Analysis
- max time kernel
135s - max time network
148s - platform
debian-12_armhf - resource
debian12-armhf-20250619-en - resource tags
arch:armhfimage:debian12-armhf-20250619-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
02/08/2025, 12:16
Behavioral task
behavioral1
Sample
morte.arm7.elf
Resource
debian12-armhf-20250619-en
debian-12-armhf
5 signatures
150 seconds
General
- Target morte.arm7.elf
- Size 173KB
- Sample250802-pfl9csskz5
- SHA256 83b783a95bd1c5d031559fa66571c98af6ded9532a582cf6c6cecf314ecb6b81
- MD5 c063f862c0c4d111bfc267c22ca9f6d2
- SHA1 37b30e7dc3631452fd01d4a39a866539341af579
- SHA512 febc873e5c6f3b9f4aabd1085eb300fb9257f8ba6fd9d4747f84febdb0c5acdd0c8cff0011ee3f2fcfae7019f07848556521e0e085c922b612d7ca393f40841d
- SSDEEP 3072:vpoGm6qQC7tpadghjHxNu4pcBTEoQ8pnPMXZzSpbWM/9UPHOU:BoGUJpa+hjHxN5cBTNpPMpzSpqM/9sJ
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
-
description ioc Process File deleted /var/log/audit/audit.log morte.arm7.elf - Deletes journal logs 1 TTPs 1 IoCs
Deletes systemd journal logs. Likely to evade detection.
description ioc Process File deleted /var/log/journal/65779e181e584f059cb9deb1099989c3/system.journal morte.arm7.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself /usr/lib/udisks2/udisksd 787 morte.arm7.elf -
description ioc Process File opened for reading /proc/803/stat morte.arm7.elf File opened for reading /proc/17/stat morte.arm7.elf File opened for reading /proc/36/stat morte.arm7.elf File opened for reading /proc/56/stat morte.arm7.elf File opened for reading /proc/57/stat morte.arm7.elf File opened for reading /proc/762/stat morte.arm7.elf File opened for reading /proc/22/stat morte.arm7.elf File opened for reading /proc/198/stat morte.arm7.elf File opened for reading /proc/200/stat morte.arm7.elf File opened for reading /proc/320/stat morte.arm7.elf File opened for reading /proc/362/stat morte.arm7.elf File opened for reading /proc/4/stat morte.arm7.elf File opened for reading /proc/14/stat morte.arm7.elf File opened for reading /proc/28/stat morte.arm7.elf File opened for reading /proc/45/stat morte.arm7.elf File opened for reading /proc/142/stat morte.arm7.elf File opened for reading /proc/344/stat morte.arm7.elf File opened for reading /proc/348/stat morte.arm7.elf File opened for reading /proc/735/stat morte.arm7.elf File opened for reading /proc/787/fd/0 morte.arm7.elf File opened for reading /proc/3/stat morte.arm7.elf File opened for reading /proc/9/stat morte.arm7.elf File opened for reading /proc/29/stat morte.arm7.elf File opened for reading /proc/30/stat morte.arm7.elf File opened for reading /proc/51/stat morte.arm7.elf File opened for reading /proc/218/stat morte.arm7.elf File opened for reading /proc/648/stat morte.arm7.elf File opened for reading /proc/6/stat morte.arm7.elf File opened for reading /proc/20/stat morte.arm7.elf File opened for reading /proc/34/stat morte.arm7.elf File opened for reading /proc/143/stat morte.arm7.elf File opened for reading /proc/321/stat morte.arm7.elf File opened for reading /proc/340/stat morte.arm7.elf File opened for reading /proc/380/stat morte.arm7.elf File opened for reading /proc/632/stat morte.arm7.elf File opened for reading /proc/7/stat morte.arm7.elf File opened for reading /proc/16/stat morte.arm7.elf File opened for reading /proc/23/stat morte.arm7.elf File opened for reading /proc/32/stat morte.arm7.elf File opened for reading /proc/73/stat morte.arm7.elf File opened for reading /proc/775/stat morte.arm7.elf File opened for reading /proc/42/stat morte.arm7.elf File opened for reading /proc/313/stat morte.arm7.elf File opened for reading /proc/792/stat morte.arm7.elf File opened for reading /proc/804/stat morte.arm7.elf File opened for reading /proc/8/stat morte.arm7.elf File opened for reading /proc/13/stat morte.arm7.elf File opened for reading /proc/35/stat morte.arm7.elf File opened for reading /proc/193/stat morte.arm7.elf File opened for reading /proc/649/stat morte.arm7.elf File opened for reading /proc/26/stat morte.arm7.elf File opened for reading /proc/33/stat morte.arm7.elf File opened for reading /proc/44/stat morte.arm7.elf File opened for reading /proc/369/stat morte.arm7.elf File opened for reading /proc/658/stat morte.arm7.elf File opened for reading /proc/787/stat morte.arm7.elf File opened for reading /proc/2/stat morte.arm7.elf File opened for reading /proc/18/stat morte.arm7.elf File opened for reading /proc/621/stat morte.arm7.elf File opened for reading /proc/633/stat morte.arm7.elf File opened for reading /proc/802/stat morte.arm7.elf File opened for reading /proc/805/stat morte.arm7.elf File opened for reading /proc/806/stat morte.arm7.elf File opened for reading /proc/19/stat morte.arm7.elf