mrblack | 562137459fb942328149138bcd23195611c891e6fbd85a3514a05af092c5bf6a

Analysis

max time kernel
153s
max time network
130s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20231215-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20231215-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
22-12-2023 04:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6b1af22a53c8f23f9cf8635f1658094f
Size

1.2MB
MD5

6b1af22a53c8f23f9cf8635f1658094f
SHA1

fd4663acb83e9a630e2abd847a933e2e08ec547a
SHA256

562137459fb942328149138bcd23195611c891e6fbd85a3514a05af092c5bf6a
SHA512

cfd120169f5cc76ed40758daefe15dfe9136c16ba08274a3ff30e0ccc56970f6e47a22bf4eb0c8f795e71663c583520a7e9a01c579ec1d9a388dc0376ce7be23
SSDEEP

24576:e845rlHu6gVJKG75oFpA0VWlX4G2y1q2rJp0:745wRVJKGtSA0VWloVu9p0

Score

10^/10

mrblack antivm botnet persistence trojan

Malware Config

Signatures

MrBlack Trojan
IoT botnet which infects routers to be used for DDoS attacks.
trojan botnet mrblack

MrBlack trojan 2 IoCs

resource	yara_rule
behavioral1/files/fstream-4.dat	family_mrblack
behavioral1/files/fstream-6.dat	family_mrblack

Executes dropped EXE 2 IoCs

ioc	pid	Process
/usr/bin/bsd-port/getty	1565	getty
/usr/bin/.sshd	1589	.sshd

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

T1497

description	ioc
File opened for reading	/proc/cpuinfo

Modifies init.d 1 TTPs 2 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

description	ioc
File opened for modification	/etc/init.d/DbSecuritySpt
File opened for modification	/etc/init.d/selinux

Reads system routing table 1 TTPs 1 IoCs

Gets active network interfaces from /proc virtual filesystem.

System Network Configuration Discovery

T1016

description	ioc
File opened for reading	/proc/net/route

Write file to user bin folder 1 TTPs 9 IoCs

Hijack Execution Flow

T1574

description	ioc	Process
File opened for modification	/usr/bin/bsd-port/getty.lock	Process not Found
File opened for modification	/usr/bin/bsd-port/conf.n	Process not Found
File opened for modification	/usr/bin/dpkgd/lsof	cp
File opened for modification	/usr/bin/lsof	cp
File opened for modification	/usr/bin/bsd-port/udevd.lock	Process not Found
File opened for modification	/usr/bin/bsd-port/getty	cp
File opened for modification	/usr/bin/.sshd	cp
File opened for modification	/usr/bin/dpkgd/ps	cp
File opened for modification	/usr/bin/dpkgd/ss	cp

Writes file to system bin folder 1 TTPs 2 IoCs

Hijack Execution Flow

T1574

description	ioc	Process
File opened for modification	/bin/ps	cp
File opened for modification	/bin/ss	cp

Reads system network configuration 1 TTPs 3 IoCs

Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery

T1016

description	ioc
File opened for reading	/proc/net/dev
File opened for reading	/proc/net/route
File opened for reading	/proc/net/arp

Reads runtime system information 23 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/stat	Process not Found
File opened for reading	/proc/meminfo	Process not Found
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp

Writes file to tmp directory 5 IoCs

Malware often drops required files in the /tmp directory.

description	ioc
File opened for modification	/tmp/moni.lod
File opened for modification	/tmp/bill.lock
File opened for modification	/tmp/gates.lod
File opened for modification	/tmp/notify.file
File opened for modification	/tmp/conf.n

/tmp/6b1af22a53c8f23f9cf8635f1658094f
/tmp/6b1af22a53c8f23f9cf8635f1658094f
1⤵
PID:1538

/bin/sh
sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt"
1⤵
PID:1543
- /bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt
  2⤵
  PID:1544

/bin/sh
sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt"
1⤵
PID:1545
- /bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt
  2⤵
  PID:1546

/bin/sh
sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt"
1⤵
PID:1547
- /bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt
  2⤵
  PID:1548

/bin/sh
sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt"
1⤵
PID:1549
- /bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt
  2⤵
  PID:1550

/bin/sh
sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt"
1⤵
PID:1551
- /bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt
  2⤵
  PID:1552

/bin/sh
sh -c "mkdir -p /usr/bin/bsd-port"
1⤵
PID:1555
- /bin/mkdir
  mkdir -p /usr/bin/bsd-port
  2⤵
  - Reads runtime system information
  PID:1556

/bin/sh
sh -c "mkdir -p /usr/bin/bsd-port"
1⤵
PID:1557
- /bin/mkdir
  mkdir -p /usr/bin/bsd-port
  2⤵
  - Reads runtime system information
  PID:1558

/bin/sh
sh -c "cp -f /tmp/6b1af22a53c8f23f9cf8635f1658094f /usr/bin/bsd-port/getty"
1⤵
PID:1559
- /bin/cp
  cp -f /tmp/6b1af22a53c8f23f9cf8635f1658094f /usr/bin/bsd-port/getty
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1560

/bin/sh
sh -c /usr/bin/bsd-port/getty
1⤵
PID:1564
- /usr/bin/bsd-port/getty
  /usr/bin/bsd-port/getty
  2⤵
  - Executes dropped EXE
  PID:1565

/bin/sh
sh -c "mkdir -p /usr/bin"
1⤵
PID:1567
- /bin/mkdir
  mkdir -p /usr/bin
  2⤵
  - Reads runtime system information
  PID:1568

/bin/sh
sh -c "mkdir -p /usr/bin"
1⤵
PID:1569
- /bin/mkdir
  mkdir -p /usr/bin
  2⤵
  - Reads runtime system information
  PID:1570

/bin/sh
sh -c "cp -f /tmp/6b1af22a53c8f23f9cf8635f1658094f /usr/bin/.sshd"
1⤵
PID:1571
- /bin/cp
  cp -f /tmp/6b1af22a53c8f23f9cf8635f1658094f /usr/bin/.sshd
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1572

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux"
1⤵
PID:1573
- /bin/ln
  ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux
  2⤵
  PID:1574

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux"
1⤵
PID:1575
- /bin/ln
  ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux
  2⤵
  PID:1576

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux"
1⤵
PID:1577
- /bin/ln
  ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux
  2⤵
  PID:1578

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux"
1⤵
PID:1579
- /bin/ln
  ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux
  2⤵
  PID:1580

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux"
1⤵
PID:1581
- /bin/ln
  ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux
  2⤵
  PID:1582

/bin/sh
sh -c "mkdir -p /usr/bin/dpkgd"
1⤵
PID:1583
- /bin/mkdir
  mkdir -p /usr/bin/dpkgd
  2⤵
  - Reads runtime system information
  PID:1584

/bin/sh
sh -c "cp -f /bin/ps /usr/bin/dpkgd/ps"
1⤵
PID:1585
- /bin/cp
  cp -f /bin/ps /usr/bin/dpkgd/ps
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1586

/bin/sh
sh -c /usr/bin/.sshd
1⤵
PID:1588
- /usr/bin/.sshd
  /usr/bin/.sshd
  2⤵
  - Executes dropped EXE
  PID:1589

/bin/sh
sh -c "mkdir -p /bin"
1⤵
PID:1590
- /bin/mkdir
  mkdir -p /bin
  2⤵
  - Reads runtime system information
  PID:1591

/bin/sh
sh -c "mkdir -p /bin"
1⤵
PID:1592
- /bin/mkdir
  mkdir -p /bin
  2⤵
  - Reads runtime system information
  PID:1593

/bin/sh
sh -c "cp -f /usr/bin/bsd-port/getty /bin/ps"
1⤵
PID:1594
- /bin/cp
  cp -f /usr/bin/bsd-port/getty /bin/ps
  2⤵
  - Writes file to system bin folder
  - Reads runtime system information
  PID:1595

/bin/sh
sh -c "chmod 0755 /bin/ps"
1⤵
PID:1598
- /bin/chmod
  chmod 0755 /bin/ps
  2⤵
  PID:1599

/bin/sh
sh -c "cp -f /bin/ss /usr/bin/dpkgd/ss"
1⤵
PID:1600
- /bin/cp
  cp -f /bin/ss /usr/bin/dpkgd/ss
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1601

/bin/sh
sh -c "mkdir -p /bin"
1⤵
PID:1602
- /bin/mkdir
  mkdir -p /bin
  2⤵
  - Reads runtime system information
  PID:1603

/bin/sh
sh -c "mkdir -p /bin"
1⤵
PID:1604
- /bin/mkdir
  mkdir -p /bin
  2⤵
  - Reads runtime system information
  PID:1605

/bin/sh
sh -c "cp -f /usr/bin/bsd-port/getty /bin/ss"
1⤵
PID:1606
- /bin/cp
  cp -f /usr/bin/bsd-port/getty /bin/ss
  2⤵
  - Writes file to system bin folder
  - Reads runtime system information
  PID:1607

/bin/sh
sh -c "chmod 0755 /bin/ss"
1⤵
PID:1608
- /bin/chmod
  chmod 0755 /bin/ss
  2⤵
  PID:1609

/bin/sh
sh -c "cp -f /usr/bin/lsof /usr/bin/dpkgd/lsof"
1⤵
PID:1610
- /bin/cp
  cp -f /usr/bin/lsof /usr/bin/dpkgd/lsof
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1611

/bin/sh
sh -c "mkdir -p /usr/bin"
1⤵
PID:1612
- /bin/mkdir
  mkdir -p /usr/bin
  2⤵
  - Reads runtime system information
  PID:1613

/bin/sh
sh -c "mkdir -p /usr/bin"
1⤵
PID:1614
- /bin/mkdir
  mkdir -p /usr/bin
  2⤵
  - Reads runtime system information
  PID:1615

/bin/sh
sh -c "cp -f /usr/bin/bsd-port/getty /usr/bin/lsof"
1⤵
PID:1616
- /bin/cp
  cp -f /usr/bin/bsd-port/getty /usr/bin/lsof
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1617

/bin/sh
sh -c "chmod 0755 /usr/bin/lsof"
1⤵
PID:1618
- /bin/chmod
  chmod 0755 /usr/bin/lsof
  2⤵
  PID:1619

/bin/sh
sh -c "insmod /tmp/xpacket.ko"
1⤵
PID:1620
- /sbin/insmod
  insmod /tmp/xpacket.ko
  2⤵
  - Reads runtime system information
  PID:1621

/bin/sh
sh -c "insmod /usr/bin/bsd-port/xpacket.ko"
1⤵
PID:1622
- /sbin/insmod
  insmod /usr/bin/bsd-port/xpacket.ko
  2⤵
  - Reads runtime system information
  PID:1623

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Defense Evasion

Hijack Execution Flow

T1574

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/etc/init.d/DbSecuritySpt

Filesize
50B

MD5
8b2ba9b77e4793a44578115bc84afe00

SHA1
d0a8945152c107b2c16b8c0b2f899e3c48f6d936

SHA256
286ed7768a2d465c772c0047c3cb9d985e31134e98f080fbfc473caf50e3b381

SHA512
5822fdfce80d97af1778cdf5f27f6e0ce99d60828e188ae515f97d414144c8a15ed1c8ae58429864a2064a64c845aebe411313982b7fcfe07c54c450211445c0

Download Submit
/etc/init.d/selinux

Filesize
36B

MD5
993cc15058142d96c3daf7852c3d5ee8

SHA1
0950b8b391b04dd3895ea33cd3141543ebd2525d

SHA256
8171d077918611803d93088409f220c66fae1c670b297e1aa5d8cbd548ce9208

SHA512
0c4256c00a3710f97e92581b552682b36b62afc35fe72622c491323c618c19ea62611ac04ccafc3dfcde2254a2ebbd93b69b66795b16e36332293bed83adb928

Download Submit
/tmp/gates.lod

Filesize
4B

MD5
17e23e50bedc63b4095e3d8204ce063b

SHA1
464f9d1621f0799f4c4b7a2e884b21e4be81d222

SHA256
731d65cdd441fde25333a70782a078911af63ef672e299a906030e16ff66756b

SHA512
500dc81d5bd51e4e1bfa0ccfd7922d2c1da081a86844cd976c5c9e0d896dd78ec1631324cb634142875271e66c4800f8631a7d6dcef2ab5705f758d7e38dd7c3

Download Submit
/tmp/moni.lod

Filesize
4B

MD5
309fee4e541e51de2e41f21bebb342aa

SHA1
ee8abc188469df780d869b862fde433a2327678e

SHA256
a19fbf8bf0530ca46179b803a8234f56276f21c0e7dc2f84c682924b95de5801

SHA512
3fb050c47892b04da1c6021ebb875e271716d181db95965a26350151429613e986e7c7e26060ecd2cb508f5492ba655a52ccba8b2f95a0c88237553165fe8971

Download Submit
/tmp/notify.file

Filesize
37B

MD5
7d019786b8f84dc774de3cb76ce27722

SHA1
0aa86bcde07e4f7922bd7aeafb519fca8aa0ad37

SHA256
e0bfb36c0676b3005a4022fb291a1776d8ed2266c7e443e5a6eced38394f2977

SHA512
72e41aa04687167a5149459701d459c262b08a8c061cc278b568b011e1d1e0bd23d20d1331daa0fb8d1f8d533c14b2d5ca4c787a1efb93ce4a421cd85757cbfe

Download Submit
/usr/bin/.sshd

Filesize
1002KB

MD5
b9ecbb7e7092a9613bb267451dc431a2

SHA1
b03de8d3c0a86393a6a67a0eadb182d7d1abe8e3

SHA256
fb3dc9ab4e2d3d3738b0a3c2b199ecc48a63f6d5f537537d32a300c150b00683

SHA512
d8168a558578bd63e47e3ab48fe9aeac8596b27dff36a773a45d45701ea1eabc613b39a8f5bb20a966573ecc8998c383fc47dabd31dfaf77d135d03142e45bef

Download Submit
/usr/bin/bsd-port/conf.n

Filesize
73B

MD5
3d09c7ee04220846816ef4af5650b064

SHA1
1c5059ca5a7d9d723642ae68ef2ee4b82b6f5f41

SHA256
d2ee533cc5a2193b674dd946062131069d83beb80b8f3c758099ed5246c2b1c9

SHA512
cbe8e7e5fdbce55889c80ce32bb9ccc390b92519eb17f1abe0a267f48f9866c84617fbd6ce8dc011a50189877fc50a406c9308cc834b282cbba0fe65b0d22c96

Download Submit
/usr/bin/bsd-port/getty

Filesize
1.2MB

MD5
6b1af22a53c8f23f9cf8635f1658094f

SHA1
fd4663acb83e9a630e2abd847a933e2e08ec547a

SHA256
562137459fb942328149138bcd23195611c891e6fbd85a3514a05af092c5bf6a

SHA512
cfd120169f5cc76ed40758daefe15dfe9136c16ba08274a3ff30e0ccc56970f6e47a22bf4eb0c8f795e71663c583520a7e9a01c579ec1d9a388dc0376ce7be23

Download Submit
/usr/bin/dpkgd/lsof

Filesize
159KB

MD5
e093dc78225e2a0a25e3b137c1c1e442

SHA1
c29497cfaae729eb576875e4fdfa400640ab16be

SHA256
1190f4dbc7be174de8fd4096c9bf7a28eebfac937d308b7cc533be4a1240d26e

SHA512
fe1cc7a65327732eaaee89f427c10239ba822430e34177842f4681068d78d404b1830d808a2a71b1efcc5f126c6d8c053512237421173aaa150e215a672da6f0

Download Submit
/usr/bin/dpkgd/ps

Filesize
130KB

MD5
558edc26f8a38fa9788220b9af8a73e7

SHA1
3024d44e580e9c67f32f6c585d50e2a6cc9a7cac

SHA256
b76435c80333d2c1fd18e0e7682f1c9dfb5da8d507e93e3c416f54b481c428d5

SHA512
edaa425b441044f015e8f68fffa1664e42372d00dd0e7b0924d24ce947aa8e5f96b3bdc326fa2f8b978e3fcf638a1ceca45a223735db73f1607df66990feb56f

Download Submit
/usr/bin/dpkgd/ss

Filesize
136KB

MD5
1dc929b5f2cd12fe6a2fe71140d2a9e3

SHA1
f9995a92bb201b1b7738a39a38570ef0c40b52d2

SHA256
418aae1da62554afe9f260866267af328fd761b3fd6f90f0ea53d543e2fefc38

SHA512
fbed011c595084548db440dfbe485b7d27032a44a6ae9e141fe43f31c8c524ff9347135ab035deb441fca99e5a3794f7bb9194f148aa2f60f1547a7c67d47373

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads