Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
154s -
max time network
132s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20231215-en -
resource tags
-
submitted
21/12/2023, 22:08
General
-
Target
0e05896b109cab25b5dd680cbf416015
-
Size
1.1MB
-
MD5
0e05896b109cab25b5dd680cbf416015
-
SHA1
1819164e6668fe23fe32f71a3d255e6c1189ca5e
-
SHA256
08d910fbe0c24f0e12a186a013129ecb07e907ae3331a8d069545e97d3f80c11
-
SHA512
29826f90d653e6cec31bbe844847d6bad6f16ec1b447b417c3e42d7deec4467df303457a82332c37ff70f2c1698629246fd182eb6c5fb3d9dae1c45d093633f2
-
SSDEEP
24576:4vRE7caCfKGPqVEDNLFxKsfaUI+gIGYuuCol7r:4vREKfPqVE5jKsfaURHGVo7r
Malware Config
Signatures
-
MrBlack Trojan
IoT botnet which infects routers to be used for DDoS attacks.
-
MrBlack trojan 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
-
Modifies init.d 1 TTPs 2 IoCs
Adds/modifies system service, likely for persistence.
-
Write file to user bin folder 1 TTPs 7 IoCs
-
Writes file to system bin folder 1 TTPs 1 IoCs
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
-
Reads runtime system information 15 IoCs
Reads data from /proc virtual filesystem.
-
Writes file to tmp directory 4 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/0e05896b109cab25b5dd680cbf416015/tmp/0e05896b109cab25b5dd680cbf4160151⤵
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt"1⤵
-
/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt2⤵
-
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt"1⤵
-
/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt2⤵
-
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt"1⤵
-
/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt2⤵
-
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt"1⤵
-
/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt2⤵
-
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt"1⤵
-
/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt2⤵
-
-
/bin/shsh -c "mkdir -p /usr/bin/bsd-port"1⤵
-
/bin/mkdirmkdir -p /usr/bin/bsd-port2⤵
- Reads runtime system information
-
-
/bin/shsh -c "cp -f /tmp/0e05896b109cab25b5dd680cbf416015 /usr/bin/bsd-port/getty"1⤵
-
/bin/cpcp -f /tmp/0e05896b109cab25b5dd680cbf416015 /usr/bin/bsd-port/getty2⤵
- Write file to user bin folder
- Reads runtime system information
-
-
/bin/shsh -c /usr/bin/bsd-port/getty1⤵
-
/usr/bin/bsd-port/getty/usr/bin/bsd-port/getty2⤵
- Executes dropped EXE
-
-
/bin/shsh -c "mkdir -p /usr/bin"1⤵
-
/bin/mkdirmkdir -p /usr/bin2⤵
- Reads runtime system information
-
-
/bin/shsh -c "cp -f /tmp/0e05896b109cab25b5dd680cbf416015 /usr/bin/.sshd"1⤵
-
/bin/cpcp -f /tmp/0e05896b109cab25b5dd680cbf416015 /usr/bin/.sshd2⤵
- Write file to user bin folder
- Reads runtime system information
-
-
/bin/shsh -c /usr/bin/.sshd1⤵
-
/usr/bin/.sshd/usr/bin/.sshd2⤵
- Executes dropped EXE
-
-
/bin/shsh -c "insmod /usr/lib/xpacket.ko"1⤵
-
/sbin/insmodinsmod /usr/lib/xpacket.ko2⤵
- Reads runtime system information
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux"1⤵
-
/bin/lnln -s /etc/init.d/selinux /etc/rc1.d/S99selinux2⤵
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux"1⤵
-
/bin/lnln -s /etc/init.d/selinux /etc/rc2.d/S99selinux2⤵
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux"1⤵
-
/bin/lnln -s /etc/init.d/selinux /etc/rc3.d/S99selinux2⤵
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux"1⤵
-
/bin/lnln -s /etc/init.d/selinux /etc/rc4.d/S99selinux2⤵
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux"1⤵
-
/bin/lnln -s /etc/init.d/selinux /etc/rc5.d/S99selinux2⤵
-
-
/bin/shsh -c "mkdir -p /usr/bin/dpkgd"1⤵
-
/bin/mkdirmkdir -p /usr/bin/dpkgd2⤵
- Reads runtime system information
-
-
/bin/shsh -c "cp -f /bin/ps /usr/bin/dpkgd/ps"1⤵
-
/bin/cpcp -f /bin/ps /usr/bin/dpkgd/ps2⤵
- Write file to user bin folder
- Reads runtime system information
-
-
/bin/shsh -c "mkdir -p /bin"1⤵
-
/bin/mkdirmkdir -p /bin2⤵
- Reads runtime system information
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/getty /bin/ps"1⤵
-
/bin/cpcp -f /usr/bin/bsd-port/getty /bin/ps2⤵
- Writes file to system bin folder
- Reads runtime system information
-
-
/bin/shsh -c "chmod 0755 /bin/ps"1⤵
-
/bin/chmodchmod 0755 /bin/ps2⤵
-
-
/bin/shsh -c "cp -f /usr/bin/lsof /usr/bin/dpkgd/lsof"1⤵
-
/bin/cpcp -f /usr/bin/lsof /usr/bin/dpkgd/lsof2⤵
- Write file to user bin folder
- Reads runtime system information
-
-
/bin/shsh -c "mkdir -p /usr/bin"1⤵
-
/bin/mkdirmkdir -p /usr/bin2⤵
- Reads runtime system information
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/getty /usr/bin/lsof"1⤵
-
/bin/cpcp -f /usr/bin/bsd-port/getty /usr/bin/lsof2⤵
- Write file to user bin folder
- Reads runtime system information
-
-
/bin/shsh -c "chmod 0755 /usr/bin/lsof"1⤵
-
/bin/chmodchmod 0755 /usr/bin/lsof2⤵
-
-
/bin/shsh -c "insmod /usr/lib/xpacket.ko"1⤵
-
/sbin/insmodinsmod /usr/lib/xpacket.ko2⤵
- Reads runtime system information
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
50B
MD55a8f63e3a79ac87d1f3bc7230f7fcc0a
SHA1a9b3df2f85d94b6cc5854b97a7ff3845fd64ded2
SHA2560f603e6b728eee672f2b533d84cf1bf7fdcd8c754cf048519e3e963f7b995eb0
SHA512b31a13a0f16c1ac1bb6387aade45ac191308f994ec1edb6200e3684e233ea80cf57578e09445a71884597a34daeb1e2cd5aa82bf42f1f88123c6e5bb6fa0c041
-
Filesize
4B
MD5facf9f743b083008a894eee7baa16469
SHA1fe286d02f80118de47f2226c2fce9f7be0bc04f0
SHA2562163909115c0f6f1e638bd2c2279387cbe37cc327150a7b5cddfde3d1cd4ef0e
SHA5127bd3d1d347d68f23d612a3ec7a1d2f4094874162441bae20122876ea980bbb76a3c46d5d2e393975ea0659fb2b58046a311d7660f226482a57a74e9ffd9b0f36
-
Filesize
4B
MD50ebcc77dc72360d0eb8e9504c78d38bd
SHA18b583aa0ac7f15508192f2ea1c56b9a07eb48e38
SHA2568698616a6419549cd9c035d5e250c81c6cefff11ff31c9602bf2ff5aa3e06b7f
SHA51218bc49d42d4b488f1264cf1f0fb6f914aa29d320e8721f75da80e9324a63c027670f82f6a0549837caac67f83e83dd67480305c079d65a380b54ff013ca11727
-
Filesize
1.1MB
MD50e05896b109cab25b5dd680cbf416015
SHA11819164e6668fe23fe32f71a3d255e6c1189ca5e
SHA25608d910fbe0c24f0e12a186a013129ecb07e907ae3331a8d069545e97d3f80c11
SHA51229826f90d653e6cec31bbe844847d6bad6f16ec1b447b417c3e42d7deec4467df303457a82332c37ff70f2c1698629246fd182eb6c5fb3d9dae1c45d093633f2
-
Filesize
159KB
MD5e093dc78225e2a0a25e3b137c1c1e442
SHA1c29497cfaae729eb576875e4fdfa400640ab16be
SHA2561190f4dbc7be174de8fd4096c9bf7a28eebfac937d308b7cc533be4a1240d26e
SHA512fe1cc7a65327732eaaee89f427c10239ba822430e34177842f4681068d78d404b1830d808a2a71b1efcc5f126c6d8c053512237421173aaa150e215a672da6f0
-
Filesize
130KB
MD5558edc26f8a38fa9788220b9af8a73e7
SHA13024d44e580e9c67f32f6c585d50e2a6cc9a7cac
SHA256b76435c80333d2c1fd18e0e7682f1c9dfb5da8d507e93e3c416f54b481c428d5
SHA512edaa425b441044f015e8f68fffa1664e42372d00dd0e7b0924d24ce947aa8e5f96b3bdc326fa2f8b978e3fcf638a1ceca45a223735db73f1607df66990feb56f