mrblack | 3270ef51cc68ed6f7f9fada4a3854caaaab88e943a5de6507fe1300b74b7d97f

Analysis

max time kernel
152s
max time network
155s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20231215-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20231215-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
20-12-2023 16:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e5e1f47899d5ff3f67a4b9edc1be524b
Size

1.2MB
MD5

e5e1f47899d5ff3f67a4b9edc1be524b
SHA1

6b5626d567b813d39d3a21744706ed0700ac05df
SHA256

3270ef51cc68ed6f7f9fada4a3854caaaab88e943a5de6507fe1300b74b7d97f
SHA512

cf41e790b210d0be3c3bd100e0cbdd6fdf26aa53d6e7ac070f40258241500f52a174a9adc13ac8d5ed268cbd85986f2e7610c9fedb6fdbe947ba0e308542a790
SSDEEP

24576:e845rGHu6gVJKG75oFpA0VWeX4J2y1q2rJp0:745vRVJKGtSA0VWeoQu9p0

Score

10^/10

mrblack antivm botnet persistence trojan

Malware Config

Signatures

MrBlack Trojan
IoT botnet which infects routers to be used for DDoS attacks.
trojan botnet mrblack

MrBlack trojan 1 IoCs

resource	yara_rule
behavioral1/files/fstream-4.dat	family_mrblack

Executes dropped EXE 2 IoCs

ioc	pid	Process
/usr/bin/bsd-port/getty	1569	getty
/usr/bin/.sshd	1593	.sshd

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

T1497

description	ioc
File opened for reading	/proc/cpuinfo

Modifies init.d 1 TTPs 2 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

description	ioc
File opened for modification	/etc/init.d/DbSecuritySpt
File opened for modification	/etc/init.d/selinux

Reads system routing table 1 TTPs 1 IoCs

Gets active network interfaces from /proc virtual filesystem.

System Network Configuration Discovery

T1016

description	ioc
File opened for reading	/proc/net/route

Write file to user bin folder 1 TTPs 8 IoCs

Hijack Execution Flow

T1574

description	ioc	Process
File opened for modification	/usr/bin/lsof	cp
File opened for modification	/usr/bin/bsd-port/getty.lock	Process not Found
File opened for modification	/usr/bin/bsd-port/udevd.lock	Process not Found
File opened for modification	/usr/bin/bsd-port/getty	cp
File opened for modification	/usr/bin/.sshd	cp
File opened for modification	/usr/bin/dpkgd/ps	cp
File opened for modification	/usr/bin/dpkgd/ss	cp
File opened for modification	/usr/bin/dpkgd/lsof	cp

Writes file to system bin folder 1 TTPs 2 IoCs

Hijack Execution Flow

T1574

description	ioc	Process
File opened for modification	/bin/ps	cp
File opened for modification	/bin/ss	cp

Reads system network configuration 1 TTPs 3 IoCs

Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery

T1016

description	ioc
File opened for reading	/proc/net/dev
File opened for reading	/proc/net/route
File opened for reading	/proc/net/arp

Reads runtime system information 23 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/meminfo	Process not Found
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/stat	Process not Found
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir

Writes file to tmp directory 5 IoCs

Malware often drops required files in the /tmp directory.

description	ioc
File opened for modification	/tmp/moni.lod
File opened for modification	/tmp/bill.lock
File opened for modification	/tmp/gates.lod
File opened for modification	/tmp/notify.file
File opened for modification	/tmp/conf.n

/tmp/e5e1f47899d5ff3f67a4b9edc1be524b
/tmp/e5e1f47899d5ff3f67a4b9edc1be524b
1⤵
PID:1533

/bin/sh
sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt"
1⤵
PID:1541
- /bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt
  2⤵
  PID:1542

/bin/sh
sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt"
1⤵
PID:1543
- /bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt
  2⤵
  PID:1544

/bin/sh
sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt"
1⤵
PID:1545
- /bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt
  2⤵
  PID:1546

/bin/sh
sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt"
1⤵
PID:1547
- /bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt
  2⤵
  PID:1548

/bin/sh
sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt"
1⤵
PID:1549
- /bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt
  2⤵
  PID:1550

/bin/sh
sh -c "mkdir -p /usr/bin/bsd-port"
1⤵
PID:1561
- /bin/mkdir
  mkdir -p /usr/bin/bsd-port
  2⤵
  - Reads runtime system information
  PID:1562

/bin/sh
sh -c "mkdir -p /usr/bin/bsd-port"
1⤵
PID:1563
- /bin/mkdir
  mkdir -p /usr/bin/bsd-port
  2⤵
  - Reads runtime system information
  PID:1564

/bin/sh
sh -c "cp -f /tmp/e5e1f47899d5ff3f67a4b9edc1be524b /usr/bin/bsd-port/getty"
1⤵
PID:1565
- /bin/cp
  cp -f /tmp/e5e1f47899d5ff3f67a4b9edc1be524b /usr/bin/bsd-port/getty
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1566

/bin/sh
sh -c /usr/bin/bsd-port/getty
1⤵
PID:1568
- /usr/bin/bsd-port/getty
  /usr/bin/bsd-port/getty
  2⤵
  - Executes dropped EXE
  PID:1569

/bin/sh
sh -c "mkdir -p /usr/bin"
1⤵
PID:1571
- /bin/mkdir
  mkdir -p /usr/bin
  2⤵
  - Reads runtime system information
  PID:1572

/bin/sh
sh -c "mkdir -p /usr/bin"
1⤵
PID:1573
- /bin/mkdir
  mkdir -p /usr/bin
  2⤵
  - Reads runtime system information
  PID:1574

/bin/sh
sh -c "cp -f /tmp/e5e1f47899d5ff3f67a4b9edc1be524b /usr/bin/.sshd"
1⤵
PID:1575
- /bin/cp
  cp -f /tmp/e5e1f47899d5ff3f67a4b9edc1be524b /usr/bin/.sshd
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1576

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux"
1⤵
PID:1577
- /bin/ln
  ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux
  2⤵
  PID:1578

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux"
1⤵
PID:1579
- /bin/ln
  ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux
  2⤵
  PID:1580

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux"
1⤵
PID:1581
- /bin/ln
  ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux
  2⤵
  PID:1582

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux"
1⤵
PID:1583
- /bin/ln
  ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux
  2⤵
  PID:1584

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux"
1⤵
PID:1585
- /bin/ln
  ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux
  2⤵
  PID:1586

/bin/sh
sh -c "mkdir -p /usr/bin/dpkgd"
1⤵
PID:1587
- /bin/mkdir
  mkdir -p /usr/bin/dpkgd
  2⤵
  - Reads runtime system information
  PID:1588

/bin/sh
sh -c "cp -f /bin/ps /usr/bin/dpkgd/ps"
1⤵
PID:1589
- /bin/cp
  cp -f /bin/ps /usr/bin/dpkgd/ps
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1592

/bin/sh
sh -c /usr/bin/.sshd
1⤵
PID:1591
- /usr/bin/.sshd
  /usr/bin/.sshd
  2⤵
  - Executes dropped EXE
  PID:1593

/bin/sh
sh -c "mkdir -p /bin"
1⤵
PID:1596
- /bin/mkdir
  mkdir -p /bin
  2⤵
  - Reads runtime system information
  PID:1597

/bin/sh
sh -c "mkdir -p /bin"
1⤵
PID:1598
- /bin/mkdir
  mkdir -p /bin
  2⤵
  - Reads runtime system information
  PID:1599

/bin/sh
sh -c "cp -f /usr/bin/bsd-port/getty /bin/ps"
1⤵
PID:1600
- /bin/cp
  cp -f /usr/bin/bsd-port/getty /bin/ps
  2⤵
  - Writes file to system bin folder
  - Reads runtime system information
  PID:1601

/bin/sh
sh -c "chmod 0755 /bin/ps"
1⤵
PID:1602
- /bin/chmod
  chmod 0755 /bin/ps
  2⤵
  PID:1603

/bin/sh
sh -c "cp -f /bin/ss /usr/bin/dpkgd/ss"
1⤵
PID:1604
- /bin/cp
  cp -f /bin/ss /usr/bin/dpkgd/ss
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1605

/bin/sh
sh -c "mkdir -p /bin"
1⤵
PID:1606
- /bin/mkdir
  mkdir -p /bin
  2⤵
  - Reads runtime system information
  PID:1607

/bin/sh
sh -c "mkdir -p /bin"
1⤵
PID:1608
- /bin/mkdir
  mkdir -p /bin
  2⤵
  - Reads runtime system information
  PID:1609

/bin/sh
sh -c "cp -f /usr/bin/bsd-port/getty /bin/ss"
1⤵
PID:1610
- /bin/cp
  cp -f /usr/bin/bsd-port/getty /bin/ss
  2⤵
  - Writes file to system bin folder
  - Reads runtime system information
  PID:1611

/bin/sh
sh -c "chmod 0755 /bin/ss"
1⤵
PID:1612
- /bin/chmod
  chmod 0755 /bin/ss
  2⤵
  PID:1613

/bin/sh
sh -c "cp -f /usr/bin/lsof /usr/bin/dpkgd/lsof"
1⤵
PID:1614
- /bin/cp
  cp -f /usr/bin/lsof /usr/bin/dpkgd/lsof
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1615

/bin/sh
sh -c "mkdir -p /usr/bin"
1⤵
PID:1616
- /bin/mkdir
  mkdir -p /usr/bin
  2⤵
  - Reads runtime system information
  PID:1617

/bin/sh
sh -c "mkdir -p /usr/bin"
1⤵
PID:1618
- /bin/mkdir
  mkdir -p /usr/bin
  2⤵
  - Reads runtime system information
  PID:1619

/bin/sh
sh -c "cp -f /usr/bin/bsd-port/getty /usr/bin/lsof"
1⤵
PID:1620
- /bin/cp
  cp -f /usr/bin/bsd-port/getty /usr/bin/lsof
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1621

/bin/sh
sh -c "chmod 0755 /usr/bin/lsof"
1⤵
PID:1622
- /bin/chmod
  chmod 0755 /usr/bin/lsof
  2⤵
  PID:1623

/bin/sh
sh -c "insmod /tmp/xpacket.ko"
1⤵
PID:1624
- /sbin/insmod
  insmod /tmp/xpacket.ko
  2⤵
  - Reads runtime system information
  PID:1625

/bin/sh
sh -c "insmod /usr/bin/bsd-port/xpacket.ko"
1⤵
PID:1635
- /sbin/insmod
  insmod /usr/bin/bsd-port/xpacket.ko
  2⤵
  - Reads runtime system information
  PID:1636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Defense Evasion

Hijack Execution Flow

T1574

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/etc/init.d/DbSecuritySpt

Filesize
50B

MD5
baaa32af7ca1427a1117a29197fe2908

SHA1
ab1abd392fc0064210b9c94fc137723766bd8599

SHA256
ea9af666e46584f9af158981743101200075d09ef0eb9bdc6c5a3d7628e02f9a

SHA512
a03bf750200b630785cc001b6f3e3159a1a4b27c6d378dde3695b822a90871a9d37fd7d03b9124c085cae7fed7c54871ef8fe4280a0c6404cabc9364d006091b

Download Submit
/etc/init.d/selinux

Filesize
36B

MD5
993cc15058142d96c3daf7852c3d5ee8

SHA1
0950b8b391b04dd3895ea33cd3141543ebd2525d

SHA256
8171d077918611803d93088409f220c66fae1c670b297e1aa5d8cbd548ce9208

SHA512
0c4256c00a3710f97e92581b552682b36b62afc35fe72622c491323c618c19ea62611ac04ccafc3dfcde2254a2ebbd93b69b66795b16e36332293bed83adb928

