mrblack | 8ebd963f86ba62f45b936f6d6687ccb1e349a0f8a6cc19286457895c885695c8

General

Target

28028763bd19e58aed1e262d8df6da84
Size

1.2MB
MD5

28028763bd19e58aed1e262d8df6da84
SHA1

14df4ad34d74026b862e43556b94ceedefba1e96
SHA256

8ebd963f86ba62f45b936f6d6687ccb1e349a0f8a6cc19286457895c885695c8
SHA512

7055da8d36353e721361525b40f80b431b7f4201a9fb80add8e046c34bb85ee05cf8b9027d6e42b2bbb53c077cb6c049cd762f9b3042bd2495ff762f785d12c5
SSDEEP

24576:e845rGHu6gVJKG75oFpA0VWeX4h2y1q2rJp0:745vRVJKGtSA0VWeo4u9p0

Score

10^/10

mrblack antivm botnet persistence trojan

Malware Config

Signatures

MrBlack Trojan
IoT botnet which infects routers to be used for DDoS attacks.
trojan botnet mrblack

MrBlack trojan 1 IoCs

resource	yara_rule
behavioral1/files/fstream-4.dat	family_mrblack

Executes dropped EXE 2 IoCs

ioc	pid	Process
/usr/bin/bsd-port/getty	1599	getty
/usr/bin/.sshd	1623	.sshd

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

T1497

description	ioc
File opened for reading	/proc/cpuinfo

Modifies init.d 1 TTPs 2 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

description	ioc
File opened for modification	/etc/init.d/DbSecuritySpt
File opened for modification	/etc/init.d/selinux

Write file to user bin folder 1 TTPs 8 IoCs

Hijack Execution Flow

T1574

description	ioc	Process
File opened for modification	/usr/bin/dpkgd/ps	cp
File opened for modification	/usr/bin/dpkgd/ss	cp
File opened for modification	/usr/bin/dpkgd/lsof	cp
File opened for modification	/usr/bin/lsof	cp
File opened for modification	/usr/bin/bsd-port/getty.lock	Process not Found
File opened for modification	/usr/bin/bsd-port/udevd.lock	Process not Found
File opened for modification	/usr/bin/bsd-port/getty	cp
File opened for modification	/usr/bin/.sshd	cp

Writes file to system bin folder 1 TTPs 2 IoCs

Hijack Execution Flow

T1574

description	ioc	Process
File opened for modification	/bin/ps	cp
File opened for modification	/bin/ss	cp

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery

T1016

description	ioc
File opened for reading	/proc/net/dev

Reads runtime system information 23 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/meminfo	Process not Found
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/stat	Process not Found
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp

Writes file to tmp directory 4 IoCs

Malware often drops required files in the /tmp directory.

description	ioc
File opened for modification	/tmp/moni.lod
File opened for modification	/tmp/bill.lock
File opened for modification	/tmp/gates.lod
File opened for modification	/tmp/notify.file

/tmp/28028763bd19e58aed1e262d8df6da84
/tmp/28028763bd19e58aed1e262d8df6da84
1⤵
PID:1576

/bin/sh
sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt"
1⤵
PID:1581
- /bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt
  2⤵
  PID:1582

/bin/sh
sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt"
1⤵
PID:1583
- /bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt
  2⤵
  PID:1584

/bin/sh
sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt"
1⤵
PID:1585
- /bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt
  2⤵
  PID:1586

/bin/sh
sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt"
1⤵
PID:1587
- /bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt
  2⤵
  PID:1588

/bin/sh
sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt"
1⤵
PID:1589
- /bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt
  2⤵
  PID:1590

/bin/sh
sh -c "mkdir -p /usr/bin/bsd-port"
1⤵
PID:1591
- /bin/mkdir
  mkdir -p /usr/bin/bsd-port
  2⤵
  - Reads runtime system information
  PID:1592

/bin/sh
sh -c "mkdir -p /usr/bin/bsd-port"
1⤵
PID:1593
- /bin/mkdir
  mkdir -p /usr/bin/bsd-port
  2⤵
  - Reads runtime system information
  PID:1594

/bin/sh
sh -c "cp -f /tmp/28028763bd19e58aed1e262d8df6da84 /usr/bin/bsd-port/getty"
1⤵
PID:1595
- /bin/cp
  cp -f /tmp/28028763bd19e58aed1e262d8df6da84 /usr/bin/bsd-port/getty
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1596

/bin/sh
sh -c /usr/bin/bsd-port/getty
1⤵
PID:1598
- /usr/bin/bsd-port/getty
  /usr/bin/bsd-port/getty
  2⤵
  - Executes dropped EXE
  PID:1599

/bin/sh
sh -c "mkdir -p /usr/bin"
1⤵
PID:1601
- /bin/mkdir
  mkdir -p /usr/bin
  2⤵
  - Reads runtime system information
  PID:1602

/bin/sh
sh -c "mkdir -p /usr/bin"
1⤵
PID:1603
- /bin/mkdir
  mkdir -p /usr/bin
  2⤵
  - Reads runtime system information
  PID:1604

/bin/sh
sh -c "cp -f /tmp/28028763bd19e58aed1e262d8df6da84 /usr/bin/.sshd"
1⤵
PID:1605
- /bin/cp
  cp -f /tmp/28028763bd19e58aed1e262d8df6da84 /usr/bin/.sshd
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1606

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux"
1⤵
PID:1607
- /bin/ln
  ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux
  2⤵
  PID:1608

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux"
1⤵
PID:1609
- /bin/ln
  ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux
  2⤵
  PID:1610

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux"
1⤵
PID:1611
- /bin/ln
  ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux
  2⤵
  PID:1612

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux"
1⤵
PID:1613
- /bin/ln
  ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux
  2⤵
  PID:1614

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux"
1⤵
PID:1615
- /bin/ln
  ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux
  2⤵
  PID:1616

/bin/sh
sh -c "mkdir -p /usr/bin/dpkgd"
1⤵
PID:1617
- /bin/mkdir
  mkdir -p /usr/bin/dpkgd
  2⤵
  - Reads runtime system information
  PID:1618

/bin/sh
sh -c "cp -f /bin/ps /usr/bin/dpkgd/ps"
1⤵
PID:1619
- /bin/cp
  cp -f /bin/ps /usr/bin/dpkgd/ps
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1620

/bin/sh
sh -c /usr/bin/.sshd
1⤵
PID:1622
- /usr/bin/.sshd
  /usr/bin/.sshd
  2⤵
  - Executes dropped EXE
  PID:1623

/bin/sh
sh -c "mkdir -p /bin"
1⤵
PID:1624
- /bin/mkdir
  mkdir -p /bin
  2⤵
  - Reads runtime system information
  PID:1625

/bin/sh
sh -c "mkdir -p /bin"
1⤵
PID:1626
- /bin/mkdir
  mkdir -p /bin
  2⤵
  - Reads runtime system information
  PID:1627

/bin/sh
sh -c "cp -f /usr/bin/bsd-port/getty /bin/ps"
1⤵
PID:1628
- /bin/cp
  cp -f /usr/bin/bsd-port/getty /bin/ps
  2⤵
  - Writes file to system bin folder
  - Reads runtime system information
  PID:1629

/bin/sh
sh -c "chmod 0755 /bin/ps"
1⤵
PID:1630
- /bin/chmod
  chmod 0755 /bin/ps
  2⤵
  PID:1631

/bin/sh
sh -c "cp -f /bin/ss /usr/bin/dpkgd/ss"
1⤵
PID:1632
- /bin/cp
  cp -f /bin/ss /usr/bin/dpkgd/ss
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1633

/bin/sh
sh -c "mkdir -p /bin"
1⤵
PID:1634
- /bin/mkdir
  mkdir -p /bin
  2⤵
  - Reads runtime system information
  PID:1635

/bin/sh
sh -c "mkdir -p /bin"
1⤵
PID:1636
- /bin/mkdir
  mkdir -p /bin
  2⤵
  - Reads runtime system information
  PID:1637

/bin/sh
sh -c "cp -f /usr/bin/bsd-port/getty /bin/ss"
1⤵
PID:1638
- /bin/cp
  cp -f /usr/bin/bsd-port/getty /bin/ss
  2⤵
  - Writes file to system bin folder
  - Reads runtime system information
  PID:1639

/bin/sh
sh -c "chmod 0755 /bin/ss"
1⤵
PID:1640
- /bin/chmod
  chmod 0755 /bin/ss
  2⤵
  PID:1641

/bin/sh
sh -c "cp -f /usr/bin/lsof /usr/bin/dpkgd/lsof"
1⤵
PID:1642
- /bin/cp
  cp -f /usr/bin/lsof /usr/bin/dpkgd/lsof
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1643

/bin/sh
sh -c "mkdir -p /usr/bin"
1⤵
PID:1644
- /bin/mkdir
  mkdir -p /usr/bin
  2⤵
  - Reads runtime system information
  PID:1645

/bin/sh
sh -c "mkdir -p /usr/bin"
1⤵
PID:1646
- /bin/mkdir
  mkdir -p /usr/bin
  2⤵
  - Reads runtime system information
  PID:1647

/bin/sh
sh -c "cp -f /usr/bin/bsd-port/getty /usr/bin/lsof"
1⤵
PID:1648
- /bin/cp
  cp -f /usr/bin/bsd-port/getty /usr/bin/lsof
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1649

/bin/sh
sh -c "chmod 0755 /usr/bin/lsof"
1⤵
PID:1650
- /bin/chmod
  chmod 0755 /usr/bin/lsof
  2⤵
  PID:1651

/bin/sh
sh -c "insmod /usr/bin/bsd-port/xpacket.ko"
1⤵
PID:1654
- /sbin/insmod
  insmod /usr/bin/bsd-port/xpacket.ko
  2⤵
  - Reads runtime system information
  PID:1655

/bin/sh
sh -c "insmod /tmp/xpacket.ko"
1⤵
PID:1656
- /sbin/insmod
  insmod /tmp/xpacket.ko
  2⤵
  - Reads runtime system information
  PID:1657

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Hijack Execution Flow

2

T1574

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Hijack Execution Flow

2

T1574

Defense Evasion

Hijack Execution Flow

2

T1574

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

System Network Configuration Discovery

1

T1016

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/etc/init.d/DbSecuritySpt

Filesize
50B

MD5
75a5b83dc30e707fb14c783e2ed0df14

SHA1
c687953651e92b2fdea3f7782ae2eedf666edad0

SHA256
66c049e9de08c46a56bb8d031412ffb28f1af981ba4a4ad000a407ddfd42c806

SHA512
dadd9771f07ce8cd52f01661710664c88d11e1da130add2cfa7afd52b52463c93921b75070f5497cf23350f3633220c01161646471280e7e66c0d5f667007c33

Download Submit
/tmp/gates.lod

Filesize
4B

MD5
7e1d842d0f7ee600116ffc6b2d87d83f

SHA1
58cb004c78ad7dd27552600c7c1d525e5797cd1d

SHA256
1d16bb3354a11b509e641db094ca078be290298b0ec32c6b46b88fe919a1a8ed

SHA512
113c6380957062e07ff7390ef365b7352fa3e96dabb6503422821a7de921d40296db514ff99bf85f780aee8486787810184d16106a8a7ccdc92423e23bf31575

Download Submit
/tmp/moni.lod

Filesize
4B

MD5
207f88018f72237565570f8a9e5ca240

SHA1
ca70ca5f6efd8e48f2b4b75b3bd75a5f8fdb12d5

SHA256
b3dfc696bb0a50080a047af22f87c0f9a07728ba3095a9aac126123ad1bc24d3

SHA512
543d76d42a7a164fad91e612de066ae7a47f1687b343be7c9a08aef10f0b3474c7cfd59e1d6cc326e07212cc3dc1ea04d8ad2334c21d48f9cabb7aead473f6b8

Download Submit
/tmp/notify.file

Filesize
37B

MD5
5114753a2c3aef965eb8ac438896175c

SHA1
4fe1f5cd34727ff0f3c019974483b537b256c7db

SHA256
4f58b97ab550cfcd3dde6651f5362d6f5aa8993f95b5ac6ccc0457fef4b4ea04

SHA512
872908aa8c5e3425ae61b83b5454dfebdfd895e99dea56a189e8805df3c9dfa82d2fba2ec67df634a18b61ea41c434e0cdf77c69d092c6d5e2d499b1d30f8ba9

Download Submit
/usr/bin/bsd-port/getty

Filesize
1.2MB

MD5
28028763bd19e58aed1e262d8df6da84

SHA1
14df4ad34d74026b862e43556b94ceedefba1e96

SHA256
8ebd963f86ba62f45b936f6d6687ccb1e349a0f8a6cc19286457895c885695c8

SHA512
7055da8d36353e721361525b40f80b431b7f4201a9fb80add8e046c34bb85ee05cf8b9027d6e42b2bbb53c077cb6c049cd762f9b3042bd2495ff762f785d12c5

Download Submit
/usr/bin/dpkgd/lsof

Filesize
159KB

MD5
e093dc78225e2a0a25e3b137c1c1e442

SHA1
c29497cfaae729eb576875e4fdfa400640ab16be

SHA256
1190f4dbc7be174de8fd4096c9bf7a28eebfac937d308b7cc533be4a1240d26e

SHA512
fe1cc7a65327732eaaee89f427c10239ba822430e34177842f4681068d78d404b1830d808a2a71b1efcc5f126c6d8c053512237421173aaa150e215a672da6f0

Download Submit
/usr/bin/dpkgd/ps

Filesize
130KB

MD5
558edc26f8a38fa9788220b9af8a73e7

SHA1
3024d44e580e9c67f32f6c585d50e2a6cc9a7cac

SHA256
b76435c80333d2c1fd18e0e7682f1c9dfb5da8d507e93e3c416f54b481c428d5

SHA512
edaa425b441044f015e8f68fffa1664e42372d00dd0e7b0924d24ce947aa8e5f96b3bdc326fa2f8b978e3fcf638a1ceca45a223735db73f1607df66990feb56f

Download Submit
/usr/bin/dpkgd/ss

Filesize
136KB

MD5
1dc929b5f2cd12fe6a2fe71140d2a9e3

SHA1
f9995a92bb201b1b7738a39a38570ef0c40b52d2

SHA256
418aae1da62554afe9f260866267af328fd761b3fd6f90f0ea53d543e2fefc38

SHA512
fbed011c595084548db440dfbe485b7d27032a44a6ae9e141fe43f31c8c524ff9347135ab035deb441fca99e5a3794f7bb9194f148aa2f60f1547a7c67d47373

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads