Analysis
- max time kernel
150s - max time network
151s - platform
debian-9_mips - resource
debian9-mipsbe-20250619-en - resource tags
arch:mipsimage:debian9-mipsbe-20250619-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem - submitted
16/11/2025, 23:25
Behavioral task
behavioral1
Sample
morte.mips.elf
Resource
debian9-mipsbe-20250619-en
debian-9-mips
7 signatures
150 seconds
General
- Target morte.mips.elf
- Size 47KB
- Sample251116-3ef8lstrgm
- SHA256 7ab71d3eea8507eac54876fd314c45baae3a10bf70a0fe2cc218dcde1bcea5e2
- MD5 df0bbb363d0720e25fc5ac9f419b32bd
- SHA1 23a4bcd939fd5ec99fcb2326e68c818c9541dcd9
- SHA512 a1cdb1d448ea562fda621e0b9a1b906e89de0d4531720316d55c54bcd571855ad949c203e2e22bcd77e98032b02842b68f859f81bdc672acfaa9964d8cc8b1de
- SSDEEP 768:MJleAAqyXWo2JUBBLszd4hrh4wQK4ekztYOGnR4QYyaYOJNsIJgGlzDpbuR1JTr:WeRDpJszUFSHek+OaR4Q7OJNpVJuJ
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
mirai
C2
-
vmr3b.bounceme.net
Signatures
- Mirai family
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog morte.mips.elf File opened for modification /dev/misc/watchdog morte.mips.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog morte.mips.elf File opened for modification /bin/watchdog morte.mips.elf -
description ioc Process File opened for reading /proc/12/status morte.mips.elf File opened for reading /proc/36/status morte.mips.elf File opened for reading /proc/74/status morte.mips.elf File opened for reading /proc/337/status morte.mips.elf File opened for reading /proc/665/status morte.mips.elf File opened for reading /proc/392/status morte.mips.elf File opened for reading /proc/22/status morte.mips.elf File opened for reading /proc/11/status morte.mips.elf File opened for reading /proc/1/status morte.mips.elf File opened for reading /proc/154/status morte.mips.elf File opened for reading /proc/179/status morte.mips.elf File opened for reading /proc/691/status morte.mips.elf File opened for reading /proc/692/status morte.mips.elf File opened for reading /proc/17/status morte.mips.elf File opened for reading /proc/73/status morte.mips.elf File opened for reading /proc/79/status morte.mips.elf File opened for reading /proc/82/status morte.mips.elf File opened for reading /proc/126/status morte.mips.elf File opened for reading /proc/348/status morte.mips.elf File opened for reading /proc/3/status morte.mips.elf File opened for reading /proc/4/status morte.mips.elf File opened for reading /proc/16/status morte.mips.elf File opened for reading /proc/162/status morte.mips.elf File opened for reading /proc/344/status morte.mips.elf File opened for reading /proc/399/status morte.mips.elf File opened for reading /proc/668/status morte.mips.elf File opened for reading /proc/701/status morte.mips.elf File opened for reading /proc/15/status morte.mips.elf File opened for reading /proc/75/status morte.mips.elf File opened for reading /proc/81/status morte.mips.elf File opened for reading /proc/697/status morte.mips.elf File opened for reading /proc/13/status morte.mips.elf File opened for reading /proc/2/status morte.mips.elf File opened for reading /proc/5/status morte.mips.elf File opened for reading /proc/18/status morte.mips.elf File opened for reading /proc/72/status morte.mips.elf File opened for reading /proc/127/status morte.mips.elf File opened for reading /proc/7/status morte.mips.elf File opened for reading /proc/14/status morte.mips.elf File opened for reading /proc/19/status morte.mips.elf File opened for reading /proc/77/status morte.mips.elf File opened for reading /proc/177/status morte.mips.elf File opened for reading /proc/8/status morte.mips.elf File opened for reading /proc/704/status morte.mips.elf File opened for reading /proc/674/status morte.mips.elf File opened for reading /proc/37/status morte.mips.elf File opened for reading /proc/110/status morte.mips.elf File opened for reading /proc/390/status morte.mips.elf File opened for reading /proc/698/status morte.mips.elf File opened for reading /proc/254/status morte.mips.elf File opened for reading /proc/647/status morte.mips.elf File opened for reading /proc/6/status morte.mips.elf File opened for reading /proc/24/status morte.mips.elf File opened for reading /proc/336/status morte.mips.elf File opened for reading /proc/380/status morte.mips.elf File opened for reading /proc/21/status morte.mips.elf File opened for reading /proc/10/status morte.mips.elf File opened for reading /proc/9/status morte.mips.elf File opened for reading /proc/339/status morte.mips.elf File opened for reading /proc/696/status morte.mips.elf File opened for reading /proc/700/status morte.mips.elf File opened for reading /proc/23/status morte.mips.elf File opened for reading /proc/70/status morte.mips.elf File opened for reading /proc/76/status morte.mips.elf - System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 700 morte.mips.elf