Download Submit
/tmp/gates.lod

Filesize
4B

MD5
d1a69640d53a32a9fb13e93d1c8f3104

SHA1
ad896e3ecf46771003093f24b88cd72af2225023

SHA256
6a27eece1c1658b237aede5c6c2b8af51d235ca08b2f7963b67d99caa7a12395

SHA512
100604d883bb248a24436fea1542cf81636e693256e0f0e8943c3cbdf7aa89bf759ddad050d1c3c487c07b00258dc0e6eefbc04d7109d7a788e2f8b98a9e3894

Download Submit
/tmp/moni.lod

Filesize
4B

MD5
0ebcc77dc72360d0eb8e9504c78d38bd

SHA1
8b583aa0ac7f15508192f2ea1c56b9a07eb48e38

SHA256
8698616a6419549cd9c035d5e250c81c6cefff11ff31c9602bf2ff5aa3e06b7f

SHA512
18bc49d42d4b488f1264cf1f0fb6f914aa29d320e8721f75da80e9324a63c027670f82f6a0549837caac67f83e83dd67480305c079d65a380b54ff013ca11727

Download Submit
/tmp/notify.file

Filesize
37B

MD5
e9100359c0bef830e8c6c81bfac69783

SHA1
ed44231e428aae2e8fd0d64149e22716c22c739d

SHA256
a8fec546618c2487d1bc27db2da05ce3b88224d2f2e14101ba93e8b18a3c0f0b

SHA512
94118d39ef74e4523b8cbd4ee0ed4d272b5950702628ac38884da25d31d1c33dfea513befce5e04809b2c46a1034a1a0846bff467d5e2e56bfd4eb7c40b4ffae

Download Submit
/usr/bin/bsd-port/getty

Filesize
1.2MB

MD5
e5e1f47899d5ff3f67a4b9edc1be524b

SHA1
6b5626d567b813d39d3a21744706ed0700ac05df

SHA256
3270ef51cc68ed6f7f9fada4a3854caaaab88e943a5de6507fe1300b74b7d97f

SHA512
cf41e790b210d0be3c3bd100e0cbdd6fdf26aa53d6e7ac070f40258241500f52a174a9adc13ac8d5ed268cbd85986f2e7610c9fedb6fdbe947ba0e308542a790

Download Submit
/usr/bin/dpkgd/lsof

Filesize
159KB

MD5
e093dc78225e2a0a25e3b137c1c1e442

SHA1
c29497cfaae729eb576875e4fdfa400640ab16be

SHA256
1190f4dbc7be174de8fd4096c9bf7a28eebfac937d308b7cc533be4a1240d26e

SHA512
fe1cc7a65327732eaaee89f427c10239ba822430e34177842f4681068d78d404b1830d808a2a71b1efcc5f126c6d8c053512237421173aaa150e215a672da6f0

Download Submit
/usr/bin/dpkgd/ps

Filesize
130KB

MD5
558edc26f8a38fa9788220b9af8a73e7

SHA1
3024d44e580e9c67f32f6c585d50e2a6cc9a7cac

SHA256
b76435c80333d2c1fd18e0e7682f1c9dfb5da8d507e93e3c416f54b481c428d5

SHA512
edaa425b441044f015e8f68fffa1664e42372d00dd0e7b0924d24ce947aa8e5f96b3bdc326fa2f8b978e3fcf638a1ceca45a223735db73f1607df66990feb56f

Download Submit
/usr/bin/dpkgd/ss

Filesize
136KB

MD5
1dc929b5f2cd12fe6a2fe71140d2a9e3

SHA1
f9995a92bb201b1b7738a39a38570ef0c40b52d2

SHA256
418aae1da62554afe9f260866267af328fd761b3fd6f90f0ea53d543e2fefc38

SHA512
fbed011c595084548db440dfbe485b7d27032a44a6ae9e141fe43f31c8c524ff9347135ab035deb441fca99e5a3794f7bb9194f148aa2f60f1547a7c67d47373

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads