Analysis
- max time kernel
107s - max time network
152s - platform
debian-9_mips - resource
debian9-mipsbe-20260513-en - resource tags
arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem - submitted
27/05/2026, 07:00
Behavioral task
behavioral1
Sample
morte.mips.elf
Resource
debian9-mipsbe-20260513-en
debian-9-mips
7 signatures
150 seconds
General
- Target morte.mips.elf
- Size 338KB
- Sample260527-hs3csags4m
- SHA256 68ad31ff542dbff7145554463983a69eebc6247a9c560442eac5d82adcc8609b
- MD5 c48c0295bb67a683efcb027931368ca5
- SHA1 2f2bf96c6b4bf29ae9964fff52b6917d52bcf1f7
- SHA512 451476dd4eb224bde33adcce8a990a6eff4cef3c00e1cbe997291d613718b71d4693726271845f992c1372a1c799de1ee3a5b670ec17aee5808a33159cf2390b
- SSDEEP 3072:J9Rs/N/h+sFx1c/C+84wiXhb+A9GDWUO+joCIZgwT:tOhuh84wiXZnANrjoXHT
- TLSH T1B77486179D258965F1648CF223773241A84783BB88E622D3EA6E4DA1BF3091F517FEC1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Contacts a large (94551) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog morte.mips.elf File opened for modification /dev/misc/watchdog morte.mips.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog morte.mips.elf File opened for modification /bin/watchdog morte.mips.elf -
description ioc Process File opened for reading /proc/658/status morte.mips.elf File opened for reading /proc/661/status morte.mips.elf File opened for reading /proc/708/status morte.mips.elf File opened for reading /proc/17/status morte.mips.elf File opened for reading /proc/21/status morte.mips.elf File opened for reading /proc/37/status morte.mips.elf File opened for reading /proc/6/status morte.mips.elf File opened for reading /proc/16/status morte.mips.elf File opened for reading /proc/82/status morte.mips.elf File opened for reading /proc/105/status morte.mips.elf File opened for reading /proc/151/status morte.mips.elf File opened for reading /proc/324/status morte.mips.elf File opened for reading /proc/710/status morte.mips.elf File opened for reading /proc/2/status morte.mips.elf File opened for reading /proc/14/status morte.mips.elf File opened for reading /proc/70/status morte.mips.elf File opened for reading /proc/229/status morte.mips.elf File opened for reading /proc/355/status morte.mips.elf File opened for reading /proc/370/status morte.mips.elf File opened for reading /proc/695/status morte.mips.elf File opened for reading /proc/24/status morte.mips.elf File opened for reading /proc/662/status morte.mips.elf File opened for reading /proc/700/status morte.mips.elf File opened for reading /proc/8/status morte.mips.elf File opened for reading /proc/15/status morte.mips.elf File opened for reading /proc/352/status morte.mips.elf File opened for reading /proc/699/status morte.mips.elf File opened for reading /proc/701/status morte.mips.elf File opened for reading /proc/19/status morte.mips.elf File opened for reading /proc/75/status morte.mips.elf File opened for reading /proc/116/status morte.mips.elf File opened for reading /proc/167/status morte.mips.elf File opened for reading /proc/371/status morte.mips.elf File opened for reading /proc/674/status morte.mips.elf File opened for reading /proc/77/status morte.mips.elf File opened for reading /proc/325/status morte.mips.elf File opened for reading /proc/694/status morte.mips.elf File opened for reading /proc/703/status morte.mips.elf File opened for reading /proc/1/status morte.mips.elf File opened for reading /proc/13/status morte.mips.elf File opened for reading /proc/76/status morte.mips.elf File opened for reading /proc/9/status morte.mips.elf File opened for reading /proc/11/status morte.mips.elf File opened for reading /proc/382/status morte.mips.elf File opened for reading /proc/655/status morte.mips.elf File opened for reading /proc/3/status morte.mips.elf File opened for reading /proc/321/status morte.mips.elf File opened for reading /proc/67/status morte.mips.elf File opened for reading /proc/385/status morte.mips.elf File opened for reading /proc/400/status morte.mips.elf File opened for reading /proc/4/status morte.mips.elf File opened for reading /proc/80/status morte.mips.elf File opened for reading /proc/709/status morte.mips.elf File opened for reading /proc/10/status morte.mips.elf File opened for reading /proc/22/status morte.mips.elf File opened for reading /proc/36/status morte.mips.elf File opened for reading /proc/68/status morte.mips.elf File opened for reading /proc/7/status morte.mips.elf File opened for reading /proc/12/status morte.mips.elf File opened for reading /proc/18/status morte.mips.elf File opened for reading /proc/69/status morte.mips.elf File opened for reading /proc/74/status morte.mips.elf File opened for reading /proc/115/status morte.mips.elf File opened for reading /proc/144/status morte.mips.elf - System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 703 morte.mips.elf