Analysis
- max time kernel
149s - max time network
151s - platform
debian-12_armhf - resource
debian12-armhf-20260513-en - resource tags
arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
02/08/2026, 01:54
Behavioral task
behavioral1
Sample
morte.arm7.elf
Resource
debian12-armhf-20260513-en
debian-12-armhf
4 signatures
150 seconds
General
- Target morte.arm7.elf
- Size 196KB
- Sample260802-cbq1jasara
- SHA256 6364e72f4838a6e1c487a15f8b373a950d0830fa94a275cebf247dd4820da676
- MD5 005f779a9116d7c06b92e4dcda352136
- SHA1 5610a0d1f77309fe1c46b295a82466ad652bdd73
- SHA512 224aa4a0f021bd721befb458118e444637676595f0d4f64cb7b72bcd8bb3137cc40da31f42a3b116198fb7e7316c1ed50e10d89f9665e4a22c8a6818854a9631
- SSDEEP 6144:fyL4oAzWZvkRlqaHjp7VcKBTLCMBkL93JgM/9Auug:fy89zWZ8RlqaHjp7VcKBPBIfZ/auR
- TLSH T18A145C46EA414E13C0D7137AB6AF424A333297A4D3DB73069D286FB43BC279E0E67645
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/misc/watchdog morte.arm7.elf File opened for modification /dev/watchdog morte.arm7.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog morte.arm7.elf File opened for modification /bin/watchdog morte.arm7.elf -
description ioc Process File opened for reading /proc/345/status morte.arm7.elf File opened for reading /proc/735/status morte.arm7.elf File opened for reading /proc/251/status morte.arm7.elf File opened for reading /proc/319/status morte.arm7.elf File opened for reading /proc/28/status morte.arm7.elf File opened for reading /proc/33/status morte.arm7.elf File opened for reading /proc/45/status morte.arm7.elf File opened for reading /proc/144/status morte.arm7.elf File opened for reading /proc/643/status morte.arm7.elf File opened for reading /proc/789/status morte.arm7.elf File opened for reading /proc/74/status morte.arm7.elf File opened for reading /proc/317/status morte.arm7.elf File opened for reading /proc/22/status morte.arm7.elf File opened for reading /proc/3/status morte.arm7.elf File opened for reading /proc/19/status morte.arm7.elf File opened for reading /proc/36/status morte.arm7.elf File opened for reading /proc/38/status morte.arm7.elf File opened for reading /proc/8/status morte.arm7.elf File opened for reading /proc/29/status morte.arm7.elf File opened for reading /proc/35/status morte.arm7.elf File opened for reading /proc/18/status morte.arm7.elf File opened for reading /proc/26/status morte.arm7.elf File opened for reading /proc/143/status morte.arm7.elf File opened for reading /proc/356/status morte.arm7.elf File opened for reading /proc/361/status morte.arm7.elf File opened for reading /proc/624/status morte.arm7.elf File opened for reading /proc/729/status morte.arm7.elf File opened for reading /proc/793/status morte.arm7.elf File opened for reading /proc/13/status morte.arm7.elf File opened for reading /proc/16/status morte.arm7.elf File opened for reading /proc/194/status morte.arm7.elf File opened for reading /proc/12/status morte.arm7.elf File opened for reading /proc/17/status morte.arm7.elf File opened for reading /proc/313/status morte.arm7.elf File opened for reading /proc/335/status morte.arm7.elf File opened for reading /proc/780/status morte.arm7.elf File opened for reading /proc/788/status morte.arm7.elf File opened for reading /proc/792/status morte.arm7.elf File opened for reading /proc/312/status morte.arm7.elf File opened for reading /proc/782/status morte.arm7.elf File opened for reading /proc/1/status morte.arm7.elf File opened for reading /proc/7/status morte.arm7.elf File opened for reading /proc/21/status morte.arm7.elf File opened for reading /proc/25/status morte.arm7.elf File opened for reading /proc/46/status morte.arm7.elf File opened for reading /proc/644/status morte.arm7.elf File opened for reading /proc/10/status morte.arm7.elf File opened for reading /proc/24/status morte.arm7.elf File opened for reading /proc/52/status morte.arm7.elf File opened for reading /proc/57/status morte.arm7.elf File opened for reading /proc/790/status morte.arm7.elf File opened for reading /proc/6/status morte.arm7.elf File opened for reading /proc/9/status morte.arm7.elf File opened for reading /proc/31/status morte.arm7.elf File opened for reading /proc/768/status morte.arm7.elf File opened for reading /proc/787/status morte.arm7.elf File opened for reading /proc/23/status morte.arm7.elf File opened for reading /proc/34/status morte.arm7.elf File opened for reading /proc/43/status morte.arm7.elf File opened for reading /proc/47/status morte.arm7.elf File opened for reading /proc/58/status morte.arm7.elf File opened for reading /proc/373/status morte.arm7.elf File opened for reading /proc/684/status morte.arm7.elf File opened for reading /proc/794/status morte.arm7.elf