mrblack | f974ea63526356d1cab4efb1b5f091b4e8a39efe4cfd41dd628328c725957ac9

Analysis

max time kernel
153s
max time network
155s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20231215-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20231215-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
22-12-2023 01:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4a21bf00956f523f819d6229ed46dc43
Size

1.1MB
MD5

4a21bf00956f523f819d6229ed46dc43
SHA1

b87a5ee7e7c126f32cf9459f75565da60ba51a99
SHA256

f974ea63526356d1cab4efb1b5f091b4e8a39efe4cfd41dd628328c725957ac9
SHA512

c9968aa48b528d3941883a76d376b03c72b3a5003cba33efa3a65c139eb40621e6f53bdb13e4df048ae7cd2ed5b3f76d6914b12ff5504996092e8507be9114e0
SSDEEP

24576:4vRE7caCfKGPqVEDNLFxKsfaxI+gIGYuuCol7r:4vREKfPqVE5jKsfaxRHGVo7r

Score

10^/10

mrblack antivm botnet persistence trojan

Malware Config

Signatures

MrBlack Trojan
IoT botnet which infects routers to be used for DDoS attacks.
trojan botnet mrblack

MrBlack trojan 2 IoCs

Processes:

resource	yara_rule
/usr/bin/bsd-port/agent	family_mrblack
/usr/bin/acpid	family_mrblack

Executes dropped EXE 2 IoCs

Processes:

agentacpid

ioc pid process

/usr/bin/bsd-port/agent 1554 agent
/usr/bin/acpid 1562 acpid
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
antivm

Virtualization/Sandbox Evasion
T1497

Processes:

description ioc

File opened for reading /proc/cpuinfo
Modifies init.d 1 TTPs 2 IoCs
Adds/modifies system service, likely for persistence.
persistence

Boot or Logon Autostart Execution
T1547

Processes:

description ioc

File opened for modification /etc/init.d/selinux
File opened for modification /etc/init.d/DbSecurityMdt
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.

System Network Configuration Discovery
T1016

Processes:

description ioc

File opened for reading /proc/net/route

ioc	pid	process
/usr/bin/bsd-port/agent	1554	agent
/usr/bin/acpid	1562	acpid

description	ioc
File opened for reading	/proc/cpuinfo

description	ioc
File opened for modification	/etc/init.d/selinux
File opened for modification	/etc/init.d/DbSecurityMdt

description	ioc
File opened for reading	/proc/net/route

Write file to user bin folder 1 TTPs 8 IoCs

Hijack Execution Flow

T1574

Processes:

cpcpcpcpcp

description	ioc	process
File opened for modification	/usr/bin/dpkgd/lsof	cp
File opened for modification	/usr/bin/lsof	cp
File opened for modification	/usr/bin/bsd-port/conf.n
File opened for modification	/usr/bin/bsd-port/agent.conf
File opened for modification	/usr/bin/bsd-port/udevd.conf
File opened for modification	/usr/bin/bsd-port/agent	cp
File opened for modification	/usr/bin/acpid	cp
File opened for modification	/usr/bin/dpkgd/ps	cp

Writes file to system bin folder 1 TTPs 1 IoCs

Hijack Execution Flow
T1574

Processes:

cp

description ioc process

File opened for modification /bin/ps cp
Reads system network configuration 1 TTPs 3 IoCs
Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery
T1016

Processes:

description ioc

File opened for reading /proc/net/route
File opened for reading /proc/net/arp
File opened for reading /proc/net/dev

description	ioc	process
File opened for modification	/bin/ps	cp

description	ioc
File opened for reading	/proc/net/route
File opened for reading	/proc/net/arp
File opened for reading	/proc/net/dev

Reads runtime system information 15 IoCs

Reads data from /proc virtual filesystem.

Processes:

cpinsmodcpmkdircpmkdircpmkdircpcpmkdirmkdirinsmod

description	ioc	process
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/meminfo
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/stat
File opened for reading	/proc/cmdline	insmod

Writes file to tmp directory 4 IoCs

Malware often drops required files in the /tmp directory.

Processes:

description	ioc
File opened for modification	/tmp/moni.note
File opened for modification	/tmp/bill.note
File opened for modification	/tmp/gates.note
File opened for modification	/tmp/notify.file

/tmp/4a21bf00956f523f819d6229ed46dc43
/tmp/4a21bf00956f523f819d6229ed46dc43
1⤵
PID:1533

/bin/sh
sh -c "ln -s /etc/init.d/DbSecurityMdt /etc/rc1.d/S97DbSecurityMdt"
1⤵
PID:1538
- /bin/ln
  ln -s /etc/init.d/DbSecurityMdt /etc/rc1.d/S97DbSecurityMdt
  2⤵
  PID:1539

/bin/sh
sh -c "ln -s /etc/init.d/DbSecurityMdt /etc/rc2.d/S97DbSecurityMdt"
1⤵
PID:1540
- /bin/ln
  ln -s /etc/init.d/DbSecurityMdt /etc/rc2.d/S97DbSecurityMdt
  2⤵
  PID:1541

/bin/sh
sh -c "ln -s /etc/init.d/DbSecurityMdt /etc/rc3.d/S97DbSecurityMdt"
1⤵
PID:1542
- /bin/ln
  ln -s /etc/init.d/DbSecurityMdt /etc/rc3.d/S97DbSecurityMdt
  2⤵
  PID:1543

/bin/sh
sh -c "ln -s /etc/init.d/DbSecurityMdt /etc/rc4.d/S97DbSecurityMdt"
1⤵
PID:1544
- /bin/ln
  ln -s /etc/init.d/DbSecurityMdt /etc/rc4.d/S97DbSecurityMdt
  2⤵
  PID:1545

/bin/sh
sh -c "ln -s /etc/init.d/DbSecurityMdt /etc/rc5.d/S97DbSecurityMdt"
1⤵
PID:1546
- /bin/ln
  ln -s /etc/init.d/DbSecurityMdt /etc/rc5.d/S97DbSecurityMdt
  2⤵
  PID:1547

/bin/sh
sh -c "mkdir -p /usr/bin/bsd-port"
1⤵
PID:1548
- /bin/mkdir
  mkdir -p /usr/bin/bsd-port
  2⤵
  - Reads runtime system information
  PID:1549

/bin/sh
sh -c "cp -f /tmp/4a21bf00956f523f819d6229ed46dc43 /usr/bin/bsd-port/agent"
1⤵
PID:1550
- /bin/cp
  cp -f /tmp/4a21bf00956f523f819d6229ed46dc43 /usr/bin/bsd-port/agent
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1551

/bin/sh
sh -c /usr/bin/bsd-port/agent
1⤵
PID:1553
- /usr/bin/bsd-port/agent
  /usr/bin/bsd-port/agent
  2⤵
  - Executes dropped EXE
  PID:1554

/bin/sh
sh -c "mkdir -p /usr/bin"
1⤵
PID:1556
- /bin/mkdir
  mkdir -p /usr/bin
  2⤵
  - Reads runtime system information
  PID:1557

/bin/sh
sh -c "cp -f /tmp/4a21bf00956f523f819d6229ed46dc43 /usr/bin/acpid"
1⤵
PID:1558
- /bin/cp
  cp -f /tmp/4a21bf00956f523f819d6229ed46dc43 /usr/bin/acpid
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1559

/bin/sh
sh -c /usr/bin/acpid
1⤵
PID:1561
- /usr/bin/acpid
  /usr/bin/acpid
  2⤵
  - Executes dropped EXE
  PID:1562

/bin/sh
sh -c "insmod /usr/lib/xpacket.ko"
1⤵
PID:1564
- /sbin/insmod
  insmod /usr/lib/xpacket.ko
  2⤵
  - Reads runtime system information
  PID:1565

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux"
1⤵
PID:1570
- /bin/ln
  ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux
  2⤵
  PID:1571

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux"
1⤵
PID:1574
- /bin/ln
  ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux
  2⤵
  PID:1575

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux"
1⤵
PID:1577
- /bin/ln
  ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux
  2⤵
  PID:1578

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux"
1⤵
PID:1579
- /bin/ln
  ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux
  2⤵
  PID:1580

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux"
1⤵
PID:1581
- /bin/ln
  ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux
  2⤵
  PID:1582

/bin/sh
sh -c "mkdir -p /usr/bin/dpkgd"
1⤵
PID:1583
- /bin/mkdir
  mkdir -p /usr/bin/dpkgd
  2⤵
  - Reads runtime system information
  PID:1584

/bin/sh
sh -c "cp -f /bin/ps /usr/bin/dpkgd/ps"
1⤵
PID:1585
- /bin/cp
  cp -f /bin/ps /usr/bin/dpkgd/ps
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1586

/bin/sh
sh -c "mkdir -p /bin"
1⤵
PID:1587
- /bin/mkdir
  mkdir -p /bin
  2⤵
  - Reads runtime system information
  PID:1588

/bin/sh
sh -c "cp -f /usr/bin/bsd-port/agent /bin/ps"
1⤵
PID:1589
- /bin/cp
  cp -f /usr/bin/bsd-port/agent /bin/ps
  2⤵
  - Writes file to system bin folder
  - Reads runtime system information
  PID:1590

/bin/sh
sh -c "chmod 0755 /bin/ps"
1⤵
PID:1591
- /bin/chmod
  chmod 0755 /bin/ps
  2⤵
  PID:1592

/bin/sh
sh -c "cp -f /usr/bin/lsof /usr/bin/dpkgd/lsof"
1⤵
PID:1593
- /bin/cp
  cp -f /usr/bin/lsof /usr/bin/dpkgd/lsof
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1594

/bin/sh
sh -c "mkdir -p /usr/bin"
1⤵
PID:1595
- /bin/mkdir
  mkdir -p /usr/bin
  2⤵
  - Reads runtime system information
  PID:1596

/bin/sh
sh -c "cp -f /usr/bin/bsd-port/agent /usr/bin/lsof"
1⤵
PID:1597
- /bin/cp
  cp -f /usr/bin/bsd-port/agent /usr/bin/lsof
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1598

/bin/sh
sh -c "chmod 0755 /usr/bin/lsof"
1⤵
PID:1600
- /bin/chmod
  chmod 0755 /usr/bin/lsof
  2⤵
  PID:1601

/bin/sh
sh -c "insmod /usr/lib/xpacket.ko"
1⤵
PID:1602
- /sbin/insmod
  insmod /usr/lib/xpacket.ko
  2⤵
  - Reads runtime system information
  PID:1603

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Defense Evasion

Hijack Execution Flow

T1574

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/etc/init.d/DbSecurityMdt

Filesize
50B

MD5
62239c774d96fbf02e37d3c486f74e96

SHA1
3657b699dbd3daf3e1a58d200097760feb73c3f0

SHA256
d2d07f967f1b7fb4fdd24853f3949d6908888940d139e3c0b173497c31643eb7

SHA512
9d41d8a1a9a541685282c9621b2faedfb1303a57dad6dba3d035c14147ce8aace4f1ff6925956f527b0e0f0786d5a0209536e395da819c73388ec7eb8021b396

Download Submit
/etc/init.d/selinux

Filesize
36B

MD5
c6a80f08539a4c3176762f514976dd24

SHA1
bbc5826b01d20f5c4d315ff5dbc3f216760c64ef

SHA256
ea47e885ae227059ce55d020335f7869c565ec6d85f484497e83cd4998149d5d

SHA512
9a1e3b0142876305fe389e07880bd586e97bf709273a66299d9128ff2861459104054d4e5d836aecdf73f2c11886fa3a2a8498741adb3211b96116658b856175

Download Submit
/tmp/gates.note

Filesize
4B

MD5
d63fbf8c3173730f82b150c5ef38b8ff

SHA1
1d23c8edf135106a57d7f1694d9c2c7eb67cc326

SHA256
13be5b896be039957e7996f606c8513fa2d9061132bdcabdbee5a362dd9fd8ff

SHA512
275c9875be2b60cc2d67678f6c08b9bfb4f21f8f087eaa942aad8d808f2141a9d1b376e1825ab764f8eda46cc7f6a86490d8475ca8446a6ef519c71784fdc11a

Download Submit
/tmp/moni.note

Filesize
4B

MD5
4d6e4749289c4ec58c0063a90deb3964

SHA1
a0e3eab3c80118379cb2e1d7b163f82494430e03

SHA256
e830a0d7d5f303724e6404c8f9797580b6e77e4bdab70b8e163967925b69e6d0

SHA512
c0a696afb1940c302622b6ba6ec2913c19903291626073ed3233a16000d45bb61ec7c676c42c1ae0e0b32126d9f72e938a80e665a68ad3fbfa0e606c352276ed

Download Submit
/tmp/notify.file

Filesize
37B

MD5
585c70e811a4d6f8ee25693024f70c84

SHA1
9b8a786e7b83feba2131bdb1a5571626b4708121

SHA256
36dfa137cf9b01d077ed9403017ac7802b5e5693a3e1dbf1f50c7a51d5051666

SHA512
611ce26dd44cf24fba5bc34586ec2cb7778dc4a99208613e4d7a05f6d8b936abce953a9f4bbc1056f813e80eb427e0d4099f91448b8a3a3d9ac52ae6003c9519

Download Submit
/usr/bin/acpid

Filesize
1.1MB

MD5
4a21bf00956f523f819d6229ed46dc43

SHA1
b87a5ee7e7c126f32cf9459f75565da60ba51a99

SHA256
f974ea63526356d1cab4efb1b5f091b4e8a39efe4cfd41dd628328c725957ac9

SHA512
c9968aa48b528d3941883a76d376b03c72b3a5003cba33efa3a65c139eb40621e6f53bdb13e4df048ae7cd2ed5b3f76d6914b12ff5504996092e8507be9114e0

Download Submit
/usr/bin/bsd-port/agent

Filesize
876KB

MD5
2549674b9ddb04b6037c600f92dd1558

SHA1
3bb3e16fc31c3efc5c6c7c792e6be776d9956c02

SHA256
b9ab60a9dbab028ce2d42e28b466c1c78ca6830c5f5bda3e393b8b04aae92fd0

SHA512
e1bf1c46074f0e17b825c35480ec0012005c4f5d8e0928325621d171a4ccd1ca6c5ea414e677239f8ef2025875e72f397e38e91f8c2db093e5a9d49eb4c38666

Download Submit
/usr/bin/bsd-port/conf.n

Filesize
69B

MD5
40650058a36ce26a7ce09530c6515f5d

SHA1
e4c1e1e3e242aef731426a193e7b29f9a703b662

SHA256
aba99ddd3850721f259fa8abf18014b22340f6d0793ddb491b218ee966b25411

SHA512
4f0536c7bb9911ea44958f9eb129d2059de4eebee0b38445b71b4acc851a75db1649cb5dc4f0b69e59f89ff30a52eaeba3c462a0ec35bd1604242ea8f35ed5e3

Download Submit
/usr/bin/bsd-port/conf.n

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/usr/bin/dpkgd/lsof

Filesize
159KB

MD5
e093dc78225e2a0a25e3b137c1c1e442

SHA1
c29497cfaae729eb576875e4fdfa400640ab16be

SHA256
1190f4dbc7be174de8fd4096c9bf7a28eebfac937d308b7cc533be4a1240d26e

SHA512
fe1cc7a65327732eaaee89f427c10239ba822430e34177842f4681068d78d404b1830d808a2a71b1efcc5f126c6d8c053512237421173aaa150e215a672da6f0

Download Submit
/usr/bin/dpkgd/ps

Filesize
130KB

MD5
558edc26f8a38fa9788220b9af8a73e7

SHA1
3024d44e580e9c67f32f6c585d50e2a6cc9a7cac

SHA256
b76435c80333d2c1fd18e0e7682f1c9dfb5da8d507e93e3c416f54b481c428d5

SHA512
edaa425b441044f015e8f68fffa1664e42372d00dd0e7b0924d24ce947aa8e5f96b3bdc326fa2f8b978e3fcf638a1ceca45a223735db73f1607df66990feb56f

Download Submit