mrblack | 19ba3b2658b0bc0fed89b30286bc28c2d4296cb27c2d758f78596be138317b60

General

Target

298049890e2f02ba6a507f8d73c7f7dc
Size

1.2MB
MD5

298049890e2f02ba6a507f8d73c7f7dc
SHA1

76ec00fe09b85c2cb1df9363e2919705190f35c5
SHA256

19ba3b2658b0bc0fed89b30286bc28c2d4296cb27c2d758f78596be138317b60
SHA512

1b38b290c3b12078c7cdff7f97a2ce59069671fa0f94ce72d108b0ed366567a1d038e80a0f5e204e578513c1233ca79ff5b655fef92f2ef9767322bb852aed1f
SSDEEP

24576:e845rGHu6gVJKG75oFpA0VWeX402y1q2rJp0:745vRVJKGtSA0VWeobu9p0

Score

10^/10

mrblack antivm botnet persistence trojan

Malware Config

Signatures

MrBlack Trojan
IoT botnet which infects routers to be used for DDoS attacks.
trojan botnet mrblack

MrBlack trojan 2 IoCs

resource	yara_rule
behavioral1/files/fstream-4.dat	family_mrblack
behavioral1/files/fstream-7.dat	family_mrblack

Executes dropped EXE 2 IoCs

ioc	pid	Process
/usr/bin/bsd-port/getty	1545	getty
/usr/bin/.sshd	1597	.sshd

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

T1497

description	ioc
File opened for reading	/proc/cpuinfo

Modifies init.d 1 TTPs 2 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

description	ioc
File opened for modification	/etc/init.d/DbSecuritySpt
File opened for modification	/etc/init.d/selinux

Write file to user bin folder 1 TTPs 8 IoCs

Hijack Execution Flow

T1574

description	ioc	Process
File opened for modification	/usr/bin/bsd-port/udevd.lock	Process not Found
File opened for modification	/usr/bin/bsd-port/getty	cp
File opened for modification	/usr/bin/.sshd	cp
File opened for modification	/usr/bin/dpkgd/ps	cp
File opened for modification	/usr/bin/dpkgd/ss	cp
File opened for modification	/usr/bin/dpkgd/lsof	cp
File opened for modification	/usr/bin/lsof	cp
File opened for modification	/usr/bin/bsd-port/getty.lock	Process not Found

Writes file to system bin folder 1 TTPs 2 IoCs

Hijack Execution Flow

T1574

description	ioc	Process
File opened for modification	/bin/ss	cp
File opened for modification	/bin/ps	cp

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery

T1016

description	ioc
File opened for reading	/proc/net/dev

Reads runtime system information 23 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/meminfo	Process not Found
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/stat	Process not Found
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/cmdline	insmod

Writes file to tmp directory 4 IoCs

Malware often drops required files in the /tmp directory.

description	ioc
File opened for modification	/tmp/gates.lod
File opened for modification	/tmp/notify.file
File opened for modification	/tmp/moni.lod
File opened for modification	/tmp/bill.lock

/tmp/298049890e2f02ba6a507f8d73c7f7dc
/tmp/298049890e2f02ba6a507f8d73c7f7dc
1⤵
PID:1519

/bin/sh
sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt"
1⤵
PID:1524
- /bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt
  2⤵
  PID:1525

/bin/sh
sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt"
1⤵
PID:1526
- /bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt
  2⤵
  PID:1527

/bin/sh
sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt"
1⤵
PID:1528
- /bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt
  2⤵
  PID:1529

/bin/sh
sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt"
1⤵
PID:1530
- /bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt
  2⤵
  PID:1531

/bin/sh
sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt"
1⤵
PID:1532
- /bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt
  2⤵
  PID:1533

/bin/sh
sh -c "mkdir -p /usr/bin/bsd-port"
1⤵
PID:1534
- /bin/mkdir
  mkdir -p /usr/bin/bsd-port
  2⤵
  - Reads runtime system information
  PID:1535

/bin/sh
sh -c "mkdir -p /usr/bin/bsd-port"
1⤵
PID:1536
- /bin/mkdir
  mkdir -p /usr/bin/bsd-port
  2⤵
  - Reads runtime system information
  PID:1537

/bin/sh
sh -c "cp -f /tmp/298049890e2f02ba6a507f8d73c7f7dc /usr/bin/bsd-port/getty"
1⤵
PID:1538
- /bin/cp
  cp -f /tmp/298049890e2f02ba6a507f8d73c7f7dc /usr/bin/bsd-port/getty
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1539

/bin/sh
sh -c /usr/bin/bsd-port/getty
1⤵
PID:1544
- /usr/bin/bsd-port/getty
  /usr/bin/bsd-port/getty
  2⤵
  - Executes dropped EXE
  PID:1545

/bin/sh
sh -c "mkdir -p /usr/bin"
1⤵
PID:1547
- /bin/mkdir
  mkdir -p /usr/bin
  2⤵
  - Reads runtime system information
  PID:1548

/bin/sh
sh -c "mkdir -p /usr/bin"
1⤵
PID:1549
- /bin/mkdir
  mkdir -p /usr/bin
  2⤵
  - Reads runtime system information
  PID:1550

/bin/sh
sh -c "cp -f /tmp/298049890e2f02ba6a507f8d73c7f7dc /usr/bin/.sshd"
1⤵
PID:1551
- /bin/cp
  cp -f /tmp/298049890e2f02ba6a507f8d73c7f7dc /usr/bin/.sshd
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1552

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux"
1⤵
PID:1553
- /bin/ln
  ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux
  2⤵
  PID:1554

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux"
1⤵
PID:1555
- /bin/ln
  ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux
  2⤵
  PID:1556

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux"
1⤵
PID:1557
- /bin/ln
  ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux
  2⤵
  PID:1558

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux"
1⤵
PID:1559
- /bin/ln
  ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux
  2⤵
  PID:1560

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux"
1⤵
PID:1561
- /bin/ln
  ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux
  2⤵
  PID:1562

/bin/sh
sh -c "mkdir -p /usr/bin/dpkgd"
1⤵
PID:1563
- /bin/mkdir
  mkdir -p /usr/bin/dpkgd
  2⤵
  - Reads runtime system information
  PID:1564

/bin/sh
sh -c "cp -f /bin/ps /usr/bin/dpkgd/ps"
1⤵
PID:1565
- /bin/cp
  cp -f /bin/ps /usr/bin/dpkgd/ps
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1566

/bin/sh
sh -c "mkdir -p /bin"
1⤵
PID:1567
- /bin/mkdir
  mkdir -p /bin
  2⤵
  - Reads runtime system information
  PID:1568

/bin/sh
sh -c "mkdir -p /bin"
1⤵
PID:1569
- /bin/mkdir
  mkdir -p /bin
  2⤵
  - Reads runtime system information
  PID:1570

/bin/sh
sh -c "cp -f /usr/bin/bsd-port/getty /bin/ps"
1⤵
PID:1571
- /bin/cp
  cp -f /usr/bin/bsd-port/getty /bin/ps
  2⤵
  - Writes file to system bin folder
  - Reads runtime system information
  PID:1572

/bin/sh
sh -c "chmod 0755 /bin/ps"
1⤵
PID:1573
- /bin/chmod
  chmod 0755 /bin/ps
  2⤵
  PID:1574

/bin/sh
sh -c "cp -f /bin/ss /usr/bin/dpkgd/ss"
1⤵
PID:1575
- /bin/cp
  cp -f /bin/ss /usr/bin/dpkgd/ss
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1576

/bin/sh
sh -c "mkdir -p /bin"
1⤵
PID:1577
- /bin/mkdir
  mkdir -p /bin
  2⤵
  - Reads runtime system information
  PID:1578

/bin/sh
sh -c "mkdir -p /bin"
1⤵
PID:1579
- /bin/mkdir
  mkdir -p /bin
  2⤵
  - Reads runtime system information
  PID:1580

/bin/sh
sh -c "cp -f /usr/bin/bsd-port/getty /bin/ss"
1⤵
PID:1581
- /bin/cp
  cp -f /usr/bin/bsd-port/getty /bin/ss
  2⤵
  - Writes file to system bin folder
  - Reads runtime system information
  PID:1582

/bin/sh
sh -c "chmod 0755 /bin/ss"
1⤵
PID:1583
- /bin/chmod
  chmod 0755 /bin/ss
  2⤵
  PID:1584

/bin/sh
sh -c "cp -f /usr/bin/lsof /usr/bin/dpkgd/lsof"
1⤵
PID:1585
- /bin/cp
  cp -f /usr/bin/lsof /usr/bin/dpkgd/lsof
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1586

/bin/sh
sh -c "mkdir -p /usr/bin"
1⤵
PID:1587
- /bin/mkdir
  mkdir -p /usr/bin
  2⤵
  - Reads runtime system information
  PID:1588

/bin/sh
sh -c "mkdir -p /usr/bin"
1⤵
PID:1589
- /bin/mkdir
  mkdir -p /usr/bin
  2⤵
  - Reads runtime system information
  PID:1590

/bin/sh
sh -c "cp -f /usr/bin/bsd-port/getty /usr/bin/lsof"
1⤵
PID:1591
- /bin/cp
  cp -f /usr/bin/bsd-port/getty /usr/bin/lsof
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1592

/bin/sh
sh -c "chmod 0755 /usr/bin/lsof"
1⤵
PID:1593
- /bin/chmod
  chmod 0755 /usr/bin/lsof
  2⤵
  PID:1594

/bin/sh
sh -c /usr/bin/.sshd
1⤵
PID:1596
- /usr/bin/.sshd
  /usr/bin/.sshd
  2⤵
  - Executes dropped EXE
  PID:1597

/bin/sh
sh -c "insmod /usr/bin/bsd-port/xpacket.ko"
1⤵
PID:1600
- /sbin/insmod
  insmod /usr/bin/bsd-port/xpacket.ko
  2⤵
  - Reads runtime system information
  PID:1601

/bin/sh
sh -c "insmod /tmp/xpacket.ko"
1⤵
PID:1602
- /sbin/insmod
  insmod /tmp/xpacket.ko
  2⤵
  - Reads runtime system information
  PID:1603

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Hijack Execution Flow

2

T1574

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Hijack Execution Flow

2

T1574

Defense Evasion

Hijack Execution Flow

2

T1574

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

System Network Configuration Discovery

1

T1016

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/etc/init.d/selinux

Filesize
36B

MD5
993cc15058142d96c3daf7852c3d5ee8

SHA1
0950b8b391b04dd3895ea33cd3141543ebd2525d

SHA256
8171d077918611803d93088409f220c66fae1c670b297e1aa5d8cbd548ce9208

SHA512
0c4256c00a3710f97e92581b552682b36b62afc35fe72622c491323c618c19ea62611ac04ccafc3dfcde2254a2ebbd93b69b66795b16e36332293bed83adb928

Download Submit
/tmp/moni.lod

Filesize
4B

MD5
9c19a2aa1d84e04b0bd4bc888792bd1e

SHA1
037880d210451b590c3a5229ea350645724e7e15

SHA256
191024c47d6c2b3c24a570326b7e29f09652ec8bc2bb1779d95783e8753d12db

SHA512
fbc7830e289b19696b7b6e01ae6d7e5403d144d417e380e47c29ea17db59c765ae7aa4a47cf885b6af0df831a8c98d5f99a40c35d121854ba273dd4afab24f93

Download Submit
/usr/bin/.sshd

Filesize
890KB

MD5
c5f8cc7b348fbd5ed19a41d8d4afa26b

SHA1
bfe5a762a68e68b9e5eaabc76b0f40de74a22f18

SHA256
8216884d5c36a43b1f1256a8a6a7398b7264e05b59f5aaa544e2db95b383a60f

SHA512
7d3a48262176f4447fee9a535a79d6d99cd20b53545d29e0c6b0ada4298f6eb9103cd7363eda795703a94cae2b702e876dd6c7b8811790ad418a4b37e7b44a74

Download Submit
/usr/bin/bsd-port/getty

Filesize
1.2MB

MD5
298049890e2f02ba6a507f8d73c7f7dc

SHA1
76ec00fe09b85c2cb1df9363e2919705190f35c5

SHA256
19ba3b2658b0bc0fed89b30286bc28c2d4296cb27c2d758f78596be138317b60

SHA512
1b38b290c3b12078c7cdff7f97a2ce59069671fa0f94ce72d108b0ed366567a1d038e80a0f5e204e578513c1233ca79ff5b655fef92f2ef9767322bb852aed1f

Download Submit
/usr/bin/dpkgd/lsof

Filesize
159KB

MD5
e093dc78225e2a0a25e3b137c1c1e442

SHA1
c29497cfaae729eb576875e4fdfa400640ab16be

SHA256
1190f4dbc7be174de8fd4096c9bf7a28eebfac937d308b7cc533be4a1240d26e

SHA512
fe1cc7a65327732eaaee89f427c10239ba822430e34177842f4681068d78d404b1830d808a2a71b1efcc5f126c6d8c053512237421173aaa150e215a672da6f0

Download Submit
/usr/bin/dpkgd/ss

Filesize
1KB

MD5
4022e3e67d032a41ccac7c502d8a14f5

SHA1
32186f4ba72f0b899c099c62581dc8c102d7d7d9

SHA256
96dd4ccc2d094fb2791b87e6ca94f7253bfe4cae7fac05408585e8f6fd74522c

SHA512
68cf2872d6c92dbd06bd070dfaff0ee9772547ddfa9edd3a95e1b3d48055671ed677bbcb8e91f66dd454f9a3815e87d6a02d2ba5ade5ebc4431a5c9ab4236bb1

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads