File name:

morte.x86_64.elf

Full analysis: https://app.any.run/tasks/058e35cb-271b-4f20-ab40-ff90591c2814
Verdict: Malicious activity
Analysis date: July 06, 2025, 05:49:25
OS: Ubuntu 22.04.2
MIME: application/x-executable
File info: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, no section header
MD5:

BD8209D013F4EEECE8891164F7860E7A

SHA1:

92C6FF32BFA7B9EAF6C1FA38B8692C2BA269BDF9

SHA256:

6D6CD3CE8DFBEA00297056FD7159AAE4E4333698CFBEBC20C50657A441164E39

SSDEEP:

768:G45lNEK29o0ILzDfdDn31uwtuVLwNWp45ykAYAYkTwiZVLUcK5vdF8f:p5lXLzrdJLkWop4gkAYy0ivUcOFo

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Adds/modifies system service, likely for persistence

      • morte.x86_64.elf (PID: 41417)

    • Application was dropped or rewritten from another process

      • morte.x86_64.elf (PID: 41422)
      • morte.x86_64.elf (PID: 41421)
      • morte.x86_64.elf (PID: 41416)
      • morte.x86_64.elf (PID: 41415)
      • morte.x86_64.elf (PID: 41420)
      • morte.x86_64.elf (PID: 41408)
      • morte.x86_64.elf (PID: 41417)

  • SUSPICIOUS

    • Modifies file or directory owner

      • sudo (PID: 41403)

    • Creates shell script file

      • cp (PID: 41419)

    • Reads network configuration

      • morte.x86_64.elf (PID: 41417)

    • Creates or rewrites file in the "bin" folder

      • cp (PID: 41419)

    • Executes commands using command-line interpreter

      • sudo (PID: 41406)

    • Gets active TCP connections

      • morte.x86_64.elf (PID: 41417)

    • Reads passwd file

      • dbus-daemon (PID: 41434)
      • dbus-daemon (PID: 41528)

    • Reads /proc/mounts (likely used to find writable filesystems)

      • dbus-daemon (PID: 41434)
      • dbus-daemon (PID: 41528)

    • Check the Environment Variables Related to System Identification (os-release)

      • snapctl (PID: 41481)
      • snapd-desktop-integration (PID: 41510)
      • snapctl (PID: 41557)
      • snapctl (PID: 41550)
      • snapd-desktop-integration (PID: 41435)
      • snapctl (PID: 41476)

    • Checks DMI information (probably VM detection)

      • udevadm (PID: 41464)
      • udevadm (PID: 41584)

  • INFO

    • Checks timezone

      • dbus-daemon (PID: 41434)
      • dbus-daemon (PID: 41528)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.o | ELF Executable and Linkable format (generic) (100)

EXIF

EXE

CPUArchitecture: 64 bit
CPUByteOrder: Little endian
ObjectFileType: Executable file
CPUType: AMD x86-64
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
222
Monitored processes
89
Malicious processes
1
Suspicious processes
3

Behavior graph

Click at the process to see the details
dash no specs sudo no specs chown no specs chmod no specs sudo no specs morte.x86_64.elf no specs locale-check no specs bash no specs dash no specs tr no specs cat no specs mesg no specs morte.x86_64.elf no specs morte.x86_64.elf no specs morte.x86_64.elf no specs dash no specs cp no specs morte.x86_64.elf morte.x86_64.elf no specs morte.x86_64.elf no specs fusermount3 no specs dbus-daemon no specs snapd-desktop-integration no specs snap-seccomp no specs xdg-document-portal no specs xdg-permission-store no specs fusermount3 no specs udevadm no specs snap-confine no specs snap-confine no specs date no specs chmod no specs grep no specs snapctl no specs snapctl no specs xdg-user-dirs-update no specs bash no specs realpath no specs bash no specs realpath no specs bash no specs realpath no specs bash no specs realpath no specs bash no specs realpath no specs bash no specs realpath no specs bash no specs realpath no specs bash no specs realpath no specs ln no specs snapd-desktop-integration no specs fusermount3 no specs snapd-desktop-integration no specs snap-seccomp no specs dbus-daemon no specs xdg-document-portal no specs xdg-permission-store no specs fusermount3 no specs snap-confine no specs snap-confine no specs date no specs chmod no specs grep no specs snapctl no specs snapctl no specs xdg-user-dirs-update no specs bash no specs realpath no specs bash no specs realpath no specs bash no specs realpath no specs bash no specs realpath no specs bash no specs realpath no specs bash no specs realpath no specs bash no specs realpath no specs bash no specs realpath no specs ln no specs snapd-desktop-integration no specs udevadm no specs fusermount3 no specs

Process information

PID
CMD
Path
Indicators
Parent process
41402/bin/sh -c "sudo chown user /home/user/Desktop/morte\.x86_64\.elf && chmod +x /home/user/Desktop/morte\.x86_64\.elf && DISPLAY=:0 sudo -i /home/user/Desktop/morte\.x86_64\.elf "/usr/bin/dash—UbvyYXL4x2mYa65Q
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libc.so.6
41403sudo chown user /home/user/Desktop/morte.x86_64.elf/usr/bin/sudo—dash
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libaudit.so.1.0.0
/usr/lib/x86_64-linux-gnu/libselinux.so.1
/usr/libexec/sudo/libsudo_util.so.0.0.0
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libcap-ng.so.0.0.0
/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4
/usr/lib/x86_64-linux-gnu/libnss_systemd.so.2
/usr/libexec/sudo/sudoers.so
/usr/lib/x86_64-linux-gnu/libpam.so.0.85.1
/usr/lib/x86_64-linux-gnu/libz.so.1.2.11
41404chown user /home/user/Desktop/morte.x86_64.elf/usr/bin/chown—sudo
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libc.so.6
41405chmod +x /home/user/Desktop/morte.x86_64.elf/usr/bin/chmod—dash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libc.so.6
41406sudo -i /home/user/Desktop/morte.x86_64.elf/usr/bin/sudo—dash
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libaudit.so.1.0.0
/usr/lib/x86_64-linux-gnu/libselinux.so.1
/usr/libexec/sudo/libsudo_util.so.0.0.0
/usr/lib/x86_64-linux-gnu/libc.so.6
/usr/lib/x86_64-linux-gnu/libcap-ng.so.0.0.0
/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.10.4
/usr/lib/x86_64-linux-gnu/libnss_systemd.so.2
/usr/libexec/sudo/sudoers.so
/usr/lib/x86_64-linux-gnu/libpam.so.0.85.1
/usr/lib/x86_64-linux-gnu/libz.so.1.2.11
41408/home/user/Desktop/morte.x86_64.elf/home/user/Desktop/morte.x86_64.elf—sudo
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libtinfo.so.6.3
/usr/lib/x86_64-linux-gnu/libc.so.6
41409/usr/bin/locale-check C.UTF-8/usr/bin/locale-check—morte.x86_64.elf
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libc.so.6
41410-bash --login -c \/home\/user\/Desktop\/morte\.x86_64\.elf/usr/bin/bash—morte.x86_64.elf
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
41411sh -c "cat /usr/etc/debuginfod/*\.urls 2>/dev/null"/usr/bin/dash—bash
User:
root
Integrity Level:
UNKNOWN
Exit code:
256
Modules
Images
/usr/lib/x86_64-linux-gnu/libc.so.6
41412tr \n " "/usr/bin/tr—bash
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Modules
Images
/usr/lib/x86_64-linux-gnu/libc.so.6
Executable files
0
Suspicious files
1
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
41419cp/usr/bin/.sho
MD5:—
SHA256:—
41417morte.x86_64.elf/etc/init.d/sysdtext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
21
TCP/UDP connections
14
DNS requests
29
Threats
17

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
207.211.211.26:443
https://odrs.gnome.org/1.0/reviews/api/ratings
unknown
binary
1.47 Mb
whitelisted
—
—
GET
204
91.189.91.48:80
http://connectivity-check.ubuntu.com/
unknown
—
—
whitelisted
—
—
GET
204
185.125.190.98:80
http://connectivity-check.ubuntu.com/
unknown
—
—
whitelisted
—
—
GET
—
91.189.91.48:80
http://connectivity-check.ubuntu.com/
unknown
—
—
whitelisted
—
—
GET
200
195.181.170.19:443
https://odrs.gnome.org/1.0/reviews/api/ratings
unknown
binary
1.47 Mb
whitelisted
—
—
GET
204
185.125.190.48:80
http://connectivity-check.ubuntu.com/
unknown
—
—
whitelisted
—
—
GET
200
169.150.255.183:443
https://odrs.gnome.org/1.0/reviews/api/ratings
unknown
binary
1.47 Mb
whitelisted
—
—
POST
200
185.125.188.59:443
https://api.snapcraft.io/v2/snaps/refresh
unknown
binary
45.5 Kb
whitelisted
—
—
POST
200
185.125.188.58:443
https://api.snapcraft.io/v2/snaps/refresh
unknown
binary
45.5 Kb
whitelisted
—
—
POST
200
185.125.188.57:443
https://api.snapcraft.io/v2/snaps/refresh
unknown
binary
45.5 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
185.125.190.98:80
connectivity-check.ubuntu.com
Canonical Group Limited
GB
whitelisted
484
avahi-daemon
224.0.0.251:5353
—
—
—
unknown
—
—
91.189.91.48:80
connectivity-check.ubuntu.com
Canonical Group Limited
US
whitelisted
—
—
207.211.211.26:443
odrs.gnome.org
—
US
whitelisted
—
—
185.125.190.48:80
connectivity-check.ubuntu.com
Canonical Group Limited
GB
whitelisted
—
—
169.150.255.180:443
odrs.gnome.org
—
GB
whitelisted
—
—
185.125.188.59:443
api.snapcraft.io
Canonical Group Limited
GB
whitelisted
—
—
185.125.188.54:443
api.snapcraft.io
Canonical Group Limited
GB
whitelisted
512
snapd
185.125.188.54:443
api.snapcraft.io
Canonical Group Limited
GB
whitelisted
41420
morte.x86_64.elf
65.222.202.53:80
—
UUNET
US
unknown

DNS requests

Domain
IP
Reputation
connectivity-check.ubuntu.com
  • 2620:2d:4000:1::22
  • 2620:2d:4000:1::96
  • 2620:2d:4000:1::23
  • 2620:2d:4000:1::2a
  • 2620:2d:4002:1::197
  • 2620:2d:4002:1::198
  • 2620:2d:4000:1::98
  • 2620:2d:4002:1::196
  • 2001:67c:1562::24
  • 2620:2d:4000:1::97
  • 2620:2d:4000:1::2b
  • 2001:67c:1562::23
  • 91.189.91.48
  • 185.125.190.96
  • 91.189.91.96
  • 185.125.190.49
  • 185.125.190.98
  • 91.189.91.49
  • 185.125.190.18
  • 185.125.190.17
  • 185.125.190.48
  • 185.125.190.97
  • 91.189.91.97
  • 91.189.91.98
whitelisted
odrs.gnome.org
  • 207.211.211.26
  • 169.150.255.180
  • 195.181.175.40
  • 212.102.56.179
  • 37.19.194.80
  • 169.150.255.183
  • 195.181.170.19
  • 2a02:6ea0:c700::112
  • 2a02:6ea0:c700::11
  • 2a02:6ea0:c700::19
  • 2a02:6ea0:c700::101
  • 2a02:6ea0:c700::107
  • 2a02:6ea0:c700::18
  • 2a02:6ea0:c700::21
whitelisted
google.com
  • 142.250.186.110
  • 2a00:1450:4001:810::200e
whitelisted
api.snapcraft.io
  • 185.125.188.59
  • 185.125.188.54
  • 185.125.188.57
  • 185.125.188.58
  • 2620:2d:4000:1010::344
  • 2620:2d:4000:1010::2e6
  • 2620:2d:4000:1010::42
  • 2620:2d:4000:1010::117
whitelisted
10.100.168.192.in-addr.arpa
  • —
unknown
abc.galaxias.cc
  • —
unknown

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET DNS Query for .cc TLD
—
—
Potentially Bad Traffic
ET DNS Query for .cc TLD
—
—
Potentially Bad Traffic
ET DNS Query for .cc TLD
—
—
Potentially Bad Traffic
ET DNS Query for .cc TLD
—
—
Potentially Bad Traffic
ET DNS Query for .cc TLD
—
—
Potentially Bad Traffic
ET DNS Query for .cc TLD
—
—
Potentially Bad Traffic
ET DNS Query for .cc TLD
—
—
Potentially Bad Traffic
ET DNS Query for .cc TLD
—
—
Potentially Bad Traffic
ET DNS Query for .cc TLD
—
—
Potentially Bad Traffic
ET DNS Query for .cc TLD
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
morte.x86_64.elf