Analysis
-
max time kernel
153s -
max time network
152s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20231215-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20231215-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
22-12-2023 01:15
Behavioral task
behavioral1
Sample
43195a0298bcc72b72f5687d4bd49c37
Resource
ubuntu1804-amd64-20231215-en
General
-
Target
43195a0298bcc72b72f5687d4bd49c37
-
Size
1.1MB
-
MD5
43195a0298bcc72b72f5687d4bd49c37
-
SHA1
90ea668fc256ee75f803da35bad44589cd2caddf
-
SHA256
43056c0ce96c83c1c21263fd163f9a59156cbab1b5b7b713a4409ba5feeb7a7d
-
SHA512
8b169b0f24e2676f05110df630c1a1df40d2b89176ebfcfd7ca59678cfad992b2ff152c041c93c1ea66d2f6be64a3a9adf99b67cc59d582ec14a3c207ab421a1
-
SSDEEP
24576:4vRE7caCfKGPqVEDNLFxKsfa/I+gIGYuuCol7r:4vREKfPqVE5jKsfa/RHGVo7r
Malware Config
Signatures
-
MrBlack trojan 2 IoCs
resource yara_rule behavioral1/files/fstream-4.dat family_mrblack behavioral1/files/fstream-6.dat family_mrblack -
Executes dropped EXE 2 IoCs
ioc pid Process /usr/bin/bsd-port/recei 1559 recei /usr/bin/oracle 1567 oracle -
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc File opened for reading /proc/cpuinfo -
description ioc File opened for modification /etc/init.d/VsystemsshMmt File opened for modification /etc/init.d/selinux -
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
description ioc File opened for reading /proc/net/route -
Write file to user bin folder 1 TTPs 8 IoCs
description ioc Process File opened for modification /usr/bin/dpkgd/ps cp File opened for modification /usr/bin/dpkgd/lsof cp File opened for modification /usr/bin/lsof cp File opened for modification /usr/bin/bsd-port/conf.n Process not Found File opened for modification /usr/bin/bsd-port/recei.conf Process not Found File opened for modification /usr/bin/bsd-port/udevd.conf Process not Found File opened for modification /usr/bin/bsd-port/recei cp File opened for modification /usr/bin/oracle cp -
Writes file to system bin folder 1 TTPs 1 IoCs
description ioc Process File opened for modification /bin/ps cp -
Reads system network configuration 1 TTPs 3 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc File opened for reading /proc/net/arp File opened for reading /proc/net/dev File opened for reading /proc/net/route -
Reads runtime system information 15 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems mkdir File opened for reading /proc/cmdline insmod File opened for reading /proc/filesystems cp File opened for reading /proc/cmdline insmod File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems mkdir File opened for reading /proc/meminfo Process not Found File opened for reading /proc/filesystems mkdir File opened for reading /proc/stat Process not Found File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems cp -
Writes file to tmp directory 5 IoCs
Malware often drops required files in the /tmp directory.
description ioc File opened for modification /tmp/conf.n File opened for modification /tmp/appd.log File opened for modification /tmp/appd.conf File opened for modification /tmp/Dest.cfg File opened for modification /tmp/notify.file
Processes
-
/tmp/43195a0298bcc72b72f5687d4bd49c37/tmp/43195a0298bcc72b72f5687d4bd49c371⤵PID:1537
-
/bin/shsh -c "ln -s /etc/init.d/VsystemsshMmt /etc/rc1.d/S97VsystemsshMmt"1⤵PID:1543
-
/bin/lnln -s /etc/init.d/VsystemsshMmt /etc/rc1.d/S97VsystemsshMmt2⤵PID:1544
-
-
/bin/shsh -c "ln -s /etc/init.d/VsystemsshMmt /etc/rc2.d/S97VsystemsshMmt"1⤵PID:1545
-
/bin/lnln -s /etc/init.d/VsystemsshMmt /etc/rc2.d/S97VsystemsshMmt2⤵PID:1546
-
-
/bin/shsh -c "ln -s /etc/init.d/VsystemsshMmt /etc/rc3.d/S97VsystemsshMmt"1⤵PID:1547
-
/bin/lnln -s /etc/init.d/VsystemsshMmt /etc/rc3.d/S97VsystemsshMmt2⤵PID:1548
-
-
/bin/shsh -c "ln -s /etc/init.d/VsystemsshMmt /etc/rc4.d/S97VsystemsshMmt"1⤵PID:1549
-
/bin/lnln -s /etc/init.d/VsystemsshMmt /etc/rc4.d/S97VsystemsshMmt2⤵PID:1550
-
-
/bin/shsh -c "ln -s /etc/init.d/VsystemsshMmt /etc/rc5.d/S97VsystemsshMmt"1⤵PID:1551
-
/bin/lnln -s /etc/init.d/VsystemsshMmt /etc/rc5.d/S97VsystemsshMmt2⤵PID:1552
-
-
/bin/shsh -c "mkdir -p /usr/bin/bsd-port"1⤵PID:1553
-
/bin/mkdirmkdir -p /usr/bin/bsd-port2⤵
- Reads runtime system information
PID:1554
-
-
/bin/shsh -c "cp -f /tmp/43195a0298bcc72b72f5687d4bd49c37 /usr/bin/bsd-port/recei"1⤵PID:1555
-
/bin/cpcp -f /tmp/43195a0298bcc72b72f5687d4bd49c37 /usr/bin/bsd-port/recei2⤵
- Write file to user bin folder
- Reads runtime system information
PID:1556
-
-
/bin/shsh -c /usr/bin/bsd-port/recei1⤵PID:1558
-
/usr/bin/bsd-port/recei/usr/bin/bsd-port/recei2⤵
- Executes dropped EXE
PID:1559
-
-
/bin/shsh -c "mkdir -p /usr/bin"1⤵PID:1561
-
/bin/mkdirmkdir -p /usr/bin2⤵
- Reads runtime system information
PID:1562
-
-
/bin/shsh -c "cp -f /tmp/43195a0298bcc72b72f5687d4bd49c37 /usr/bin/oracle"1⤵PID:1563
-
/bin/cpcp -f /tmp/43195a0298bcc72b72f5687d4bd49c37 /usr/bin/oracle2⤵
- Write file to user bin folder
- Reads runtime system information
PID:1564
-
-
/bin/shsh -c /usr/bin/oracle1⤵PID:1566
-
/usr/bin/oracle/usr/bin/oracle2⤵
- Executes dropped EXE
PID:1567
-
-
/bin/shsh -c "insmod /usr/lib/xpacket.ko"1⤵PID:1569
-
/sbin/insmodinsmod /usr/lib/xpacket.ko2⤵
- Reads runtime system information
PID:1570
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux"1⤵PID:1578
-
/bin/lnln -s /etc/init.d/selinux /etc/rc1.d/S99selinux2⤵PID:1579
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux"1⤵PID:1580
-
/bin/lnln -s /etc/init.d/selinux /etc/rc2.d/S99selinux2⤵PID:1581
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux"1⤵PID:1582
-
/bin/lnln -s /etc/init.d/selinux /etc/rc3.d/S99selinux2⤵PID:1583
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux"1⤵PID:1584
-
/bin/lnln -s /etc/init.d/selinux /etc/rc4.d/S99selinux2⤵PID:1585
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux"1⤵PID:1586
-
/bin/lnln -s /etc/init.d/selinux /etc/rc5.d/S99selinux2⤵PID:1587
-
-
/bin/shsh -c "mkdir -p /usr/bin/dpkgd"1⤵PID:1588
-
/bin/mkdirmkdir -p /usr/bin/dpkgd2⤵
- Reads runtime system information
PID:1589
-
-
/bin/shsh -c "cp -f /bin/ps /usr/bin/dpkgd/ps"1⤵PID:1591
-
/bin/cpcp -f /bin/ps /usr/bin/dpkgd/ps2⤵
- Write file to user bin folder
- Reads runtime system information
PID:1592
-
-
/bin/shsh -c "mkdir -p /bin"1⤵PID:1593
-
/bin/mkdirmkdir -p /bin2⤵
- Reads runtime system information
PID:1594
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/recei /bin/ps"1⤵PID:1595
-
/bin/cpcp -f /usr/bin/bsd-port/recei /bin/ps2⤵
- Writes file to system bin folder
- Reads runtime system information
PID:1596
-
-
/bin/shsh -c "chmod 0755 /bin/ps"1⤵PID:1597
-
/bin/chmodchmod 0755 /bin/ps2⤵PID:1598
-
-
/bin/shsh -c "cp -f /usr/bin/lsof /usr/bin/dpkgd/lsof"1⤵PID:1599
-
/bin/cpcp -f /usr/bin/lsof /usr/bin/dpkgd/lsof2⤵
- Write file to user bin folder
- Reads runtime system information
PID:1600
-
-
/bin/shsh -c "mkdir -p /usr/bin"1⤵PID:1601
-
/bin/mkdirmkdir -p /usr/bin2⤵
- Reads runtime system information
PID:1602
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/recei /usr/bin/lsof"1⤵PID:1603
-
/bin/cpcp -f /usr/bin/bsd-port/recei /usr/bin/lsof2⤵
- Write file to user bin folder
- Reads runtime system information
PID:1604
-
-
/bin/shsh -c "chmod 0755 /usr/bin/lsof"1⤵PID:1605
-
/bin/chmodchmod 0755 /usr/bin/lsof2⤵PID:1606
-
-
/bin/shsh -c "insmod /usr/lib/xpacket.ko"1⤵PID:1607
-
/sbin/insmodinsmod /usr/lib/xpacket.ko2⤵
- Reads runtime system information
PID:1608
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
50B
MD50b1710699e87eb213db5875a0bef4eeb
SHA1c8e50845bbeccc4ad772d8983f83959e1e1c5bbf
SHA256405dda3a5ddb9cf2e7284ee4d433c53d6c9b4036045bd10e61a474f3be5c02e1
SHA512abdef0595d05849f44fee592a659d0b7a226ea8f435621db3a0ac7d922871d61879cdee5d04c8c340c7c06d2cb724e84dfa910ad6e56ed06ee2e004d6147b4fe
-
Filesize
36B
MD557cde9c165195cfb90c212057795ed49
SHA1d77d9895306eb09ad9b54588fb7998c79c671563
SHA2563e3488e9c63dfadffd594301e2192418b158238bfb8f83d6702123d72892cf36
SHA512de9af53a508167cbbb820a99c2742918ec5b8c83877b77e43e4b441019311685647f47fb4666ba53ecef4e6a2d5514eb67981d471ddf173b04848609b3c0c00d
-
Filesize
4B
MD5b60c5ab647a27045b462934977ccad9a
SHA1aff60c26ab00f0ad980af68c68a926fa11795ef9
SHA2560f8e631d28e2a339b435ea55da61c718da28902056ed719e576ff1c1b4cb2baf
SHA512d8e0a85d197bbd49b2c4586c3e6e29dcdfa203b80c4d3480a4f48f0aeefd87ce3261e56bae531551d6eb007afd221a16df4447d1d4882c846a144754d16b8431
-
Filesize
37B
MD569bffc5e1a48c5503f786465804eec8e
SHA113d603b8d8fa8b765b5b580145c6bfb3d88ec37f
SHA25685bfedd210d3b130b973e3ddb88cc535b6ab6eb2b06bb358337dd74ae0bf310c
SHA512c1fac0aedd8b66c0cf887d29901cdf186c46b7127be9a95e6f92e82bf11f7934eed50c9cc8f7f4c5803f9d9a9eacd62d2e17663538473cf7db0657fcbbb44643
-
Filesize
69B
MD55d3d128f1b932142cdc67365e42a6fd5
SHA195a1566f0df9cc0857b389ab0285a778f0fb0e55
SHA256344444f85c309bc9fd45233857e0bbb62dc549b49abf4cfc3af8d62a1ea1e222
SHA5124f7485ce2ef5fca45c7d1b6a9301f2b0a43b2a125f39c0f9c303cba4f3532cff3eef8ba241870c0744898db07e40dae9dd81538082a1258a5493e6bd6e836206
-
Filesize
1.1MB
MD543195a0298bcc72b72f5687d4bd49c37
SHA190ea668fc256ee75f803da35bad44589cd2caddf
SHA25643056c0ce96c83c1c21263fd163f9a59156cbab1b5b7b713a4409ba5feeb7a7d
SHA5128b169b0f24e2676f05110df630c1a1df40d2b89176ebfcfd7ca59678cfad992b2ff152c041c93c1ea66d2f6be64a3a9adf99b67cc59d582ec14a3c207ab421a1
-
Filesize
159KB
MD5e093dc78225e2a0a25e3b137c1c1e442
SHA1c29497cfaae729eb576875e4fdfa400640ab16be
SHA2561190f4dbc7be174de8fd4096c9bf7a28eebfac937d308b7cc533be4a1240d26e
SHA512fe1cc7a65327732eaaee89f427c10239ba822430e34177842f4681068d78d404b1830d808a2a71b1efcc5f126c6d8c053512237421173aaa150e215a672da6f0
-
Filesize
130KB
MD5558edc26f8a38fa9788220b9af8a73e7
SHA13024d44e580e9c67f32f6c585d50e2a6cc9a7cac
SHA256b76435c80333d2c1fd18e0e7682f1c9dfb5da8d507e93e3c416f54b481c428d5
SHA512edaa425b441044f015e8f68fffa1664e42372d00dd0e7b0924d24ce947aa8e5f96b3bdc326fa2f8b978e3fcf638a1ceca45a223735db73f1607df66990feb56f
-
Filesize
484KB
MD5e968fee2e8940d305e29de48145a7946
SHA17bcaecf18afcf2c9dcb7fde66dcf97cbcd68019a
SHA2568298b009e2af3e05eb4f3b02f8d0d6a2531eff3ef54d52a21575b77c396d5088
SHA512fb9ab44f9010b8b5dc45872611b058587f0adf4c0d54ad93058241bc60f6f7a213914bae31420a2fef20a59dd77d62762586008d8322d7da19e217e8256f40dc