mrblack | c428cf1e96baa71f12876d6df843d61d65546fef7e01f03f3bc14b34d89e5397

Analysis

max time kernel
153s
max time network
157s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20231215-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20231215-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
19-12-2023 22:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2be9dc77bc9bdd9c3c6b091a3132a65f
Size

1.2MB
MD5

2be9dc77bc9bdd9c3c6b091a3132a65f
SHA1

dd03bb0f2ed025714f17ab254441c9278e18643d
SHA256

c428cf1e96baa71f12876d6df843d61d65546fef7e01f03f3bc14b34d89e5397
SHA512

1372e5f12c149a96a8f91d9959e6bb74b569cf6e078769708f2a00c38c11c58bf0ebe830a2c3bf83ded35df0e166c50133d2b2bf275495b2934537972afde25c
SSDEEP

24576:e845rGHu6gVJKG75oFpA0VWeX462y1q2rJp0:745vRVJKGtSA0VWeo5u9p0

Score

10^/10

mrblack antivm botnet persistence trojan

Malware Config

Signatures

MrBlack Trojan
IoT botnet which infects routers to be used for DDoS attacks.
trojan botnet mrblack

MrBlack trojan 2 IoCs

resource	yara_rule
behavioral1/files/fstream-4.dat	family_mrblack
behavioral1/files/fstream-6.dat	family_mrblack

Executes dropped EXE 2 IoCs

ioc	pid	Process
/usr/bin/bsd-port/getty	1570	getty
/usr/bin/.sshd	1586	.sshd

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

T1497

description	ioc
File opened for reading	/proc/cpuinfo

Modifies init.d 1 TTPs 2 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

description	ioc
File opened for modification	/etc/init.d/DbSecuritySpt
File opened for modification	/etc/init.d/selinux

Reads system routing table 1 TTPs 1 IoCs

Gets active network interfaces from /proc virtual filesystem.

System Network Configuration Discovery

T1016

description	ioc
File opened for reading	/proc/net/route

Write file to user bin folder 1 TTPs 8 IoCs

Hijack Execution Flow

T1574

description	ioc	Process
File opened for modification	/usr/bin/bsd-port/udevd.lock	Process not Found
File opened for modification	/usr/bin/bsd-port/getty	cp
File opened for modification	/usr/bin/.sshd	cp
File opened for modification	/usr/bin/dpkgd/ps	cp
File opened for modification	/usr/bin/dpkgd/ss	cp
File opened for modification	/usr/bin/dpkgd/lsof	cp
File opened for modification	/usr/bin/lsof	cp
File opened for modification	/usr/bin/bsd-port/getty.lock	Process not Found

Writes file to system bin folder 1 TTPs 2 IoCs

Hijack Execution Flow

T1574

description	ioc	Process
File opened for modification	/bin/ps	cp
File opened for modification	/bin/ss	cp

Reads system network configuration 1 TTPs 3 IoCs

Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery

T1016

description	ioc
File opened for reading	/proc/net/dev
File opened for reading	/proc/net/route
File opened for reading	/proc/net/arp

Reads runtime system information 23 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/stat	Process not Found
File opened for reading	/proc/meminfo	Process not Found

Writes file to tmp directory 5 IoCs

Malware often drops required files in the /tmp directory.

description	ioc
File opened for modification	/tmp/moni.lod
File opened for modification	/tmp/bill.lock
File opened for modification	/tmp/gates.lod
File opened for modification	/tmp/notify.file
File opened for modification	/tmp/conf.n

/tmp/2be9dc77bc9bdd9c3c6b091a3132a65f
/tmp/2be9dc77bc9bdd9c3c6b091a3132a65f
1⤵
PID:1546

/bin/sh
sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt"
1⤵
PID:1552
- /bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt
  2⤵
  PID:1553

/bin/sh
sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt"
1⤵
PID:1554
- /bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt
  2⤵
  PID:1555

/bin/sh
sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt"
1⤵
PID:1556
- /bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt
  2⤵
  PID:1557

/bin/sh
sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt"
1⤵
PID:1558
- /bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt
  2⤵
  PID:1559

/bin/sh
sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt"
1⤵
PID:1560
- /bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt
  2⤵
  PID:1561

/bin/sh
sh -c "mkdir -p /usr/bin/bsd-port"
1⤵
PID:1562
- /bin/mkdir
  mkdir -p /usr/bin/bsd-port
  2⤵
  - Reads runtime system information
  PID:1563

/bin/sh
sh -c "mkdir -p /usr/bin/bsd-port"
1⤵
PID:1564
- /bin/mkdir
  mkdir -p /usr/bin/bsd-port
  2⤵
  - Reads runtime system information
  PID:1565

/bin/sh
sh -c "cp -f /tmp/2be9dc77bc9bdd9c3c6b091a3132a65f /usr/bin/bsd-port/getty"
1⤵
PID:1566
- /bin/cp
  cp -f /tmp/2be9dc77bc9bdd9c3c6b091a3132a65f /usr/bin/bsd-port/getty
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1567

/bin/sh
sh -c /usr/bin/bsd-port/getty
1⤵
PID:1569
- /usr/bin/bsd-port/getty
  /usr/bin/bsd-port/getty
  2⤵
  - Executes dropped EXE
  PID:1570

/bin/sh
sh -c "mkdir -p /usr/bin"
1⤵
PID:1572
- /bin/mkdir
  mkdir -p /usr/bin
  2⤵
  - Reads runtime system information
  PID:1573

/bin/sh
sh -c "mkdir -p /usr/bin"
1⤵
PID:1574
- /bin/mkdir
  mkdir -p /usr/bin
  2⤵
  - Reads runtime system information
  PID:1575

/bin/sh
sh -c "cp -f /tmp/2be9dc77bc9bdd9c3c6b091a3132a65f /usr/bin/.sshd"
1⤵
PID:1576
- /bin/cp
  cp -f /tmp/2be9dc77bc9bdd9c3c6b091a3132a65f /usr/bin/.sshd
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1577

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux"
1⤵
PID:1578
- /bin/ln
  ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux
  2⤵
  PID:1579

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux"
1⤵
PID:1580
- /bin/ln
  ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux
  2⤵
  PID:1581

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux"
1⤵
PID:1582
- /bin/ln
  ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux
  2⤵
  PID:1583

/bin/sh
sh -c /usr/bin/.sshd
1⤵
PID:1585
- /usr/bin/.sshd
  /usr/bin/.sshd
  2⤵
  - Executes dropped EXE
  PID:1586

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux"
1⤵
PID:1587
- /bin/ln
  ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux
  2⤵
  PID:1588

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux"
1⤵
PID:1589
- /bin/ln
  ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux
  2⤵
  PID:1590

/bin/sh
sh -c "mkdir -p /usr/bin/dpkgd"
1⤵
PID:1591
- /bin/mkdir
  mkdir -p /usr/bin/dpkgd
  2⤵
  - Reads runtime system information
  PID:1592

/bin/sh
sh -c "cp -f /bin/ps /usr/bin/dpkgd/ps"
1⤵
PID:1593
- /bin/cp
  cp -f /bin/ps /usr/bin/dpkgd/ps
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1594

/bin/sh
sh -c "mkdir -p /bin"
1⤵
PID:1595
- /bin/mkdir
  mkdir -p /bin
  2⤵
  - Reads runtime system information
  PID:1596

/bin/sh
sh -c "mkdir -p /bin"
1⤵
PID:1597
- /bin/mkdir
  mkdir -p /bin
  2⤵
  - Reads runtime system information
  PID:1598

/bin/sh
sh -c "cp -f /usr/bin/bsd-port/getty /bin/ps"
1⤵
PID:1599
- /bin/cp
  cp -f /usr/bin/bsd-port/getty /bin/ps
  2⤵
  - Writes file to system bin folder
  - Reads runtime system information
  PID:1600

/bin/sh
sh -c "chmod 0755 /bin/ps"
1⤵
PID:1601
- /bin/chmod
  chmod 0755 /bin/ps
  2⤵
  PID:1602

/bin/sh
sh -c "cp -f /bin/ss /usr/bin/dpkgd/ss"
1⤵
PID:1603
- /bin/cp
  cp -f /bin/ss /usr/bin/dpkgd/ss
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1604

/bin/sh
sh -c "mkdir -p /bin"
1⤵
PID:1605
- /bin/mkdir
  mkdir -p /bin
  2⤵
  - Reads runtime system information
  PID:1606

/bin/sh
sh -c "mkdir -p /bin"
1⤵
PID:1607
- /bin/mkdir
  mkdir -p /bin
  2⤵
  - Reads runtime system information
  PID:1608

/bin/sh
sh -c "cp -f /usr/bin/bsd-port/getty /bin/ss"
1⤵
PID:1609
- /bin/cp
  cp -f /usr/bin/bsd-port/getty /bin/ss
  2⤵
  - Writes file to system bin folder
  - Reads runtime system information
  PID:1610

/bin/sh
sh -c "chmod 0755 /bin/ss"
1⤵
PID:1611
- /bin/chmod
  chmod 0755 /bin/ss
  2⤵
  PID:1612

/bin/sh
sh -c "cp -f /usr/bin/lsof /usr/bin/dpkgd/lsof"
1⤵
PID:1613
- /bin/cp
  cp -f /usr/bin/lsof /usr/bin/dpkgd/lsof
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1614

/bin/sh
sh -c "mkdir -p /usr/bin"
1⤵
PID:1615
- /bin/mkdir
  mkdir -p /usr/bin
  2⤵
  - Reads runtime system information
  PID:1616

/bin/sh
sh -c "mkdir -p /usr/bin"
1⤵
PID:1618
- /bin/mkdir
  mkdir -p /usr/bin
  2⤵
  - Reads runtime system information
  PID:1619

/bin/sh
sh -c "cp -f /usr/bin/bsd-port/getty /usr/bin/lsof"
1⤵
PID:1621
- /bin/cp
  cp -f /usr/bin/bsd-port/getty /usr/bin/lsof
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1622

/bin/sh
sh -c "chmod 0755 /usr/bin/lsof"
1⤵
PID:1623
- /bin/chmod
  chmod 0755 /usr/bin/lsof
  2⤵
  PID:1624

/bin/sh
sh -c "insmod /tmp/xpacket.ko"
1⤵
PID:1625
- /sbin/insmod
  insmod /tmp/xpacket.ko
  2⤵
  - Reads runtime system information
  PID:1626

/bin/sh
sh -c "insmod /usr/bin/bsd-port/xpacket.ko"
1⤵
PID:1628
- /sbin/insmod
  insmod /usr/bin/bsd-port/xpacket.ko
  2⤵
  - Reads runtime system information
  PID:1629

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Defense Evasion

Hijack Execution Flow

T1574

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/etc/init.d/DbSecuritySpt

Filesize
50B

MD5
cd2b751eedc950d892f382b2581ff254

SHA1
505e97d6ac2c81f4f7653d19fbb81a94f33f248e

SHA256
180b60dcc3f30296b294a15338438044a4e5eae24a633e8a0dae3bb304b0ede3

SHA512
b6ba27df0f161260207775232d0d57edf41ea289da229c4063215f895c3d2a6155f5a9aa2d94fbbbe8af9e8232ac428c57ba97781e9c4c953b94b03a19f0c894

Download Submit
/tmp/gates.lod

Filesize
4B

MD5
204da255aea2cd4a75ace6018fad6b4d

SHA1
03f1c15a222d8e288e3eeda35ae04ebc1f7f6526

SHA256
05fb3c9a7f20d8c60ade227ba6ed41510428c5d3e3847eac78eb486b06d2fae4

SHA512
ec715b80d8ee2adb9a3b9870601ce2a9f26ecd4aafd1ef9f966518a44bab7a5f1bfb85f0d06fd6cb4a4d0d348d49bdfec9023b9dae0330fcee8121e50d47f0ef

Download Submit
/tmp/moni.lod

Filesize
4B

MD5
297fa7777981f402dbba17e9f29e292d

SHA1
a5545296721299579e56c41888bd3b60e9287b43

SHA256
67aa578ed1fd0fa4198a7f1cc37b1ab20331cb472f7eb766f687f870a53a0670

SHA512
566f7969e5e8e55b28a7130ccd9261bdd145f04303170eb698359583b79bf0adb1d0a6708abf47bc70e1ff35a04894fc34e1cadf120fef2c0eff3b60438c4560

Download Submit
/tmp/notify.file

Filesize
37B

MD5
b0de43de042be43f2017264f6fbca697

SHA1
b8ff8c465f3e2ac562dd6b7fdc4bd96fd2e5fef3

SHA256
de85a237a380fb77e8cd39b393a2ab4da0241f62b8e973b55379b2aa24283acb

SHA512
248d9f7add59f949031729dc3f28f762c20a9d51cf2adec6a17143df3e8e1094137352eb0ca1d20e3db9d931662d61e31679585ebb7ecf6ca58a9930b5738503

Download Submit
/usr/bin/.sshd

Filesize
703KB

MD5
4007ac007a55f12b663d620f29458bb1

SHA1
7f304cf2f9148f41dbcf18c7498748a067ca1fcb

SHA256
802a96e68fb742fee117c7f3d4d4fd6141c5bcba325047bc756d410e6880f979

SHA512
6248aac4b037f1a24138ed4a4c52a086dfc28a81b2e3b1992c8e91fcac1640394b3f5a3fc23abf59026359336020000480b52814d75bb2eb4ccc420786d49b8c

Download Submit
/usr/bin/bsd-port/getty

Filesize
1.2MB

MD5
2be9dc77bc9bdd9c3c6b091a3132a65f

SHA1
dd03bb0f2ed025714f17ab254441c9278e18643d

SHA256
c428cf1e96baa71f12876d6df843d61d65546fef7e01f03f3bc14b34d89e5397

SHA512
1372e5f12c149a96a8f91d9959e6bb74b569cf6e078769708f2a00c38c11c58bf0ebe830a2c3bf83ded35df0e166c50133d2b2bf275495b2934537972afde25c

Download Submit
/usr/bin/dpkgd/lsof

Filesize
159KB

MD5
e093dc78225e2a0a25e3b137c1c1e442

SHA1
c29497cfaae729eb576875e4fdfa400640ab16be

SHA256
1190f4dbc7be174de8fd4096c9bf7a28eebfac937d308b7cc533be4a1240d26e

SHA512
fe1cc7a65327732eaaee89f427c10239ba822430e34177842f4681068d78d404b1830d808a2a71b1efcc5f126c6d8c053512237421173aaa150e215a672da6f0

Download Submit
/usr/bin/dpkgd/ps

Filesize
130KB

MD5
558edc26f8a38fa9788220b9af8a73e7

SHA1
3024d44e580e9c67f32f6c585d50e2a6cc9a7cac

SHA256
b76435c80333d2c1fd18e0e7682f1c9dfb5da8d507e93e3c416f54b481c428d5

SHA512
edaa425b441044f015e8f68fffa1664e42372d00dd0e7b0924d24ce947aa8e5f96b3bdc326fa2f8b978e3fcf638a1ceca45a223735db73f1607df66990feb56f

Download Submit
/usr/bin/dpkgd/ss

Filesize
136KB

MD5
1dc929b5f2cd12fe6a2fe71140d2a9e3

SHA1
f9995a92bb201b1b7738a39a38570ef0c40b52d2

SHA256
418aae1da62554afe9f260866267af328fd761b3fd6f90f0ea53d543e2fefc38

SHA512
fbed011c595084548db440dfbe485b7d27032a44a6ae9e141fe43f31c8c524ff9347135ab035deb441fca99e5a3794f7bb9194f148aa2f60f1547a7c67d47373

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads