Analysis
- max time kernel
35s - max time network
37s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
02/08/2026, 05:06
Behavioral task
behavioral1
Sample
morte.x86_64
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
5 signatures
40 seconds
General
- Target morte.x86_64
- Size 46KB
- Sample260802-frffhsdl51
- SHA256 ab901b2408ef39103a2b44eccb0dd49a6fe3ba895a2f00e0fb0cc9e71890739c
- MD5 69967cb243a863a0c8071189186dc969
- SHA1 c8cfb8796fc0dbf34c3a151ad1961aeeab458fc8
- SHA512 891537459ad32c3863ae43d7779ce4f906be283987943c806833a617e9fa909dd66c652a37df0565629172b13fedae64923ee318c2271f4c6f10e4ced7476f6d
- SSDEEP 768:3DbdXXjWo86KJKMIw1tV+qWts83xxLFUGlkQNzEi/dyq49ld8N0sLFx05u:3DbdUbR5VAtt3349ldm5Au
- TLSH T12723F1B1C97FEFB0D439B8F18C486B8478ED655F5713875D249422A81EBBE205C12EE2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
mirai
C2
-
wqok85qtq.net
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog morte.x86_64 File opened for modification /dev/misc/watchdog morte.x86_64 - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog morte.x86_64 File opened for modification /bin/watchdog morte.x86_64 -
description ioc Process File opened for reading /proc/938/status morte.x86_64 File opened for reading /proc/1170/status morte.x86_64 File opened for reading /proc/1514/status morte.x86_64 File opened for reading /proc/1516/status morte.x86_64 File opened for reading /proc/6/status morte.x86_64 File opened for reading /proc/179/status morte.x86_64 File opened for reading /proc/329/status morte.x86_64 File opened for reading /proc/335/status morte.x86_64 File opened for reading /proc/24/status morte.x86_64 File opened for reading /proc/9/status morte.x86_64 File opened for reading /proc/454/status morte.x86_64 File opened for reading /proc/1190/status morte.x86_64 File opened for reading /proc/167/status morte.x86_64 File opened for reading /proc/170/status morte.x86_64 File opened for reading /proc/553/status morte.x86_64 File opened for reading /proc/1000/status morte.x86_64 File opened for reading /proc/1078/status morte.x86_64 File opened for reading /proc/1124/status morte.x86_64 File opened for reading /proc/1127/status morte.x86_64 File opened for reading /proc/1208/status morte.x86_64 File opened for reading /proc/98/status morte.x86_64 File opened for reading /proc/212/status morte.x86_64 File opened for reading /proc/565/status morte.x86_64 File opened for reading /proc/694/status morte.x86_64 File opened for reading /proc/974/status morte.x86_64 File opened for reading /proc/1079/status morte.x86_64 File opened for reading /proc/8/status morte.x86_64 File opened for reading /proc/10/status morte.x86_64 File opened for reading /proc/12/status morte.x86_64 File opened for reading /proc/1109/status morte.x86_64 File opened for reading /proc/1191/status morte.x86_64 File opened for reading /proc/1225/status morte.x86_64 File opened for reading /proc/1372/status morte.x86_64 File opened for reading /proc/481/status morte.x86_64 File opened for reading /proc/729/status morte.x86_64 File opened for reading /proc/1083/status morte.x86_64 File opened for reading /proc/1088/status morte.x86_64 File opened for reading /proc/1120/status morte.x86_64 File opened for reading /proc/1381/status morte.x86_64 File opened for reading /proc/137/status morte.x86_64 File opened for reading /proc/181/status morte.x86_64 File opened for reading /proc/182/status morte.x86_64 File opened for reading /proc/522/status morte.x86_64 File opened for reading /proc/1327/status morte.x86_64 File opened for reading /proc/36/status morte.x86_64 File opened for reading /proc/82/status morte.x86_64 File opened for reading /proc/84/status morte.x86_64 File opened for reading /proc/477/status morte.x86_64 File opened for reading /proc/1003/status morte.x86_64 File opened for reading /proc/1281/status morte.x86_64 File opened for reading /proc/278/status morte.x86_64 File opened for reading /proc/78/status morte.x86_64 File opened for reading /proc/25/status morte.x86_64 File opened for reading /proc/5/status morte.x86_64 File opened for reading /proc/11/status morte.x86_64 File opened for reading /proc/31/status morte.x86_64 File opened for reading /proc/251/status morte.x86_64 File opened for reading /proc/1121/status morte.x86_64 File opened for reading /proc/180/status morte.x86_64 File opened for reading /proc/478/status morte.x86_64 File opened for reading /proc/513/status morte.x86_64 File opened for reading /proc/1227/status morte.x86_64 File opened for reading /proc/1518/status morte.x86_64 File opened for reading /proc/79/status morte.x86_64