Overview

overview

10

Static

static

10

0894ee1d6e...4b385c

ubuntu-18.04-amd64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0894ee1d6e43f54343f21fb8dc4b385c

  • Size

    1.5MB

  • Sample

    231221-1ryx3scce8

  • MD5

    0894ee1d6e43f54343f21fb8dc4b385c

  • SHA1

    e94f9108770a3192230a9737adc2d7a541f25eb3

  • SHA256

    34847c24984fcd6f3e0cad1ed7eafcb70db20583a59f0e84df3ea42c0c7659b6

  • SHA512

    8c260c48edbd1d5087b3baf30dfb6b0ed3063d86bfdadba251907514d8fc3d6c3f990ee20734b9b44b307b91294099a40ec1e4dd584954319c76f358e283b4e8

  • SSDEEP

    24576:GA46TrzJBisiOvhlOHdSbQmHyJgf/kgX0Exb2cyaGpIoiMKnnLmYXqSYKKZdTrnD:zRNi6OHdSbQoyJyXpxb2PaGpXiMKnLmB

Score
10/10
mrblackantivmbotnetlinuxpersistencetrojan

Malware Config

Targets

    • Target

      0894ee1d6e43f54343f21fb8dc4b385c

    • Size

      1.5MB

    • MD5

      0894ee1d6e43f54343f21fb8dc4b385c

    • SHA1

      e94f9108770a3192230a9737adc2d7a541f25eb3

    • SHA256

      34847c24984fcd6f3e0cad1ed7eafcb70db20583a59f0e84df3ea42c0c7659b6

    • SHA512

      8c260c48edbd1d5087b3baf30dfb6b0ed3063d86bfdadba251907514d8fc3d6c3f990ee20734b9b44b307b91294099a40ec1e4dd584954319c76f358e283b4e8

    • SSDEEP

      24576:GA46TrzJBisiOvhlOHdSbQmHyJgf/kgX0Exb2cyaGpIoiMKnnLmYXqSYKKZdTrnD:zRNi6OHdSbQoyJyXpxb2PaGpXiMKnLmB

    Score
    10/10
    mrblackantivmbotnetpersistencetrojan

    • MrBlack Trojan

      IoT botnet which infects routers to be used for DDoS attacks.

      trojanbotnetmrblack

    • MrBlack trojan

    • Executes dropped EXE

    • Checks CPU configuration

      Checks CPU information which indicate if the system is a virtual machine.

      antivm

    • Modifies init.d

      Adds/modifies system service, likely for persistence.

      persistence

    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

    • Write file to user bin folder

    • Writes file to system bin folder

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks