Sativa.tar.gz
- SHA256 a5500fe2db4ae07caea0cb6cf80156ff0f100c9a5ee7828d3f1d664d65a27c10
Overview
overview
10Static
static
10SativaC2.sh
ubuntu-18.04-amd64
7SativaC2.sh
debian-9-armhf
7SativaC2.sh
debian-9-mips
SativaC2.sh
debian-9-mipsel
a-r.m-4.sativac2
debian-12-armhf
6a-r.m-5.sativac2
debian-12-armhf
6a-r.m-7.sativac2
debian-12-armhf
6a-r.m-8.sativac2
ubuntu-18.04-amd64
a-r.m-8.sativac2
debian-9-armhf
a-r.m-8.sativac2
debian-9-mips
a-r.m-8.sativac2
debian-9-mipsel
arm64.sh
ubuntu-18.04-amd64
10arm64.sh
debian-9-armhf
10arm64.sh
debian-9-mips
arm64.sh
debian-9-mipsel
m-6.8-k.sativac2
ubuntu-18.04-amd64
m-6.8-k.sativac2
debian-9-armhf
m-6.8-k.sativac2
debian-9-mips
m-6.8-k.sativac2
debian-9-mipsel
m-i.p-s.sativac2
debian-9-mips
m-p.s-l.sativac2
debian-12-mipsel
6p-p.c-.sativac2
ubuntu-18.04-amd64
p-p.c-.sativac2
debian-9-armhf
p-p.c-.sativac2
debian-9-mips
p-p.c-.sativac2
debian-9-mipsel
payload.sh
ubuntu-18.04-amd64
7payload.sh
debian-9-armhf
7payload.sh
debian-9-mips
payload.sh
debian-9-mipsel
x-3.2-.sativac2
ubuntu-18.04-amd64
6x-8.6-.sativac2
ubuntu-18.04-amd64
6Behavioral task
behavioral1
Sample
SativaC2.sh
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
4 signatures
123 seconds
Behavioral task
behavioral2
Sample
SativaC2.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
6 signatures
123 seconds
Behavioral task
behavioral3
Sample
SativaC2.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
0 signatures
123 seconds
Behavioral task
behavioral4
Sample
SativaC2.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
0 signatures
123 seconds
Behavioral task
behavioral5
Sample
a-r.m-4.sativac2
Resource
debian12-armhf-20260127-en
debian-12-armhf
2 signatures
123 seconds
Behavioral task
behavioral6
Sample
a-r.m-5.sativac2
Resource
debian12-armhf-20260127-en
debian-12-armhf
2 signatures
123 seconds
Behavioral task
behavioral7
Sample
a-r.m-7.sativac2
Resource
debian12-armhf-20260513-en
debian-12-armhf
2 signatures
123 seconds
Behavioral task
behavioral8
Sample
a-r.m-8.sativac2
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
0 signatures
123 seconds
Behavioral task
behavioral9
Sample
a-r.m-8.sativac2
Resource
debian9-armhf-20260513-en
debian-9-armhf
0 signatures
123 seconds
Behavioral task
behavioral10
Sample
a-r.m-8.sativac2
Resource
debian9-mipsbe-20260513-en
debian-9-mips
0 signatures
123 seconds
Behavioral task
behavioral11
Sample
a-r.m-8.sativac2
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
0 signatures
123 seconds
Behavioral task
behavioral12
Sample
arm64.sh
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
5 signatures
123 seconds
Behavioral task
behavioral13
Sample
arm64.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
7 signatures
123 seconds
Behavioral task
behavioral14
Sample
arm64.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
0 signatures
123 seconds
Behavioral task
behavioral15
Sample
arm64.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
0 signatures
123 seconds
Behavioral task
behavioral16
Sample
m-6.8-k.sativac2
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
0 signatures
123 seconds
Behavioral task
behavioral17
Sample
m-6.8-k.sativac2
Resource
debian9-armhf-20260513-en
debian-9-armhf
0 signatures
123 seconds
Behavioral task
behavioral18
Sample
m-6.8-k.sativac2
Resource
debian9-mipsbe-20260513-en
debian-9-mips
0 signatures
123 seconds
Behavioral task
behavioral19
Sample
m-6.8-k.sativac2
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
0 signatures
123 seconds
Behavioral task
behavioral20
Sample
m-i.p-s.sativac2
Resource
debian9-mipsbe-20260513-en
debian-9-mips
0 signatures
123 seconds
Behavioral task
behavioral21
Sample
m-p.s-l.sativac2
Resource
debian12-mipsel-20260513-en
debian-12-mipsel
2 signatures
123 seconds
Behavioral task
behavioral22
Sample
p-p.c-.sativac2
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
0 signatures
123 seconds
Behavioral task
behavioral23
Sample
p-p.c-.sativac2
Resource
debian9-armhf-20260513-en
debian-9-armhf
0 signatures
123 seconds
Behavioral task
behavioral24
Sample
p-p.c-.sativac2
Resource
debian9-mipsbe-20260513-en
debian-9-mips
0 signatures
123 seconds
Behavioral task
behavioral25
Sample
p-p.c-.sativac2
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
0 signatures
123 seconds
Behavioral task
behavioral26
Sample
payload.sh
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
4 signatures
123 seconds
Behavioral task
behavioral27
Sample
payload.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
6 signatures
123 seconds
Behavioral task
behavioral28
Sample
payload.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
0 signatures
123 seconds
Behavioral task
behavioral29
Sample
payload.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
0 signatures
123 seconds
Behavioral task
behavioral30
Sample
x-3.2-.sativac2
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
2 signatures
123 seconds
Behavioral task
behavioral31
Sample
x-8.6-.sativac2
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
2 signatures
123 seconds
General
- Target Sativa.tar.gz
- Size 733KB
- Sample260702-atv14agy6k
- SHA256 a5500fe2db4ae07caea0cb6cf80156ff0f100c9a5ee7828d3f1d664d65a27c10
- MD5 722fd12b2281a32edd2655f188300767
- SHA1 6c89923349d0ad4b707e93d492698fcfe86a2e8b
- SHA512 5b53a9a69943c345154ecdf4e842d59e7ead3245caa300c5bd635fc29ec9f046404b5df393fe0dfdaec88e17164c9640c1373c25b3655d46189e67bda41df62d
- SSDEEP 12288:3hfCKv8gMVwne6zmmJuokZqLEEsLdwAxG4S+OdaEl6N+zduKeHzXMPeWGckg8Nmp:Jhv1ZeLmJuoko4NLdq6Od8+zovHLeeWz
- TLSH T1BEF43375F0F421975A3EDE2E850DB55FCD19716E81B3EBAF0BBA120840B5E831B42276
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
gafgyt
C2
-
85.204.125.67:8080
-
85.204.125.67:12345
Signatures
- Detected Gafgyt variant 11 IoCs
resource yara_rule static1/unpack001/Sativa.tar family_gafgyt static1/unpack002/a-r.m-4.SativaC2 family_gafgyt static1/unpack002/a-r.m-5.SativaC2 family_gafgyt static1/unpack002/a-r.m-7.SativaC2 family_gafgyt static1/unpack002/a-r.m-8.SativaC2 family_gafgyt static1/unpack002/m-6.8-k.SativaC2 family_gafgyt static1/unpack002/m-i.p-s.SativaC2 family_gafgyt static1/unpack002/m-p.s-l.SativaC2 family_gafgyt static1/unpack002/p-p.c-.SativaC2 family_gafgyt static1/unpack002/x-3.2-.SativaC2 family_gafgyt static1/unpack002/x-8.6-.SativaC2 family_gafgyt
File Explorer
-
Sativa.tar.gz.gz 733KB
-
Sativa.tar.tar 1.5MB
-
SativaC2.sh.sh.sh 4KB
-
a-r.m-4.SativaC2.elf 134KB
-
a-r.m-5.SativaC2.elf 134KB
-
a-r.m-7.SativaC2.elf 125KB
-
a-r.m-8.SativaC2.elf 227KB
-
arm64.sh.sh.sh 579B
-
m-6.8-k.SativaC2.elf 121KB
-
m-i.p-s.SativaC2.elf 187KB
-
m-p.s-l.SativaC2.elf 187KB
-
p-p.c-.SativaC2.elf 171KB
-
payload.sh.sh.sh 4KB
-
x-3.2-.SativaC2.elf 119KB
-
x-8.6-.SativaC2.elf 105KB
Sativa.tar
- SHA256 8bcd77e7020e1879c2da17ceca543b72bbc552159c190cbc3b5e1bc6f101ff7d
- MD5 8453a681582277bfee14ec4e579540f2
- SHA1 bb514057e09ad88299fadbc02c3390688db0b1cf
- SHA512 bb9db584bf2dea9c561f04e21c23408d455a53919def8d61a8e96067eefd344abeb067594875674897e2a02d62c91bf8e2f2a5e1ba9a605fedb03aebd9867d2f
- SSDEEP 24576:INIFO+ZLIFO+SI2gPIHZMok1bI4lgDUocBA1ePtngEn1OSUORYtngEQg/mXx3se8:IWPZ0PFfIHZMosfdnAA1NnES+N/G8/5v
- TLSH T124759E45FB009B63C0D546329AAB830233727A51FBDA7706B51CBF283EA37594D5B788
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Gafgyt variant
SativaC2.sh.sh
- SHA256 3a93967ea364b1efaf1c20d04071ae5a2fcb66fc453259851d2f85544506e246
- MD5 40c0d610792cb03b8dcbda5395fc87d2
- SHA1 950554588813a8fd150ed0f2197681d1ce07165c
- SHA512 54c8bce64908bcccb4e6a263ec8f03872c039b25c3256a00daa0386d6de12668b0133a1794456420a249c647586cbc6687c9bde4fa3fe73b661023dbf29b4d29
- SSDEEP 48:JH56NgMqqfVFisPUBckaryaC1d3sJmKB1Os13WxHs1Cy183yml1MBAne1V4i1rYO:JH589nj0cRmZpUBNcTAOs9oQXck
- TLSH T197A13FE770319139A4468D2072BC90D16EBAA49AECC09ECE70526E146D7FCC47F36A73
- MD5 SHA1 SHA512 SSDEEP TLSH
a-r.m-4.SativaC2
- SHA256 2f5c6c94cc34b38d13d6f6222bb54ca64bb97d3345c9df4b703b43385a8bb47e
- MD5 bf455d7ad9755a4108dbdbf0363ca9dd
- SHA1 1871941b511cff63834f1a898b3c7a1aab9765ee
- SHA512 5292398425a158b171d9dde7106cbb118d18116247a6bba554b89de40cf805f0cb0f2fdde795e88c68303f5ffa4915c20123dd6698b5c704b6a96d11ed94cc9b
- SSDEEP 3072:cxUWRN0+T7b4m/C+acJp6+NsvfJqlXKjiZnCMhqIFO+:cK3K4m/C+O+WJLjiZn/qIFO+
- TLSH T148D31A5DB440CB23C5D1263AFA9E524833735B65FFEE370699187F343BD26298E2A601
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Gafgyt variant
a-r.m-5.SativaC2
- SHA256 8c2ffc06877098d6202e3a46f23218a74274927cd51b48ca4e3f9feb3a6013da
- MD5 94ff7908ae6d6384ececb1cd000742ee
- SHA1 1fc7be44c69a995e4f7aaa42a5c6959a6182f368
- SHA512 8e16777eaa9d1aa739816020dcdb9ea3fab2bbbc7e054cf74afab104e513983cb1e9a59237e011c48868a15964ca7ceceb07d5fb5f9f3f084e345279ca454b34
- SSDEEP 3072:wxUWRN0+T7b4m/C+acJp6+NsvfJqlXKjiDaMhqIFO+:wK3K4m/C+O+WJLjiDHqIFO+
- TLSH T1D3D31A5DB440CB13C5D1263AFA9E524833735B64FFEE370699197F343BD26298E2A601
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Gafgyt variant
a-r.m-7.SativaC2
- SHA256 1abaa88dccd65608f8247a88a0faed3bd645fdda15b302bb61ccc8a942eeda20
- MD5 b95c5485ce366313cacc94a092abc0e7
- SHA1 928efa2d25c7ebd93216244743b3f71541f82c52
- SHA512 721b52f0f4b62a5ba80664476b0a827deaa7c9ca2d399e77f18e16f9b6ac5b78a4d9e9298b7bc5e76cc1dcf3fb876b4581d7cd525e1549c279ce524336d38868
- SSDEEP 3072:FlYJxGsF7jFgc9u8ahV3rxz1zWkiPDplI2gP:FuJxrXgc9u8ebxQkiPPI2gP
- TLSH T164C3195DB440CB62C5D1263AFA9F424833735724EFEE370699186F383AD752A8E3A705
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Gafgyt variant
a-r.m-8.SativaC2
- SHA256 0f50037a4a75241877efc3b33f243a4239995049fd459fff2b455dac8d33f300
- MD5 f24bf31674a00940cb5090dbc80f4caf
- SHA1 113334c819fb6d99f2b9329143c5275c85f5c1a1
- SHA512 947101ce9fe73fda4e371e292970931bd7a97492805a6930dff956225e7f1f852663915a85f2f4648c6fbdd34cd4abc8a49533f57b2569440fcce2fc5c1f1fad
- SSDEEP 6144:w0c8M+ykO9ptKJZHQWCcLohjE0C5bxbeP4l:ascsxQWCMoh21bI4l
- TLSH T1E4348E48BB4CEB06C0A083FB9D5F0723633134517B8A9B227919662EFDD27DC8C5665E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Gafgyt variant
arm64.sh.sh
- SHA256 5ca3b37534c5e8cc4bae90be04bcc719d287293e286b70e4f25231748d80c06e
- MD5 89dcad68f5b7c550376c890eaf656230
- SHA1 946d09448fca726ac4ab3c617a7d0d916809f33e
- SHA512 a3c999118b8843f99857205887d79d2e2d1911d1ae7bda7a225c2e0aaa339fcaf4e8f3536bbfdab404f86dd47d8609abe68a5859880362b2c100b2ea5bc06c8c
- TLSH T1BDF0F6EAA1A31C3A7C458E2531EC14F19A98A4B79CE09E0FA4052DD0F80EF04FA65633
- MD5 SHA1 SHA512 TLSH
m-6.8-k.SativaC2
- SHA256 55f400523d42b6e42c1084eae678651530884696c716fdef704f097e8df7842d
- MD5 b1bbb5555e726a7c3642e16b89c616bc
- SHA1 67049899ed23da15ac8318979e2d7f2dbc36b0f9
- SHA512 e2b7da2e17970bf4f15af3fa984cdb0649329f7e60db005185bf317ead8ce67485f9aca1d0d29d7dd1e975647af9488ac2475ecec068d0006c717f3a65951ff8
- SSDEEP 1536:FroaHzArCerO7ExptcSyAiWXJBC3v43JFg3sonBH074/N9h46yasQrAiXxIYBE8+:ZOrhtcSy8C3vMghBc4/V7soAZbU5ecB4
- TLSH T124C38F91735D3D6FC1B69E3A8483C3027F24EE10AA462613507DB7572EB32E11E6B6C6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Gafgyt variant
m-i.p-s.SativaC2
- SHA256 81d7f5ce799c3e86bc6e23eec6c1e1073c108e88551af7aca6e87de406698333
- MD5 21ea0ee841b8eced252e169843de7a32
- SHA1 eeb9bf578edcd9cfc97dd35cb16409affcee6118
- SHA512 284fb336eeb62856d5c82037c59eed5179bff4877bfbe1f91c85a841dfa1fd844bd129abca5736635027a10997bf763b1b8f615ff69486cde6b612b77ea2b235
- SSDEEP 3072:hM1ey7JnonhectCLu3rVCRC92sAnG41pfC/hjgbltd651R3tbTgERy:hM1eeocADw4KG4E9x5btngERy
- TLSH T108142A567B11AFA2C228C53009F3C35267F636D227D29549B26DDB187E213496C2FFE8
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Gafgyt variant
m-p.s-l.SativaC2
- SHA256 2761b6fec6aadf449090548926dd50e2de093cab254c97394eb350a226ab3054
- MD5 06fe3711f4526295fab9589005d887a5
- SHA1 9ea657de578ffcbd8efa875e604d19e24aaf36f4
- SHA512 80bf0b676ac7e477b9ebe262d4fe96f5df4418038fb7e6126889de0874f24c7c447195dfdb085c33692a9d635ee0d97b8b1d951ad33c815c1c02dfddc47de920
- SSDEEP 3072:0K1DpxJQhvn4L32bo97xrspaW16Xch6Ft1LpqVgbs+UcgAn+jtbTgE:0K1zWhS2bi7lCaW16XcctLxIvtjtngE
- TLSH T10E144B46BF505FEBC05ECF31066B831213E9D88653AA6B2E717C9A9C3D5A3494DC3AC4
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Gafgyt variant
p-p.c-.SativaC2
- SHA256 f9ad742f2618ecff013631ec4d08ee614065018c38430a522028996d990ef845
- MD5 c781fd476f35cbb56021b6440ef6ac3b
- SHA1 4afcded6378f1df5e79f392984c64afd9f6fe736
- SHA512 25b482c64e7f1928fe2315cec1440235e498e1eb750ed8000bf3470b47a5b9e8699a960636ee06452c487188d06ad49d43b1283925f8bf01f86a67c80ef5708d
- SSDEEP 3072:ygn4EaDryGygTACTzx5woZJKkSmb+T5BKl4EomRPcP6u/GZXxE:hn0rJPNTz/woZJKkSe0um466u/mXxE
- TLSH T1F5047D11FB1C1553C0821E705E3B0767A336958186B9E60E660D7F2A2B33AF64E877ED
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Gafgyt variant
payload.sh.sh
- SHA256 3a93967ea364b1efaf1c20d04071ae5a2fcb66fc453259851d2f85544506e246
- MD5 40c0d610792cb03b8dcbda5395fc87d2
- SHA1 950554588813a8fd150ed0f2197681d1ce07165c
- SHA512 54c8bce64908bcccb4e6a263ec8f03872c039b25c3256a00daa0386d6de12668b0133a1794456420a249c647586cbc6687c9bde4fa3fe73b661023dbf29b4d29
- SSDEEP 48:JH56NgMqqfVFisPUBckaryaC1d3sJmKB1Os13WxHs1Cy183yml1MBAne1V4i1rYO:JH589nj0cRmZpUBNcTAOs9oQXck
- TLSH T197A13FE770319139A4468D2072BC90D16EBAA49AECC09ECE70526E146D7FCC47F36A73
- MD5 SHA1 SHA512 SSDEEP TLSH
x-3.2-.SativaC2
- SHA256 779ff6d3f2d459a2fd99df9b3136612da7a8d4f73a74e2d5fb45709255f9616a
- MD5 053cdb305b0187d256d15383e9ae87dd
- SHA1 78ae9d0b0be6360f145ea582331bd38abba7da1d
- SHA512 43a0022dfc88a1740e315b0558a1c27c8f3f7cde90746ae95eff479bb6c81bc6bb24996d9d985cfaa96f9cc672e1cf3103c19c0fbbf6df111c17528762c3c5e6
- SSDEEP 3072:C7wqc7cLMU21kvbtalPTqU3AIgfDjhPAdcA:CZcjkTy2U8L9PAdcA
- TLSH T125C37B85F783C1F3E5830673056BDBAA4B31DD25420ADF46FB0E7A656D7260A8C5A32C
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Gafgyt variant
x-8.6-.SativaC2
- SHA256 77a88c19c58a48b22835c796fbd97471b891c6aeeb159c023a80912b7c3d6096
- MD5 45c93111ed9f802433768dfaae978002
- SHA1 a8174ea072d295075d65356fa788c7e84c28bf58
- SHA512 fcdc18b20faa2dde1ff3def57ca51534e651c8e378218d6561d1a25f4e6f3dfdae0955958f0033db0cd6584ca73d9f1e6aef2256647dc74e0d4124230013a93e
- SSDEEP 1536:Mr32xQzMb0BwHGyD65xFcQMHKJMA81CJcApZbUW/cO0EnMorBaqto0+dzSFzpG4o:MGxQgxmVxdMHuNJhbbOO99UqtOKpG4o
- TLSH T13AB34B02ADA1C0FEC0D6C53597DBD222F732BC5553117B2B3394AA353FA2F691B09658
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Gafgyt variant