Overview

overview

10

Static

static

10

45ea54c012...d472b1

ubuntu-18.04-amd64

10

Analysis

  • max time kernel
    153s
  • max time network
    153s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20231215-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20231215-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    19-12-2023 23:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    45ea54c012452bacdec3954c06d472b1

  • Size

    1.1MB

  • MD5

    45ea54c012452bacdec3954c06d472b1

  • SHA1

    1f4ff076f09b74f660a6b83f6c0feb20d865266a

  • SHA256

    21ddba24a874c5afa2637a3644eaf14100c5fd9c87b4e51e2f4e65e7da69130c

  • SHA512

    3b82c81f75e89e26e6c11f0caa3983ad94268f463d301e9686d098bf0870d929c94a63da6fab579cb055f3223a733c4ab45e083cd33baf730b922aba412c336d

  • SSDEEP

    24576:4vRE7caCfKGPqVEDNLFxKsfawI+gIGYuuCol7r:4vREKfPqVE5jKsfawRHGVo7r

Score
10/10
mrblackantivmbotnetpersistencetrojan

Malware Config

Signatures

  • MrBlack Trojan

    IoT botnet which infects routers to be used for DDoS attacks.

    trojanbotnetmrblack
  • MrBlack trojan 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Modifies init.d 1 TTPs 2 IoCs

    Adds/modifies system service, likely for persistence.

    persistence
  • Reads system routing table 1 TTPs 1 IoCs

    Gets active network interfaces from /proc virtual filesystem.

  • Write file to user bin folder 1 TTPs 8 IoCs
  • Writes file to system bin folder 1 TTPs 1 IoCs
  • Reads system network configuration 1 TTPs 3 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

  • Reads runtime system information 15 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 4 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/45ea54c012452bacdec3954c06d472b1
    /tmp/45ea54c012452bacdec3954c06d472b1
    1⤵
      PID:1532
    • /bin/sh
      sh -c "ln -s /etc/init.d/QsystemsshMmt /etc/rc1.d/S97QsystemsshMmt"
      1⤵
        PID:1538
        • /bin/ln
          ln -s /etc/init.d/QsystemsshMmt /etc/rc1.d/S97QsystemsshMmt
          2⤵
            PID:1539
        • /bin/sh
          sh -c "ln -s /etc/init.d/QsystemsshMmt /etc/rc2.d/S97QsystemsshMmt"
          1⤵
            PID:1540
            • /bin/ln
              ln -s /etc/init.d/QsystemsshMmt /etc/rc2.d/S97QsystemsshMmt
              2⤵
                PID:1541
            • /bin/sh
              sh -c "ln -s /etc/init.d/QsystemsshMmt /etc/rc3.d/S97QsystemsshMmt"
              1⤵
                PID:1542
                • /bin/ln
                  ln -s /etc/init.d/QsystemsshMmt /etc/rc3.d/S97QsystemsshMmt
                  2⤵
                    PID:1543
                • /bin/sh
                  sh -c "ln -s /etc/init.d/QsystemsshMmt /etc/rc4.d/S97QsystemsshMmt"
                  1⤵
                    PID:1544
                    • /bin/ln
                      ln -s /etc/init.d/QsystemsshMmt /etc/rc4.d/S97QsystemsshMmt
                      2⤵
                        PID:1545
                    • /bin/sh
                      sh -c "ln -s /etc/init.d/QsystemsshMmt /etc/rc5.d/S97QsystemsshMmt"
                      1⤵
                        PID:1546
                        • /bin/ln
                          ln -s /etc/init.d/QsystemsshMmt /etc/rc5.d/S97QsystemsshMmt
                          2⤵
                            PID:1547
                        • /bin/sh
                          sh -c "mkdir -p /usr/bin/bsd-port"
                          1⤵
                            PID:1548
                            • /bin/mkdir
                              mkdir -p /usr/bin/bsd-port
                              2⤵
                              • Reads runtime system information
                              PID:1549
                          • /bin/sh
                            sh -c "cp -f /tmp/45ea54c012452bacdec3954c06d472b1 /usr/bin/bsd-port/knerl"
                            1⤵
                              PID:1550
                              • /bin/cp
                                cp -f /tmp/45ea54c012452bacdec3954c06d472b1 /usr/bin/bsd-port/knerl
                                2⤵
                                • Write file to user bin folder
                                • Reads runtime system information
                                PID:1551
                            • /bin/sh
                              sh -c /usr/bin/bsd-port/knerl
                              1⤵
                                PID:1553
                                • /usr/bin/bsd-port/knerl
                                  /usr/bin/bsd-port/knerl
                                  2⤵
                                  • Executes dropped EXE
                                  PID:1554
                              • /bin/sh
                                sh -c "mkdir -p /usr/bin"
                                1⤵
                                  PID:1556
                                  • /bin/mkdir
                                    mkdir -p /usr/bin
                                    2⤵
                                    • Reads runtime system information
                                    PID:1557
                                • /bin/sh
                                  sh -c "cp -f /tmp/45ea54c012452bacdec3954c06d472b1 /usr/bin/.sshd"
                                  1⤵
                                    PID:1558
                                    • /bin/cp
                                      cp -f /tmp/45ea54c012452bacdec3954c06d472b1 /usr/bin/.sshd
                                      2⤵
                                      • Write file to user bin folder
                                      • Reads runtime system information
                                      PID:1559
                                  • /bin/sh
                                    sh -c /usr/bin/.sshd
                                    1⤵
                                      PID:1561
                                      • /usr/bin/.sshd
                                        /usr/bin/.sshd
                                        2⤵
                                        • Executes dropped EXE
                                        PID:1562
                                    • /bin/sh
                                      sh -c "insmod /usr/lib/xpacket.ko"
                                      1⤵
                                        PID:1564
                                        • /sbin/insmod
                                          insmod /usr/lib/xpacket.ko
                                          2⤵
                                          • Reads runtime system information
                                          PID:1565
                                      • /bin/sh
                                        sh -c "ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux"
                                        1⤵
                                          PID:1572
                                          • /bin/ln
                                            ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux
                                            2⤵
                                              PID:1573
                                          • /bin/sh
                                            sh -c "ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux"
                                            1⤵
                                              PID:1574
                                              • /bin/ln
                                                ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux
                                                2⤵
                                                  PID:1576
                                              • /bin/sh
                                                sh -c "ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux"
                                                1⤵
                                                  PID:1577
                                                  • /bin/ln
                                                    ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux
                                                    2⤵
                                                      PID:1578
                                                  • /bin/sh
                                                    sh -c "ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux"
                                                    1⤵
                                                      PID:1579
                                                      • /bin/ln
                                                        ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux
                                                        2⤵
                                                          PID:1580
                                                      • /bin/sh
                                                        sh -c "ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux"
                                                        1⤵
                                                          PID:1581
                                                          • /bin/ln
                                                            ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux
                                                            2⤵
                                                              PID:1582
                                                          • /bin/sh
                                                            sh -c "mkdir -p /usr/bin/dpkgd"
                                                            1⤵
                                                              PID:1583
                                                              • /bin/mkdir
                                                                mkdir -p /usr/bin/dpkgd
                                                                2⤵
                                                                • Reads runtime system information
                                                                PID:1584
                                                            • /bin/sh
                                                              sh -c "cp -f /bin/ps /usr/bin/dpkgd/ps"
                                                              1⤵
                                                                PID:1585
                                                                • /bin/cp
                                                                  cp -f /bin/ps /usr/bin/dpkgd/ps
                                                                  2⤵
                                                                  • Write file to user bin folder
                                                                  • Reads runtime system information
                                                                  PID:1586
                                                              • /bin/sh
                                                                sh -c "mkdir -p /bin"
                                                                1⤵
                                                                  PID:1587
                                                                  • /bin/mkdir
                                                                    mkdir -p /bin
                                                                    2⤵
                                                                    • Reads runtime system information
                                                                    PID:1588
                                                                • /bin/sh
                                                                  sh -c "cp -f /usr/bin/bsd-port/knerl /bin/ps"
                                                                  1⤵
                                                                    PID:1589
                                                                    • /bin/cp
                                                                      cp -f /usr/bin/bsd-port/knerl /bin/ps
                                                                      2⤵
                                                                      • Writes file to system bin folder
                                                                      • Reads runtime system information
                                                                      PID:1590
                                                                  • /bin/sh
                                                                    sh -c "chmod 0755 /bin/ps"
                                                                    1⤵
                                                                      PID:1591
                                                                      • /bin/chmod
                                                                        chmod 0755 /bin/ps
                                                                        2⤵
                                                                          PID:1592
                                                                      • /bin/sh
                                                                        sh -c "cp -f /usr/bin/lsof /usr/bin/dpkgd/lsof"
                                                                        1⤵
                                                                          PID:1593
                                                                          • /bin/cp
                                                                            cp -f /usr/bin/lsof /usr/bin/dpkgd/lsof
                                                                            2⤵
                                                                            • Write file to user bin folder
                                                                            • Reads runtime system information
                                                                            PID:1594
                                                                        • /bin/sh
                                                                          sh -c "mkdir -p /usr/bin"
                                                                          1⤵
                                                                            PID:1595
                                                                            • /bin/mkdir
                                                                              mkdir -p /usr/bin
                                                                              2⤵
                                                                              • Reads runtime system information
                                                                              PID:1596
                                                                          • /bin/sh
                                                                            sh -c "cp -f /usr/bin/bsd-port/knerl /usr/bin/lsof"
                                                                            1⤵
                                                                              PID:1597
                                                                              • /bin/cp
                                                                                cp -f /usr/bin/bsd-port/knerl /usr/bin/lsof
                                                                                2⤵
                                                                                • Write file to user bin folder
                                                                                • Reads runtime system information
                                                                                PID:1598
                                                                            • /bin/sh
                                                                              sh -c "chmod 0755 /usr/bin/lsof"
                                                                              1⤵
                                                                                PID:1599
                                                                                • /bin/chmod
                                                                                  chmod 0755 /usr/bin/lsof
                                                                                  2⤵
                                                                                    PID:1600
                                                                                • /bin/sh
                                                                                  sh -c "insmod /usr/lib/xpacket.ko"
                                                                                  1⤵
                                                                                    PID:1601
                                                                                    • /sbin/insmod
                                                                                      insmod /usr/lib/xpacket.ko
                                                                                      2⤵
                                                                                      • Reads runtime system information
                                                                                      PID:1602

                                                                                  Network

                                                                                  MITRE ATT&CK Enterprise v15

                                                                                  Replay Monitor

                                                                                  Loading Replay Monitor...

                                                                                  Downloads

                                                                                  • /etc/init.d/QsystemsshMmt
                                                                                    Filesize

                                                                                    50B

                                                                                    MD5

                                                                                    f5f82114b5eec2fc05694de2237bf487

                                                                                    SHA1

                                                                                    4f11d45ccea3aeb2e8c70eecc7b6076d7ef844a2

                                                                                    SHA256

                                                                                    8dcef2f21829d9ee44a048e4d00a134a4fc7a4a2c982f2bd44cbcf4795246788

                                                                                    SHA512

                                                                                    ade4dfd67b282e0059e84d222aadb317c31ebd215edd8592f22a6199acdb6c2e159a1e7ef9197b470d1a45de7ae7e40787f5f1ce758e4532de76f0a09a378e7c

                                                                                    Download Submit

                                                                                  • /etc/init.d/selinux
                                                                                    Filesize

                                                                                    36B

                                                                                    MD5

                                                                                    caa27b819c9303446f702929874a00e8

                                                                                    SHA1

                                                                                    d24199c0e376edea3f822b215148cc0dc78364bf

                                                                                    SHA256

                                                                                    da9b535a14c6d9152857e211f14fb8da9056e84ba1b8d4dc27ab79c98264050b

                                                                                    SHA512

                                                                                    dcd9413eb2cb24d77f637edfc00ca0bb42229a1a3b0d84e29eff94a7b91aee6ee8c126c286a4b4103e01834d1c6aec9de09ffab3927e8de8015421005f31446e

                                                                                    Download Submit

                                                                                  • /tmp/Dest.cfg
                                                                                    Filesize

                                                                                    4B

                                                                                    MD5

                                                                                    35309226eb45ec366ca86a4329a2b7c3

                                                                                    SHA1

                                                                                    59c1c577a1380a9058d9cf86db4e0aea6a314988

                                                                                    SHA256

                                                                                    15310fd04ea64483103071a114d24163331cf0f957bf55bad9760b69b33b2aa0

                                                                                    SHA512

                                                                                    00066d42e36caacd2dfc684c36a017b8c9ab924f2ea4b1aaae8c920f4672cbeed2197aa997147058647b3b262b417a131c3ba70c659fe9e149ffdefd402d496e

                                                                                    Download Submit

                                                                                  • /tmp/notify.file
                                                                                    Filesize

                                                                                    37B

                                                                                    MD5

                                                                                    5d133abd645f93a8207db6789b8b98c9

                                                                                    SHA1

                                                                                    8c60c901365afa8e58d332ee677a673a899c1d75

                                                                                    SHA256

                                                                                    8a1140e908ad7cc7f4b92a454696a459f50ab4e1b89c9393f5439959ac6d0d54

                                                                                    SHA512

                                                                                    8da2e8893f9c79fa667573425e26ca2af97d4eb9dd757c96a1dabcd08be8f2f5b33826f1b4f5d63afa8567166e71596575281efbac050b1db24abb499f7d4c1e

                                                                                    Download Submit

                                                                                  • /usr/bin/bsd-port/conf.n
                                                                                    Filesize

                                                                                    69B

                                                                                    MD5

                                                                                    cf21f2144745fbc229f893fc37e76bfa

                                                                                    SHA1

                                                                                    18380efb998f7d513eabd2544c12ea2a548088c1

                                                                                    SHA256

                                                                                    ed4cecc8c915556bd1547dc54e47f95e5fd1d9d565b7c286eb21865192e3e00c

                                                                                    SHA512

                                                                                    af4d0c96e7594b352e6a395db93d86766378c1d721d618c42ed02b30e659f0b2b30da9d69b762af78ff86f8654e2e061ec33e2c11fc1d6c4c3180696fa858873

                                                                                    Download Submit

                                                                                  • /usr/bin/bsd-port/knerl
                                                                                    Filesize

                                                                                    1.1MB

                                                                                    MD5

                                                                                    45ea54c012452bacdec3954c06d472b1

                                                                                    SHA1

                                                                                    1f4ff076f09b74f660a6b83f6c0feb20d865266a

                                                                                    SHA256

                                                                                    21ddba24a874c5afa2637a3644eaf14100c5fd9c87b4e51e2f4e65e7da69130c

                                                                                    SHA512

                                                                                    3b82c81f75e89e26e6c11f0caa3983ad94268f463d301e9686d098bf0870d929c94a63da6fab579cb055f3223a733c4ab45e083cd33baf730b922aba412c336d

                                                                                    Download Submit

                                                                                  • /usr/bin/dpkgd/lsof
                                                                                    Filesize

                                                                                    159KB

                                                                                    MD5

                                                                                    e093dc78225e2a0a25e3b137c1c1e442

                                                                                    SHA1

                                                                                    c29497cfaae729eb576875e4fdfa400640ab16be

                                                                                    SHA256

                                                                                    1190f4dbc7be174de8fd4096c9bf7a28eebfac937d308b7cc533be4a1240d26e

                                                                                    SHA512

                                                                                    fe1cc7a65327732eaaee89f427c10239ba822430e34177842f4681068d78d404b1830d808a2a71b1efcc5f126c6d8c053512237421173aaa150e215a672da6f0

                                                                                    Download Submit

                                                                                  • /usr/bin/dpkgd/ps
                                                                                    Filesize

                                                                                    130KB

                                                                                    MD5

                                                                                    558edc26f8a38fa9788220b9af8a73e7

                                                                                    SHA1

                                                                                    3024d44e580e9c67f32f6c585d50e2a6cc9a7cac

                                                                                    SHA256

                                                                                    b76435c80333d2c1fd18e0e7682f1c9dfb5da8d507e93e3c416f54b481c428d5

                                                                                    SHA512

                                                                                    edaa425b441044f015e8f68fffa1664e42372d00dd0e7b0924d24ce947aa8e5f96b3bdc326fa2f8b978e3fcf638a1ceca45a223735db73f1607df66990feb56f

                                                                                    Download Submit