B09658
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/route x-8.6-.sativac2 - Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/route x-8.6-.sativac2