mrblack | 86649bf1aab2eaeccaea440c9deac499956e496512894b401d7a379344eed2de

General

Target

631d198fd67c385a222564f5e6832fd2
Size

1.1MB
MD5

631d198fd67c385a222564f5e6832fd2
SHA1

5b55edfd0db2b2b5301acca8d5ba1b0e6fc43e23
SHA256

86649bf1aab2eaeccaea440c9deac499956e496512894b401d7a379344eed2de
SHA512

461eb1528e12f492bf3eeef5188cb10e990e6d421f8633aa56805d67205f48b5c43e9a1a714bcad0e1ad2f2e8c9b5e743a5ccea43710728640f19088d8f5c546
SSDEEP

24576:4vRE7caCfKGPqVEDNLFxKsfayI+gIGYuuCol7r:4vREKfPqVE5jKsfayRHGVo7r

Score

10^/10

mrblack antivm botnet persistence trojan

Malware Config

Signatures

MrBlack Trojan
IoT botnet which infects routers to be used for DDoS attacks.
trojan botnet mrblack

MrBlack trojan 1 IoCs

resource	yara_rule
behavioral1/files/fstream-4.dat	family_mrblack

Executes dropped EXE 2 IoCs

ioc	pid	Process
/usr/bin/bsd-port/getty	1559	getty
/usr/bin/lixww	1567	lixww

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

T1497

description	ioc
File opened for reading	/proc/cpuinfo

Modifies init.d 1 TTPs 2 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

description	ioc
File opened for modification	/etc/init.d/DbSecuritySpt
File opened for modification	/etc/init.d/selinux

Write file to user bin folder 1 TTPs 7 IoCs

Hijack Execution Flow

T1574

description	ioc	Process
File opened for modification	/usr/bin/dpkgd/lsof	cp
File opened for modification	/usr/bin/lsof	cp
File opened for modification	/usr/bin/bsd-port/getty.lock	Process not Found
File opened for modification	/usr/bin/bsd-port/udevd.lock	Process not Found
File opened for modification	/usr/bin/bsd-port/getty	cp
File opened for modification	/usr/bin/lixww	cp
File opened for modification	/usr/bin/dpkgd/ps	cp

Writes file to system bin folder 1 TTPs 1 IoCs

Hijack Execution Flow

T1574

description	ioc	Process
File opened for modification	/bin/ps	cp

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery

T1016

description	ioc
File opened for reading	/proc/net/dev

Reads runtime system information 15 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/stat	Process not Found
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/meminfo	Process not Found
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/filesystems	mkdir

Writes file to tmp directory 4 IoCs

Malware often drops required files in the /tmp directory.

description	ioc
File opened for modification	/tmp/notify.file
File opened for modification	/tmp/moni.lock
File opened for modification	/tmp/bill.lock
File opened for modification	/tmp/gates.lock

/tmp/631d198fd67c385a222564f5e6832fd2
/tmp/631d198fd67c385a222564f5e6832fd2
1⤵
PID:1537

/bin/sh
sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt"
1⤵
PID:1543
- /bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt
  2⤵
  PID:1544

/bin/sh
sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt"
1⤵
PID:1545
- /bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt
  2⤵
  PID:1546

/bin/sh
sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt"
1⤵
PID:1547
- /bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt
  2⤵
  PID:1548

/bin/sh
sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt"
1⤵
PID:1549
- /bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt
  2⤵
  PID:1550

/bin/sh
sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt"
1⤵
PID:1551
- /bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt
  2⤵
  PID:1552

/bin/sh
sh -c "mkdir -p /usr/bin/bsd-port"
1⤵
PID:1553
- /bin/mkdir
  mkdir -p /usr/bin/bsd-port
  2⤵
  - Reads runtime system information
  PID:1554

/bin/sh
sh -c "cp -f /tmp/631d198fd67c385a222564f5e6832fd2 /usr/bin/bsd-port/getty"
1⤵
PID:1555
- /bin/cp
  cp -f /tmp/631d198fd67c385a222564f5e6832fd2 /usr/bin/bsd-port/getty
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1556

/bin/sh
sh -c /usr/bin/bsd-port/getty
1⤵
PID:1558
- /usr/bin/bsd-port/getty
  /usr/bin/bsd-port/getty
  2⤵
  - Executes dropped EXE
  PID:1559

/bin/sh
sh -c "mkdir -p /usr/bin"
1⤵
PID:1561
- /bin/mkdir
  mkdir -p /usr/bin
  2⤵
  - Reads runtime system information
  PID:1562

/bin/sh
sh -c "cp -f /tmp/631d198fd67c385a222564f5e6832fd2 /usr/bin/lixww"
1⤵
PID:1563
- /bin/cp
  cp -f /tmp/631d198fd67c385a222564f5e6832fd2 /usr/bin/lixww
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1564

/bin/sh
sh -c /usr/bin/lixww
1⤵
PID:1566
- /usr/bin/lixww
  /usr/bin/lixww
  2⤵
  - Executes dropped EXE
  PID:1567

/bin/sh
sh -c "insmod /usr/lib/xpacket.ko"
1⤵
PID:1569
- /sbin/insmod
  insmod /usr/lib/xpacket.ko
  2⤵
  - Reads runtime system information
  PID:1570

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux"
1⤵
PID:1578
- /bin/ln
  ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux
  2⤵
  PID:1579

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux"
1⤵
PID:1580
- /bin/ln
  ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux
  2⤵
  PID:1581

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux"
1⤵
PID:1582
- /bin/ln
  ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux
  2⤵
  PID:1583

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux"
1⤵
PID:1584
- /bin/ln
  ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux
  2⤵
  PID:1585

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux"
1⤵
PID:1586
- /bin/ln
  ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux
  2⤵
  PID:1587

/bin/sh
sh -c "mkdir -p /usr/bin/dpkgd"
1⤵
PID:1588
- /bin/mkdir
  mkdir -p /usr/bin/dpkgd
  2⤵
  - Reads runtime system information
  PID:1589

/bin/sh
sh -c "cp -f /bin/ps /usr/bin/dpkgd/ps"
1⤵
PID:1590
- /bin/cp
  cp -f /bin/ps /usr/bin/dpkgd/ps
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1591

/bin/sh
sh -c "mkdir -p /bin"
1⤵
PID:1592
- /bin/mkdir
  mkdir -p /bin
  2⤵
  - Reads runtime system information
  PID:1593

/bin/sh
sh -c "cp -f /usr/bin/bsd-port/getty /bin/ps"
1⤵
PID:1595
- /bin/cp
  cp -f /usr/bin/bsd-port/getty /bin/ps
  2⤵
  - Writes file to system bin folder
  - Reads runtime system information
  PID:1596

/bin/sh
sh -c "chmod 0755 /bin/ps"
1⤵
PID:1597
- /bin/chmod
  chmod 0755 /bin/ps
  2⤵
  PID:1598

/bin/sh
sh -c "cp -f /usr/bin/lsof /usr/bin/dpkgd/lsof"
1⤵
PID:1599
- /bin/cp
  cp -f /usr/bin/lsof /usr/bin/dpkgd/lsof
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1600

/bin/sh
sh -c "mkdir -p /usr/bin"
1⤵
PID:1601
- /bin/mkdir
  mkdir -p /usr/bin
  2⤵
  - Reads runtime system information
  PID:1602

/bin/sh
sh -c "cp -f /usr/bin/bsd-port/getty /usr/bin/lsof"
1⤵
PID:1603
- /bin/cp
  cp -f /usr/bin/bsd-port/getty /usr/bin/lsof
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1604

/bin/sh
sh -c "chmod 0755 /usr/bin/lsof"
1⤵
PID:1605
- /bin/chmod
  chmod 0755 /usr/bin/lsof
  2⤵
  PID:1606

/bin/sh
sh -c "insmod /usr/lib/xpacket.ko"
1⤵
PID:1607
- /sbin/insmod
  insmod /usr/lib/xpacket.ko
  2⤵
  - Reads runtime system information
  PID:1608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Hijack Execution Flow

2

T1574

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Hijack Execution Flow

2

T1574

Defense Evasion

Hijack Execution Flow

2

T1574

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

System Network Configuration Discovery

1

T1016

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/etc/init.d/DbSecuritySpt

Filesize
50B

MD5
2aa6fd038562f4504e989e416ad7f975

SHA1
45631d0a7385dfe5d4719f6bb1b5556f8143e39d

SHA256
1aab15aa57328f065e943557cb0af1634657cf64551a793c893eae8cdbeb3967

SHA512
0bb8bca2787e539215e7098a1797815014a1c6afb2d4eba1eb2cbae083f48b284ba9e2a3f03845c15092f0c18bd2b5ba5dbd52662b3cea5ec5839dfe4fdcfa35

Download Submit
/etc/init.d/selinux

Filesize
36B

MD5
993cc15058142d96c3daf7852c3d5ee8

SHA1
0950b8b391b04dd3895ea33cd3141543ebd2525d

SHA256
8171d077918611803d93088409f220c66fae1c670b297e1aa5d8cbd548ce9208

SHA512
0c4256c00a3710f97e92581b552682b36b62afc35fe72622c491323c618c19ea62611ac04ccafc3dfcde2254a2ebbd93b69b66795b16e36332293bed83adb928

Download Submit
/tmp/gates.lock

Filesize
4B

MD5
b60c5ab647a27045b462934977ccad9a

SHA1
aff60c26ab00f0ad980af68c68a926fa11795ef9

SHA256
0f8e631d28e2a339b435ea55da61c718da28902056ed719e576ff1c1b4cb2baf

SHA512
d8e0a85d197bbd49b2c4586c3e6e29dcdfa203b80c4d3480a4f48f0aeefd87ce3261e56bae531551d6eb007afd221a16df4447d1d4882c846a144754d16b8431

Download Submit
/tmp/moni.lock

Filesize
4B

MD5
dfa92d8f817e5b08fcaafb50d03763cf

SHA1
722a7e9c6dcbb04ed1fffe8d658ea03ce68f8e01

SHA256
a2258ffaf9a1490a7a7a01c282b1fe03224a2952b119c3f32b1de4739407cd58

SHA512
1bb31aa3c0b2b98b36fd84e77aea11ddd9861c3117e90f50627816895636534067f94ea56526c692611289f44d020dc9b44b03d2c94db07f04ae9d2e9b643d77

Download Submit
/tmp/notify.file

Filesize
37B

MD5
366b1f844edcab8d1ab53c25a50a6b05

SHA1
eba4602273aeba378edbb8157772f44195d53e03

SHA256
a10131d8c855a2d00a6d8e7ccd61356e8b51aab4d8acbcd04975fc731c111fa2

SHA512
5bc32279df58cc86b1b34817ce5861ee46df05ec3f578145efbadb2b5256b3e327805caf78c06b7f5f80efb8a89e064da3e8b57c193bfa84ec68ab44965a38dc

Download Submit
/usr/bin/bsd-port/getty

Filesize
1.1MB

MD5
631d198fd67c385a222564f5e6832fd2

SHA1
5b55edfd0db2b2b5301acca8d5ba1b0e6fc43e23

SHA256
86649bf1aab2eaeccaea440c9deac499956e496512894b401d7a379344eed2de

SHA512
461eb1528e12f492bf3eeef5188cb10e990e6d421f8633aa56805d67205f48b5c43e9a1a714bcad0e1ad2f2e8c9b5e743a5ccea43710728640f19088d8f5c546

Download Submit
/usr/bin/dpkgd/lsof

Filesize
159KB

MD5
e093dc78225e2a0a25e3b137c1c1e442

SHA1
c29497cfaae729eb576875e4fdfa400640ab16be

SHA256
1190f4dbc7be174de8fd4096c9bf7a28eebfac937d308b7cc533be4a1240d26e

SHA512
fe1cc7a65327732eaaee89f427c10239ba822430e34177842f4681068d78d404b1830d808a2a71b1efcc5f126c6d8c053512237421173aaa150e215a672da6f0

Download Submit
/usr/bin/dpkgd/ps

Filesize
130KB

MD5
558edc26f8a38fa9788220b9af8a73e7

SHA1
3024d44e580e9c67f32f6c585d50e2a6cc9a7cac

SHA256
b76435c80333d2c1fd18e0e7682f1c9dfb5da8d507e93e3c416f54b481c428d5

SHA512
edaa425b441044f015e8f68fffa1664e42372d00dd0e7b0924d24ce947aa8e5f96b3bdc326fa2f8b978e3fcf638a1ceca45a223735db73f1607df66990feb56f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads