Analysis
-
max time kernel
156s -
max time network
132s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20231215-en -
resource tags
-
submitted
22-12-2023 05:26
General
-
Target
714e87aa41eaacdfa4db58f2a5ff1fd7
-
Size
1.5MB
-
MD5
714e87aa41eaacdfa4db58f2a5ff1fd7
-
SHA1
5e3cde5a8503c727bcb781ffb657b89cf2ec9c37
-
SHA256
59883c11aa8c0c703b3fc5338a00c90dd79d374f7c3ef214e6f217e601ff4742
-
SHA512
e80800713412589a0b2fb70b4759d0ce93fc3db0e7984fee9c2b2ddf6faffc6b2f3792bd219aa8687374dada2e2218fa4ad3fdd98c9b02a52578691d6f112226
-
SSDEEP
24576:GA46TrzJBisiOvhlOHdSbQmHyJgf/kgX0Exb2cyaGpIoiMynnLmYXqSYKKZdTrnD:zRNi6OHdSbQoyJyXpxb2PaGpXiMynLmB
Malware Config
Signatures
-
MrBlack Trojan
IoT botnet which infects routers to be used for DDoS attacks.
-
MrBlack trojan 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
-
Modifies init.d 1 TTPs 2 IoCs
Adds/modifies system service, likely for persistence.
-
Write file to user bin folder 1 TTPs 7 IoCs
-
Writes file to system bin folder 1 TTPs 1 IoCs
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
-
Reads runtime system information 15 IoCs
Reads data from /proc virtual filesystem.
-
Writes file to tmp directory 4 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/714e87aa41eaacdfa4db58f2a5ff1fd7/tmp/714e87aa41eaacdfa4db58f2a5ff1fd71⤵
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt"1⤵
-
/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt2⤵
-
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt"1⤵
-
/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt2⤵
-
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt"1⤵
-
/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt2⤵
-
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt"1⤵
-
/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt2⤵
-
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt"1⤵
-
/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt2⤵
-
-
/bin/shsh -c "mkdir -p /usr/bin/bsd-port"1⤵
-
/bin/mkdirmkdir -p /usr/bin/bsd-port2⤵
- Reads runtime system information
-
-
/bin/shsh -c "cp -f /tmp/714e87aa41eaacdfa4db58f2a5ff1fd7 /usr/bin/bsd-port/getty"1⤵
-
/bin/cpcp -f /tmp/714e87aa41eaacdfa4db58f2a5ff1fd7 /usr/bin/bsd-port/getty2⤵
- Write file to user bin folder
- Reads runtime system information
-
-
/bin/shsh -c /usr/bin/bsd-port/getty1⤵
-
/usr/bin/bsd-port/getty/usr/bin/bsd-port/getty2⤵
- Executes dropped EXE
-
-
/bin/shsh -c "mkdir -p /usr/bin"1⤵
-
/bin/mkdirmkdir -p /usr/bin2⤵
- Reads runtime system information
-
-
/bin/shsh -c "cp -f /tmp/714e87aa41eaacdfa4db58f2a5ff1fd7 /usr/bin/.sshd"1⤵
-
/bin/cpcp -f /tmp/714e87aa41eaacdfa4db58f2a5ff1fd7 /usr/bin/.sshd2⤵
- Write file to user bin folder
- Reads runtime system information
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux"1⤵
-
/bin/lnln -s /etc/init.d/selinux /etc/rc1.d/S99selinux2⤵
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux"1⤵
-
/bin/lnln -s /etc/init.d/selinux /etc/rc2.d/S99selinux2⤵
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux"1⤵
-
/bin/lnln -s /etc/init.d/selinux /etc/rc3.d/S99selinux2⤵
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux"1⤵
-
/bin/lnln -s /etc/init.d/selinux /etc/rc4.d/S99selinux2⤵
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux"1⤵
-
/bin/lnln -s /etc/init.d/selinux /etc/rc5.d/S99selinux2⤵
-
-
/bin/shsh -c "mkdir -p /usr/bin/dpkgd"1⤵
-
/bin/mkdirmkdir -p /usr/bin/dpkgd2⤵
- Reads runtime system information
-
-
/bin/shsh -c "cp -f /bin/ps /usr/bin/dpkgd/ps"1⤵
-
/bin/cpcp -f /bin/ps /usr/bin/dpkgd/ps2⤵
- Write file to user bin folder
- Reads runtime system information
-
-
/bin/shsh -c /usr/bin/.sshd1⤵
-
/usr/bin/.sshd/usr/bin/.sshd2⤵
- Executes dropped EXE
-
-
/bin/shsh -c "mkdir -p /bin"1⤵
-
/bin/mkdirmkdir -p /bin2⤵
- Reads runtime system information
-
-
/bin/shsh -c "insmod /usr/lib/xpacket.ko"1⤵
-
/sbin/insmodinsmod /usr/lib/xpacket.ko2⤵
- Reads runtime system information
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/getty /bin/ps"1⤵
-
/bin/cpcp -f /usr/bin/bsd-port/getty /bin/ps2⤵
- Writes file to system bin folder
- Reads runtime system information
-
-
/bin/shsh -c "chmod 0755 /bin/ps"1⤵
-
/bin/chmodchmod 0755 /bin/ps2⤵
-
-
/bin/shsh -c "cp -f /usr/bin/lsof /usr/bin/dpkgd/lsof"1⤵
-
/bin/cpcp -f /usr/bin/lsof /usr/bin/dpkgd/lsof2⤵
- Write file to user bin folder
- Reads runtime system information
-
-
/bin/shsh -c "mkdir -p /usr/bin"1⤵
-
/bin/mkdirmkdir -p /usr/bin2⤵
- Reads runtime system information
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/getty /usr/bin/lsof"1⤵
-
/bin/cpcp -f /usr/bin/bsd-port/getty /usr/bin/lsof2⤵
- Write file to user bin folder
- Reads runtime system information
-
-
/bin/shsh -c "chmod 0755 /usr/bin/lsof"1⤵
-
/bin/chmodchmod 0755 /usr/bin/lsof2⤵
-
-
/bin/shsh -c "insmod /usr/lib/xpacket.ko"1⤵
-
/sbin/insmodinsmod /usr/lib/xpacket.ko2⤵
- Reads runtime system information
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
50B
MD54d3533bd4668f2fbb0059ee62e0d47d6
SHA1b6a1201c29c30f4e271e2d6d8e33b583b8b5ee3d
SHA25637ebf7afbd771ce7c085185cc2af32e0c61f29d12dde0241ea3a27b20b6ef972
SHA512017dadd9f0ccf877e62efe70c06f450e2a55541783a417d94b8f69e10bbcaeaf7db9dc04c6e3ed0aed38f2d0231904a497fa2ec3ccb679b379b1a24f8a2523ae
-
Filesize
36B
MD5993cc15058142d96c3daf7852c3d5ee8
SHA10950b8b391b04dd3895ea33cd3141543ebd2525d
SHA2568171d077918611803d93088409f220c66fae1c670b297e1aa5d8cbd548ce9208
SHA5120c4256c00a3710f97e92581b552682b36b62afc35fe72622c491323c618c19ea62611ac04ccafc3dfcde2254a2ebbd93b69b66795b16e36332293bed83adb928
-
Filesize
4B
MD518ead4c77c3f40dabf9735432ac9d97a
SHA1c78296aa3aa7f4083d9c41486953aded522a1f26
SHA2568012472a35fd40939e08041936918ad9f975579bff2519a6fa568774057a799c
SHA512179782f7b2664999af5a2125d0deac589d23ceda652b9e4f080ee081c2a29fe65de14d7d4f8bcbc307da0d16f0a789884bbdd01653a87ec4de1700ee02030324
-
Filesize
4B
MD5309fee4e541e51de2e41f21bebb342aa
SHA1ee8abc188469df780d869b862fde433a2327678e
SHA256a19fbf8bf0530ca46179b803a8234f56276f21c0e7dc2f84c682924b95de5801
SHA5123fb050c47892b04da1c6021ebb875e271716d181db95965a26350151429613e986e7c7e26060ecd2cb508f5492ba655a52ccba8b2f95a0c88237553165fe8971
-
Filesize
37B
MD5329d7c2f44358aaab1fb6f00cea2fccc
SHA14509543389978731a0a907f4fbeef7860d2cf122
SHA2563b8bf4a1aedd101792ff0a5876e6a084f112fc81a838d78b4181f6d88f4f2994
SHA5123e617e5dea0e127de0e32826b2c8d627daa4d4a0e6c1ab7ea0f296247cdc23438c0e1be4c7cd7df90b7303904393f0c3e465d0ea8578eeb198dad765cadee99b
-
Filesize
1.5MB
MD5714e87aa41eaacdfa4db58f2a5ff1fd7
SHA15e3cde5a8503c727bcb781ffb657b89cf2ec9c37
SHA25659883c11aa8c0c703b3fc5338a00c90dd79d374f7c3ef214e6f217e601ff4742
SHA512e80800713412589a0b2fb70b4759d0ce93fc3db0e7984fee9c2b2ddf6faffc6b2f3792bd219aa8687374dada2e2218fa4ad3fdd98c9b02a52578691d6f112226
-
Filesize
159KB
MD5e093dc78225e2a0a25e3b137c1c1e442
SHA1c29497cfaae729eb576875e4fdfa400640ab16be
SHA2561190f4dbc7be174de8fd4096c9bf7a28eebfac937d308b7cc533be4a1240d26e
SHA512fe1cc7a65327732eaaee89f427c10239ba822430e34177842f4681068d78d404b1830d808a2a71b1efcc5f126c6d8c053512237421173aaa150e215a672da6f0