Overview

overview

10

Static

static

10

2812cc3ac9...58018d

ubuntu-18.04-amd64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2812cc3ac9c7bee252ab70fe9558018d

  • Size

    1.2MB

  • Sample

    231221-3l6rvabcgn

  • MD5

    2812cc3ac9c7bee252ab70fe9558018d

  • SHA1

    f47bfe1d2b304e4922ce9dfcab5e7c1ee426c48b

  • SHA256

    0f1479386618e132bd51440cb400ad376868a7e693e2ec491d5ac2290be80500

  • SHA512

    ee30a36afeca76c0327d8fe9ebdc863a2996bc1162ff5501dc96205b91f7fc921afef0aa13423ed6aefa0bb85e98650d8447b726ee5addeec35564fb0ab9cdb8

  • SSDEEP

    24576:e845rGHu6gVJKG75oFpA0VWeX4P2y1q2rJp0:745vRVJKGtSA0VWeouu9p0

Score
10/10
mrblackantivmbotnetlinuxpersistencetrojan

Malware Config

Targets

    • Target

      2812cc3ac9c7bee252ab70fe9558018d

    • Size

      1.2MB

    • MD5

      2812cc3ac9c7bee252ab70fe9558018d

    • SHA1

      f47bfe1d2b304e4922ce9dfcab5e7c1ee426c48b

    • SHA256

      0f1479386618e132bd51440cb400ad376868a7e693e2ec491d5ac2290be80500

    • SHA512

      ee30a36afeca76c0327d8fe9ebdc863a2996bc1162ff5501dc96205b91f7fc921afef0aa13423ed6aefa0bb85e98650d8447b726ee5addeec35564fb0ab9cdb8

    • SSDEEP

      24576:e845rGHu6gVJKG75oFpA0VWeX4P2y1q2rJp0:745vRVJKGtSA0VWeouu9p0

    Score
    10/10
    mrblackantivmbotnetpersistencetrojan

    • MrBlack Trojan

      IoT botnet which infects routers to be used for DDoS attacks.

      trojanbotnetmrblack

    • MrBlack trojan

    • Executes dropped EXE

    • Checks CPU configuration

      Checks CPU information which indicate if the system is a virtual machine.

      antivm

    • Modifies init.d

      Adds/modifies system service, likely for persistence.

      persistence

    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

    • Write file to user bin folder

    • Writes file to system bin folder

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks