Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
154s -
max time network
132s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20231215-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20231215-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
20/12/2023, 07:56
Behavioral task
behavioral1
Sample
916713f6a931d88d4b91b468081aadfa
Resource
ubuntu1804-amd64-20231215-en
General
-
Target
916713f6a931d88d4b91b468081aadfa
-
Size
1.2MB
-
MD5
916713f6a931d88d4b91b468081aadfa
-
SHA1
27e4c878a87bc6b9fdca08d785d7ebde1d80f963
-
SHA256
0468ba5c627dee9f0056f13c5bc2fa82e11f386dcfdfeab1c00412f5dfa2655c
-
SHA512
8a792e70827864160bc7fe01d31544f8179376e4d3cf410d53dc3baed14e6947c629c891af02d8cf67b5a85a99fbd6efc419c4027596f2504d005a3ec39a9e49
-
SSDEEP
24576:e845rGHu6gVJKG75oFpA0VWeX452y1q2rJp0:745vRVJKGtSA0VWeogu9p0
Malware Config
Signatures
-
MrBlack trojan 1 IoCs
resource yara_rule behavioral1/files/fstream-4.dat family_mrblack -
Executes dropped EXE 2 IoCs
ioc pid Process /usr/bin/bsd-port/getty 1584 getty /usr/bin/.sshd 1605 .sshd -
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc File opened for reading /proc/cpuinfo -
description ioc File opened for modification /etc/init.d/selinux File opened for modification /etc/init.d/DbSecuritySpt -
Write file to user bin folder 1 TTPs 8 IoCs
description ioc Process File opened for modification /usr/bin/dpkgd/ss cp File opened for modification /usr/bin/dpkgd/lsof cp File opened for modification /usr/bin/lsof cp File opened for modification /usr/bin/bsd-port/getty.lock Process not Found File opened for modification /usr/bin/bsd-port/udevd.lock Process not Found File opened for modification /usr/bin/bsd-port/getty cp File opened for modification /usr/bin/.sshd cp File opened for modification /usr/bin/dpkgd/ps cp -
Writes file to system bin folder 1 TTPs 2 IoCs
description ioc Process File opened for modification /bin/ps cp File opened for modification /bin/ss cp -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc File opened for reading /proc/net/dev -
Reads runtime system information 23 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/cmdline insmod File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/cmdline insmod File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems cp File opened for reading /proc/stat Process not Found File opened for reading /proc/meminfo Process not Found File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems cp -
Writes file to tmp directory 4 IoCs
Malware often drops required files in the /tmp directory.
description ioc File opened for modification /tmp/notify.file File opened for modification /tmp/moni.lod File opened for modification /tmp/bill.lock File opened for modification /tmp/gates.lod
Processes
-
/tmp/916713f6a931d88d4b91b468081aadfa/tmp/916713f6a931d88d4b91b468081aadfa1⤵PID:1560
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt"1⤵PID:1566
-
/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt2⤵PID:1567
-
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt"1⤵PID:1568
-
/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt2⤵PID:1569
-
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt"1⤵PID:1570
-
/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt2⤵PID:1571
-
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt"1⤵PID:1572
-
/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt2⤵PID:1573
-
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt"1⤵PID:1574
-
/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt2⤵PID:1575
-
-
/bin/shsh -c "mkdir -p /usr/bin/bsd-port"1⤵PID:1576
-
/bin/mkdirmkdir -p /usr/bin/bsd-port2⤵
- Reads runtime system information
PID:1577
-
-
/bin/shsh -c "mkdir -p /usr/bin/bsd-port"1⤵PID:1578
-
/bin/mkdirmkdir -p /usr/bin/bsd-port2⤵
- Reads runtime system information
PID:1579
-
-
/bin/shsh -c "cp -f /tmp/916713f6a931d88d4b91b468081aadfa /usr/bin/bsd-port/getty"1⤵PID:1580
-
/bin/cpcp -f /tmp/916713f6a931d88d4b91b468081aadfa /usr/bin/bsd-port/getty2⤵
- Write file to user bin folder
- Reads runtime system information
PID:1581
-
-
/bin/shsh -c /usr/bin/bsd-port/getty1⤵PID:1583
-
/usr/bin/bsd-port/getty/usr/bin/bsd-port/getty2⤵
- Executes dropped EXE
PID:1584
-
-
/bin/shsh -c "mkdir -p /usr/bin"1⤵PID:1586
-
/bin/mkdirmkdir -p /usr/bin2⤵
- Reads runtime system information
PID:1587
-
-
/bin/shsh -c "mkdir -p /usr/bin"1⤵PID:1588
-
/bin/mkdirmkdir -p /usr/bin2⤵
- Reads runtime system information
PID:1589
-
-
/bin/shsh -c "cp -f /tmp/916713f6a931d88d4b91b468081aadfa /usr/bin/.sshd"1⤵PID:1590
-
/bin/cpcp -f /tmp/916713f6a931d88d4b91b468081aadfa /usr/bin/.sshd2⤵
- Write file to user bin folder
- Reads runtime system information
PID:1591
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux"1⤵PID:1592
-
/bin/lnln -s /etc/init.d/selinux /etc/rc1.d/S99selinux2⤵PID:1593
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux"1⤵PID:1594
-
/bin/lnln -s /etc/init.d/selinux /etc/rc2.d/S99selinux2⤵PID:1595
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux"1⤵PID:1596
-
/bin/lnln -s /etc/init.d/selinux /etc/rc3.d/S99selinux2⤵PID:1597
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux"1⤵PID:1598
-
/bin/lnln -s /etc/init.d/selinux /etc/rc4.d/S99selinux2⤵PID:1599
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux"1⤵PID:1600
-
/bin/lnln -s /etc/init.d/selinux /etc/rc5.d/S99selinux2⤵PID:1601
-
-
/bin/shsh -c "mkdir -p /usr/bin/dpkgd"1⤵PID:1602
-
/bin/mkdirmkdir -p /usr/bin/dpkgd2⤵
- Reads runtime system information
PID:1606
-
-
/bin/shsh -c /usr/bin/.sshd1⤵PID:1604
-
/usr/bin/.sshd/usr/bin/.sshd2⤵
- Executes dropped EXE
PID:1605
-
-
/bin/shsh -c "cp -f /bin/ps /usr/bin/dpkgd/ps"1⤵PID:1607
-
/bin/cpcp -f /bin/ps /usr/bin/dpkgd/ps2⤵
- Write file to user bin folder
- Reads runtime system information
PID:1608
-
-
/bin/shsh -c "mkdir -p /bin"1⤵PID:1609
-
/bin/mkdirmkdir -p /bin2⤵
- Reads runtime system information
PID:1610
-
-
/bin/shsh -c "mkdir -p /bin"1⤵PID:1611
-
/bin/mkdirmkdir -p /bin2⤵
- Reads runtime system information
PID:1612
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/getty /bin/ps"1⤵PID:1613
-
/bin/cpcp -f /usr/bin/bsd-port/getty /bin/ps2⤵
- Writes file to system bin folder
- Reads runtime system information
PID:1614
-
-
/bin/shsh -c "chmod 0755 /bin/ps"1⤵PID:1615
-
/bin/chmodchmod 0755 /bin/ps2⤵PID:1616
-
-
/bin/shsh -c "cp -f /bin/ss /usr/bin/dpkgd/ss"1⤵PID:1617
-
/bin/cpcp -f /bin/ss /usr/bin/dpkgd/ss2⤵
- Write file to user bin folder
- Reads runtime system information
PID:1618
-
-
/bin/shsh -c "mkdir -p /bin"1⤵PID:1619
-
/bin/mkdirmkdir -p /bin2⤵
- Reads runtime system information
PID:1620
-
-
/bin/shsh -c "mkdir -p /bin"1⤵PID:1621
-
/bin/mkdirmkdir -p /bin2⤵
- Reads runtime system information
PID:1622
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/getty /bin/ss"1⤵PID:1623
-
/bin/cpcp -f /usr/bin/bsd-port/getty /bin/ss2⤵
- Writes file to system bin folder
- Reads runtime system information
PID:1624
-
-
/bin/shsh -c "chmod 0755 /bin/ss"1⤵PID:1625
-
/bin/chmodchmod 0755 /bin/ss2⤵PID:1626
-
-
/bin/shsh -c "cp -f /usr/bin/lsof /usr/bin/dpkgd/lsof"1⤵PID:1627
-
/bin/cpcp -f /usr/bin/lsof /usr/bin/dpkgd/lsof2⤵
- Write file to user bin folder
- Reads runtime system information
PID:1628
-
-
/bin/shsh -c "mkdir -p /usr/bin"1⤵PID:1629
-
/bin/mkdirmkdir -p /usr/bin2⤵
- Reads runtime system information
PID:1630
-
-
/bin/shsh -c "mkdir -p /usr/bin"1⤵PID:1631
-
/bin/mkdirmkdir -p /usr/bin2⤵
- Reads runtime system information
PID:1632
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/getty /usr/bin/lsof"1⤵PID:1633
-
/bin/cpcp -f /usr/bin/bsd-port/getty /usr/bin/lsof2⤵
- Write file to user bin folder
- Reads runtime system information
PID:1634
-
-
/bin/shsh -c "chmod 0755 /usr/bin/lsof"1⤵PID:1635
-
/bin/chmodchmod 0755 /usr/bin/lsof2⤵PID:1637
-
-
/bin/shsh -c "insmod /tmp/xpacket.ko"1⤵PID:1639
-
/sbin/insmodinsmod /tmp/xpacket.ko2⤵
- Reads runtime system information
PID:1641
-
-
/bin/shsh -c "insmod /usr/bin/bsd-port/xpacket.ko"1⤵PID:1640
-
/sbin/insmodinsmod /usr/bin/bsd-port/xpacket.ko2⤵
- Reads runtime system information
PID:1642
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
50B
MD5e49066851455841e273fc81967c79ca4
SHA16fbd4d0cea188ef5dc7884478acc2ef0a1207d7b
SHA256becd00598ffcdfc39eb84e500baf7ac8a946511702538e1bbfdbaf008c16ceef
SHA51258b6f142b6275cbd7bf48537e297020231cae05e5e78a1c3c784e00b0e0ec0db6dfc665b6eac3fbef06cd95c45fd1de652ee2f71b2874bc5489a0ba125799e55
-
Filesize
36B
MD5993cc15058142d96c3daf7852c3d5ee8
SHA10950b8b391b04dd3895ea33cd3141543ebd2525d
SHA2568171d077918611803d93088409f220c66fae1c670b297e1aa5d8cbd548ce9208
SHA5120c4256c00a3710f97e92581b552682b36b62afc35fe72622c491323c618c19ea62611ac04ccafc3dfcde2254a2ebbd93b69b66795b16e36332293bed83adb928
-
Filesize
4B
MD5b132ecc1609bfcf302615847c1caa69a
SHA10310477142171b7d67f2a1cd85c90a3b66be9c57
SHA2568bcefa497af26e688b555d1c4c8cc97365522b5a1416ceb099a98b4c2ed80585
SHA512816f74839aff001255a4e3fdbc354fd23aeaada1bbd44148e4fad015650143c818f741024cac050b6a4e22ce4d8d64b9591078a1d46d4776a6c51077b937bed0
-
Filesize
4B
MD51c54985e4f95b7819ca0357c0cb9a09f
SHA185d0662ad5825ba33f4259d0d06ac035abac67bf
SHA256245db7164aace830256c713e17486f1785096c86049d6409349fff5f810da253
SHA512f24fb250d43bbe3ef3f28dfb1c6f8f553540c0d43023a88a718e2d38db9a18eac926cf44bcc3f1840cc8a29b2bdfec41dd0527abdc77aecde0e165742319a232
-
Filesize
37B
MD5fbe7049b1df4590c0b9f0a8a87c5177b
SHA10842e830a4aed52a29186f3691ff8f7938bcfaec
SHA25681e64d1377d869f808533e9fff79d3a86847ac1bba6e66b8fb5437fda54554ae
SHA5123ab2c9cd670e2fc6d25354b73766e5bf1082001da735ef74629cb1a2e8d0ab604aba4b75084ca1cf81861c909228954e78a9f567a98c2e6b48a808a8ce60daaa
-
Filesize
1.2MB
MD5916713f6a931d88d4b91b468081aadfa
SHA127e4c878a87bc6b9fdca08d785d7ebde1d80f963
SHA2560468ba5c627dee9f0056f13c5bc2fa82e11f386dcfdfeab1c00412f5dfa2655c
SHA5128a792e70827864160bc7fe01d31544f8179376e4d3cf410d53dc3baed14e6947c629c891af02d8cf67b5a85a99fbd6efc419c4027596f2504d005a3ec39a9e49
-
Filesize
159KB
MD5e093dc78225e2a0a25e3b137c1c1e442
SHA1c29497cfaae729eb576875e4fdfa400640ab16be
SHA2561190f4dbc7be174de8fd4096c9bf7a28eebfac937d308b7cc533be4a1240d26e
SHA512fe1cc7a65327732eaaee89f427c10239ba822430e34177842f4681068d78d404b1830d808a2a71b1efcc5f126c6d8c053512237421173aaa150e215a672da6f0
-
Filesize
130KB
MD5558edc26f8a38fa9788220b9af8a73e7
SHA13024d44e580e9c67f32f6c585d50e2a6cc9a7cac
SHA256b76435c80333d2c1fd18e0e7682f1c9dfb5da8d507e93e3c416f54b481c428d5
SHA512edaa425b441044f015e8f68fffa1664e42372d00dd0e7b0924d24ce947aa8e5f96b3bdc326fa2f8b978e3fcf638a1ceca45a223735db73f1607df66990feb56f
-
Filesize
136KB
MD51dc929b5f2cd12fe6a2fe71140d2a9e3
SHA1f9995a92bb201b1b7738a39a38570ef0c40b52d2
SHA256418aae1da62554afe9f260866267af328fd761b3fd6f90f0ea53d543e2fefc38
SHA512fbed011c595084548db440dfbe485b7d27032a44a6ae9e141fe43f31c8c524ff9347135ab035deb441fca99e5a3794f7bb9194f148aa2f60f1547a7c67d47373